Introduction
On 1 July 2026, the Central Bank of Nigeria’s Guidelines on Instant Payment Functionalities for Financial Institutions came into force. The Guidelines were issued by circular dated 12 March 2026, signed by Musa Jimoh, Director of the Payments System Policy Department, and gave institutions a transition window to align their systems with new minimum security standards.
The measures respond to sustained losses from SIM-swap fraud and unauthorised account takeovers – losses that sit within a broader pattern the CBN has been moving to address. They apply to banks, other financial institutions and payment service providers offering instant payment services, which in practice captures virtually every licensed operator in Nigeria’s digital payments market.
Key Requirements
- Device binding: a mobile banking application may be active on only one device at a time. Concurrent logins across multiple devices are prohibited, and migration to a new device automatically triggers re-activation and fresh authentication.
- Transaction cap: on activation of an application on a new device, and for newly opened accounts, transactions are limited during the first 24 hours to a ceiling of ₦20,000. Institutions may set lower internal thresholds.
- Enhanced authentication: first-time login to internet banking on a new device requires enhanced multi-factor authentication.
- Identity verification: digital account opening and reactivation must include liveliness checks and real-time verification against BVN or NIN databases.
- Fraud monitoring: institutions must deploy enterprise fraud monitoring systems capable of tracking inflows and outflows in real time. This complements a related CBN requirement for institutions to maintain temporary watchlists for suspicious BVNs, giving them up to 24 hours to contact the customer and investigate before a flagged transfer completes.
Existing instant payment thresholds are retained at ₦25 million for individual accounts and ₦250 million for corporate accounts, though institutions may adjust these upward for a given customer following enhanced due diligence and multi-factor authentication.
Legal and Regulatory Implications
- For banks and payment service providers: The circular does not itself prescribe penalties, but supervisory consequences under the Banks and Other Financial Institutions Act 2020 would ordinarily apply. Institutions should document system alignment and retain evidence of compliance.
- For fintech operators: Device binding removes the discretion institutions previously exercised over access controls. Onboarding flows, customer dispute procedures and exception-handling policies should be reviewed against the new standard.
- For merchants and commercial counterparties: The 24-hour cap introduces settlement friction where a principal changes device. Agreements with payment-dependent performance obligations should account for this risk.
- For data governance: Reliance on liveliness checks and BVN or NIN verification engages obligations under the Nigeria Data Protection Act 2023, particularly on lawful basis, data minimisation and the security of biometric data.
The Road Ahead
Early indications suggest no system-wide disruption. Practical questions remain, however, around shared-device households and customers who exhaust the single lifetime change to the BVN-linked telephone number permitted since 1 May 2026.
Institutions should anticipate supervisory review of compliance over the coming months and monitor how the CBN addresses edge cases as they emerge in practice.
Further information on the legal and regulatory developments discussed in this newsletter is available at www.scp-law.com or by contacting us at info@scp-law.com.
