Baobyte AML Suite
Book a demo

Microfinance banks

A full compliance programme, run by two people

Proportionality lets a microfinance bank size its controls to its risk. It does not let the bank skip one. This page is about meeting the whole obligation with the team you actually have — and being able to prove you did.

  • CBN-licensed
  • Unit, state and national
  • Two- or three-person compliance function
  • Agent and cash exposure

Obligations

What a microfinance bank owes, stated plainly

Qualitative by design. Where a specific figure or cycle would help, your compliance counsel is the source — not a vendor page that may be a revision behind.

CBNThe full programme, sized to the institution
A microfinance bank is a CBN-licensed financial institution and carries a compliance programme obligation: board-approved policy, a designated compliance officer and reporting officer, risk assessment, CDD, monitoring, record keeping, training and independent testing. The risk-based approach permits controls proportionate to size and complexity. It does not remove a single one of those headings.
CBNLicence footprint shapes the customer base, not the duty
Unit, state and national authorisations differ in where a bank may operate and how it may grow, which changes the geographic and product risk in its assessment. Every category still owes the same categories of control; the assessment is where the difference is expressed.
NFIUSuspicious transaction reporting with a named reporting officer
The obligation to report suspicion to the Nigerian Financial Intelligence Unit does not scale down with the balance sheet, and a small institution has the same duty to document why an alert was closed without a report as a large one.
CBNAgent networks and cash remain the institution's risk
Where onboarding or cash handling is performed through agents, the risk stays with the licensed bank. That makes agent onboarding, agent-level activity visibility and the ability to see the same customer across agents part of the AML programme rather than an operations concern.
NDPAData protection with no dedicated privacy team
Customer identity data attracts the same lawful-basis, retention and subject-rights duties whether or not the institution employs anyone whose title mentions privacy. Defined retention and restricted, reviewable access to sensitive fields are the practical answer.
Internal auditIndependent testing when the second and third lines are one floor apart
Small institutions frequently outsource or co-source independent testing. Whoever performs it needs to retrieve evidence themselves, read-only, without asking the compliance officer to assemble the sample they are being tested on.

Proportionality

What proportionality can flex, and what it cannot

Read the right-hand column first. Everything in it survives any argument about institution size, and it is where small-bank examinations are actually lost.

Proportionality: the flexible part and the fixed part
ControlCan be sized downCannot be dropped
Risk assessmentShorter, focused on the products and geographies you actually serveHaving one, keeping it current, and being able to show it drove your controls
CDD depthSimplified measures for demonstrably lower-risk relationshipsIdentifying and verifying the customer, and applying enhanced measures where risk is higher
MonitoringFewer rules, targeted at your real typologiesMonitoring at all, and being able to explain why an alert was closed
Independent testingOutsourced or co-sourced rather than an in-house departmentBeing genuinely independent of the function it tests
GovernanceA checker drawn from outside the compliance functionSomeone other than the maker approving a sensitive change
ReportingVolume — you may file few reportsFiling when there is suspicion, and documenting the decision when there is not

Operational reality

What actually makes this hard at this size

  • The compliance function is two people, and one of them is on leaveEverything on this page has to survive a week with one person available. That means the system has to hold context — not the person — and the default configuration has to be good enough on day one that nobody is designing a risk model from scratch between customer visits.
  • Four-eyes is a real problem when the team is twoMaker-checker is not optional on sensitive changes, and a two-person team hits the wall immediately: the compliance officer proposes and the compliance officer approves. The honest answer is a named checker outside the function — a head of operations, a director, an outsourced reviewer — configured as such, plus time-bound, reason-coded emergency access when the checker is genuinely unreachable, reviewed after the event.
  • False positives are not an inconvenience, they are the whole budgetA Tier-1 bank absorbs a noisy rule by adding an analyst. A microfinance bank cannot. Screening and monitoring configuration that produces four hundred alerts a week is not a tuning problem here; it is the difference between a programme that operates and one that exists on paper.
  • Nobody has time to build a configuration from an empty screenThe realistic starting point is a signed, versioned content pack with sensible defaults that the institution then adjusts — not a blank rule engine and a two-week workshop. Defaults still have to be owned and approved locally, but they should not have to be invented locally.
  • The examiner arrives and the evidence is in a filing cabinetScanned identity documents in folders, alerts in a spreadsheet, decisions in an email thread. Each is defensible individually; together they cannot demonstrate that a policy was applied consistently, because there is no single record that says so.
  • There is no IT team to run a platformDeployment, backups, patching and identity federation cannot land on the compliance officer. That makes hosting model, upgrade path and the operational support boundary an AML question at this size, not just a procurement one.

Platform

Which capabilities carry this segment

Fewer moving parts than the Tier-1 configuration, deliberately. Every capability here is one the institution will use weekly.

Customer and CDD

Governed CDD forms with defaults you adjust rather than design, structured Nigerian addresses down to LGA, and ownership declarations captured once and reused.

Learn more

Screening and watchlists

Sanctions and PEP adjudication with retained match evidence, tuned so a two-person team can actually clear the queue — and with every clearance defensible later.

Learn more

Transaction monitoring

A small set of explainable rules you can defend line by line, versioned, with the evaluation evidence kept against each alert.

Learn more

Investigation and casework

One case per subject rather than one spreadsheet row per alert, so a week's absence does not lose the thread of an investigation.

Learn more

Governed reporting

Report content generated from governed mappings with review and approval evidence, so the reporting officer is not re-typing a narrative into a separate form.

Learn more

Implementation

A defined path from discovery to go-live, because an implementation that assumes a project team is an implementation a microfinance bank cannot staff.

Learn more

Examination readiness

What you can produce without a fire drill

  • A current risk assessment with a visible link to the CDD tiers and monitoring rules actually configured.
  • Every customer file retrievable in one place, with identity evidence, ownership declarations and the risk rating that was applied.
  • The reasoning behind each closed alert, retained with the rule version that raised it.
  • Approval records showing that the maker of a sensitive change was not its checker — including the escalations where an outside checker was used.
  • Training and access-review records held alongside the operational evidence rather than in a separate binder.
  • A retention schedule that is configured and enforced, not described in a policy nobody applies.

Proof

Microfinance bank case study

Reserved for an institution that has approved publication.

Placeholder — no microfinance bank engagement has been approved for publication. Replace with sourced, approved content before this page is made public.

Reserved for a microfinance bank that has approved publication

The write-up will cover the starting position, what was configured versus what was integrated, how long go-live took with the institution's own staffing, and what the examination that followed looked like.

Challenge
Team size, alert load and where the evidence lived before.
Approach
Which content pack was adopted, what was changed locally, and by whom.
Result
Outcomes stated by the institution against a defined baseline.

—

Weekly alert load

Awaiting a figure the institution will stand behind.

—

Time to go-live

Awaiting an actual project record, not a target.

—

Examination outcome

Awaiting written permission to describe it.

Questions

What microfinance banks ask first

We have two people in compliance. Is this too much system for us?
The question to test it against is not headcount, it is whether your evidence currently lives in one retrievable place. If it lives across a spreadsheet, a shared drive and an inbox, the effort of a platform is mostly migration, and the ongoing cost is lower than the current cost of assembling an examination sample by hand.
How do we operate maker-checker with a two-person team?
By configuring a checker outside the compliance function — commonly a head of operations, a director, or an outsourced reviewer with a scoped role. Emergency access exists for the genuine deadlock case, but it is time-bound, reason-coded, audited and reviewed afterwards rather than being a permanent workaround.
Can we start with defaults rather than designing everything?
Yes. Forms, rules, risk weights and watchlist configuration ship as signed, versioned content packs. What the packs cannot do is accept themselves — activation still runs through your own proposal and approval, because a control nobody in the institution has approved is a control nobody in the institution owns.
Does proportionality mean fewer obligations?
No. It means the depth of a control can be sized to your risk and complexity. The obligation to have the control, to apply it consistently and to evidence it does not change. The table above is the version of that answer worth keeping.

Related reading

Start the conversation

Bring one week of your alert queue

The fastest way to size this honestly is to look at a real week: how many alerts, how many were noise, how long a single customer file takes to assemble today. That conversation is more useful than a feature tour, and it works either way.

Book a demoSee pricing by institution size