Checklist de conformité KYC, KYB et AML
Nigeria KYC, KYB & AML
A general Nigerian MLPPA and TPPA implementation baseline, with a detailed overlay for financial institutions supervised by the Central Bank of Nigeria. It is not a complete checklist for DNFBPs, capital-market operators, insurers, pension operators or virtual asset service providers; those entities must apply the relevant SCUML, SEC, NAICOM, PenCom and other sector rules.
- Revue le
- 15 July 2026
- Version
- 1.1
- domaines de contrôle
- 7
- contrôles d’implémentation
- 45
Réponse directe
Que couvre la checklist de conformité pour Nigeria ?
La checklist pour Nigeria traduit les principales règles KYC, KYB et AML en 7 domaines de contrôle et 45 contrôles d’implémentation, avec les autorités, obligations de déclaration et preuves à conserver.
Faits réglementaires clés
- Supervision and reporting
- CBN, SEC, NAICOM, PenCom or SCUML by activity; STRs to NFIU
- Core CDD rules for CBN FIs
- CBN CDD Regulations, 2023
- Record retention
- At least 5 years
- Suspicion reporting
- Immediately; statutory 24-hour rule
Détail d’implémentation
Exigences et actions de conformité pour Nigeria
Ouvrez chaque domaine pour consulter l’exigence, l’action recommandée, les preuves à conserver et la source primaire utilisée.
01Applicability and governanceDetermine the entity's regulatory perimeter before translating AML obligations into accountable controls.6 éléments+
Map the regulated activity
- Action d’implémentation
- Document the services and authorization. CBN supervises specified banks, OFIs and payment institutions; SEC supervises capital-market operators and VASPs; NAICOM supervises insurance institutions; PenCom supervises pension operators; and SCUML supervises DNFBPs.
- Preuves à conserver
- Regulatory-perimeter assessment and license map
- Source primaire
- MLPPA 2022, s.30; applicable sector rules
Confirm reporting and registration channels
- Action d’implémentation
- Identify the licensing and AML supervisor, NFIU route and every sector-return destination. FIs generally use goAML for STRs and applicable threshold reports. RapidAML is used by CBN entities excluding BDCs for nil and PEP reports; BDCs for STR, CTR, nil and PEP reports; SEC- and NAICOM-regulated entities for nil reports; and SCUML-regulated DNFBPs for STRs. DNFBPs submit applicable CTR, CBTR, public-sector, PEP and training returns to SCUML. Confirm current portal instructions.
- Preuves à conserver
- Registration confirmations and channel matrix
- Source primaire
- NFIU RapidAML; SCUML S.I. No. 39
Do not infer regulation from the fintech label
- Action d’implémentation
- A technology provider is not automatically a reporting entity. Record which regulated service, license, agency or outsourcing arrangement creates direct or contractual obligations.
- Preuves à conserver
- Service-to-obligation mapping
- Source primaire
- MLPPA definitions and applicable licensing law
Appoint accountable compliance leadership
- Action d’implémentation
- Designate a qualified AML/CFT/CPF compliance officer with authority, independence, resources and direct access to senior management or the board.
- Preuves à conserver
- Appointment letter, mandate and escalation chart
- Source primaire
- CBN AML/CFT/CPF Regulations 2022
Maintain an enterprise risk assessment
- Action d’implémentation
- Assess customer, product, geography, delivery-channel, transaction and emerging-technology risks and update the assessment for material changes.
- Preuves à conserver
- Approved business-wide risk assessment
- Source primaire
- CBN risk-based supervision and applicable sector rules
Approve and test the AML program
- Action d’implémentation
- Maintain risk-based policies, internal controls, staff training, management information and independent testing proportionate to the institution's scope.
- Preuves à conserver
- Board-approved program, training record and audit plan
- Source primaire
- MLPPA 2022 and applicable regulator rules
02KYC for natural personsIdentify and independently verify the customer, understand the relationship and document the expected financial profile.6 éléments+
Prohibit anonymous or fictitious accounts
- Action d’implémentation
- Do not establish or maintain anonymous, numbered or fictitious-name accounts.
- Preuves à conserver
- Onboarding rule and exception report
- Source primaire
- CBN CDD Regulations 2023, reg. 4
Collect required identity particulars
- Action d’implémentation
- For a natural person under the CBN overlay, obtain legal and other names used; permanent physical and residential addresses; telephone, email and social-media handle; date and place of birth; BVN; TIN; nationality; occupation, public position and employer; an official identifier from an unexpired government document bearing name, photograph and signature; relationship type; signature; and PEP status.
- Preuves à conserver
- Completed customer profile
- Source primaire
- CBN CDD Regulations 2023, reg. 6
Verify identity independently
- Action d’implémentation
- Verify identity using reliable independent documents, data or information, including an unexpired government-issued document appropriate to the customer.
- Preuves à conserver
- Document copy, authenticity result and audit trail
- Source primaire
- CBN CDD Regulations 2023, reg. 7
Verify birth, address and contacts
- Action d’implémentation
- Confirm birth data from a valid official record; verify residential address through physical visitation and corroborating evidence such as a utility bill, tax assessment, bank statement or public-authority letter; obtain positive contact confirmation; and, particularly for wallet providers, validate phone numbers through an independent process such as the NCC database or geospatial checks.
- Preuves à conserver
- Address, contact and phone-verification results
- Source primaire
- CBN CDD Regulations 2023, reg. 7(2)
Understand purpose and source of funds
- Action d’implémentation
- Record the intended nature, expected transaction pattern, occupation or business, source of income and expected origin of funds.
- Preuves à conserver
- Purpose and financial-profile statement
- Source primaire
- CBN CDD Regulations 2023, regs. 10-11
Resolve incomplete CDD
- Action d’implémentation
- If required CDD cannot be completed, do not open the account, establish the relationship or execute the transaction. Terminate an existing or prematurely commenced relationship where applicable and file an STR to NFIU. If continuing CDD would create tipping-off risk, stop CDD and file the STR immediately.
- Preuves à conserver
- Decline, exit and STR record
- Source primaire
- CBN CDD Regulations 2023, regs. 19 and 22; SCUML regs. 23-24
03KYB for legal persons and arrangementsVerify legal existence and authority, then trace ownership and control to the relevant natural persons.6 éléments+
Verify legal existence and status
- Action d’implémentation
- Search the CAC or another reliable registry and obtain incorporation or registration evidence, registration number, legal form and governing documents.
- Preuves à conserver
- Current registry result and certified documents
- Source primaire
- CBN CDD Regulations 2023, regs. 6(b) and 7(3)
Understand the business
- Action d’implémentation
- Confirm registered and operating addresses, nature and purpose of activity, expected transactions, operating footprint and financial profile.
- Preuves à conserver
- Business profile, address evidence and financial information
- Source primaire
- CBN CDD Regulations 2023, regs. 6(b), 7(3), 10-11
Verify authority and connected persons
- Action d’implémentation
- Obtain the board resolution or equivalent mandate and identify and verify directors, senior management, controllers and authorized signatories.
- Preuves à conserver
- Mandate, connected-person register and KYC files
- Source primaire
- CBN CDD Regulations 2023, regs. 6(b), 8 and 9
Identify and verify beneficial owners
- Action d’implémentation
- Understand the ownership and control structure and identify and verify natural persons who ultimately own or control the customer, including control through voting rights or other means.
- Preuves à conserver
- Ownership chart, BO declaration and verified BO KYC
- Source primaire
- CBN CDD Regulations 2023, regs. 5 and 8
Check persons with significant control
- Action d’implémentation
- Compare declarations with the CAC beneficial-ownership register. Treat the PSC threshold of at least 5% or other control tests as a disclosure trigger, not a safe harbor that replaces broader BO analysis.
- Preuves à conserver
- CAC PSC result and discrepancy assessment
- Source primaire
- CAC PSC Regulations 2022
Maintain a beneficial-owner register
- Action d’implémentation
- For CBN-supervised FIs, maintain names, identification details, nature of ownership, shareholding, voting rights, controlling interests, source of wealth and PEP status.
- Preuves à conserver
- Current BO register and change history
- Source primaire
- CBN CDD Regulations 2023, reg. 8(f)
04Risk assessment and screeningUse documented risk factors and current lists to determine standard, simplified or enhanced due diligence.5 éléments+
Assign and explain customer risk
- Action d’implémentation
- Assess customer, ownership, geography, product, service, channel and transaction risks before approval and retain the rationale.
- Preuves à conserver
- Risk score, rationale and approval
- Source primaire
- CBN CDD Regulations 2023, reg. 15
Apply targeted financial sanctions
- Action d’implémentation
- Screen prospective and existing customers, BOs, directors, signatories, agents and transaction parties against current UN and Nigeria lists before onboarding or transactions, on list updates and ongoing. On a confirmed match, freeze without delay or prior notice all directly, indirectly or jointly owned or controlled assets, prohibit funds or services, report immediately to NIGSAC, NFIU and the sector regulator, and do not unfreeze without authorization.
- Preuves à conserver
- Screening, freeze and reporting audit trail
- Source primaire
- TPPA 2022; NIGSAC TFS Guidance
Apply PEP controls
- Action d’implémentation
- Identify foreign, domestic and international-organization PEPs among customers and BOs, including relevant family and close associates. Risk-rate, obtain senior approval, apply EDD to foreign and higher-risk PEPs, establish source of funds and wealth, and enhance monitoring. PEP status alone does not require an STR; map applicable PEP returns separately.
- Preuves à conserver
- PEP result, approval, source analysis and monitoring plan
- Source primaire
- CBN PEP Guidance 2023
Use adverse information proportionately
- Action d’implémentation
- Review reliable public information where relevant, distinguish allegation from verified fact and record the risk decision.
- Preuves à conserver
- Adverse-information review and disposition
- Source primaire
- Risk-based approach
Keep country risk current
- Action d’implémentation
- Use current FATF, GIABA and Nigerian guidance. Record that Nigeria left FATF increased monitoring in October 2025 rather than applying an obsolete automatic high-risk label.
- Preuves à conserver
- Country-risk methodology and update log
- Source primaire
- FATF Nigeria country profile
05Enhanced due diligenceApply additional verification, approval and monitoring where higher ML, TF or PF risk is identified.5 éléments+
Collect and corroborate additional information
- Action d’implémentation
- Obtain additional customer, beneficial-owner, business, purpose and transaction information and verify material claims with reliable sources.
- Preuves à conserver
- EDD pack and corroboration record
- Source primaire
- CBN CDD Regulations 2023, reg. 17
Establish source of funds and wealth
- Action d’implémentation
- Obtain and assess source of funds and source of wealth to a depth proportionate to the higher-risk scenario.
- Preuves à conserver
- Source evidence and plausibility analysis
- Source primaire
- CBN CDD Regulations 2023, reg. 17(2)(c)
Obtain senior-management approval
- Action d’implémentation
- Require documented senior approval to establish or continue higher-risk relationships and impose any conditions.
- Preuves à conserver
- Approval and conditions
- Source primaire
- CBN CDD Regulations 2023, reg. 17(2)(e)
Increase monitoring
- Action d’implémentation
- Increase the number, frequency or depth of controls and select transaction patterns for closer examination.
- Preuves à conserver
- EDD monitoring plan and case history
- Source primaire
- CBN CDD Regulations 2023, reg. 17(2)(f)
Control non-face-to-face risk
- Action d’implémentation
- Apply the applicable e-KYC and non-face-to-face controls, including measures addressing impersonation, document fraud, device or channel risk and first-payment requirements where relevant.
- Preuves à conserver
- Digital-onboarding control assessment
- Source primaire
- CBN CDD Regulations 2023, regs. 14 and 35
06Ongoing due diligence and automated monitoringKeep customer knowledge current and ensure monitoring technology remains governed, testable and fit for the institution's risks.5 éléments+
Monitor throughout the relationship
- Action d’implémentation
- Scrutinize transactions for consistency with customer knowledge, business, risk profile and source of funds, and investigate complex or unusual activity.
- Preuves à conserver
- Monitoring rules, alerts and investigation outcomes
- Source primaire
- CBN CDD Regulations 2023, reg. 12
Refresh records by risk
- Action d’implémentation
- For CBN-supervised FIs, review existing records at least every 12 months for high risk, 18 months for medium risk and three years for low risk, or earlier when a trigger arises.
- Preuves à conserver
- Risk-based review schedule and refreshed file
- Source primaire
- CBN CDD Regulations 2023, reg. 23(b)
Rescreen and reassess on change
- Action d’implémentation
- Trigger rescreening and risk reassessment for ownership, management, product, geography, behavior or list changes.
- Preuves à conserver
- Event-driven review and rescreening history
- Source primaire
- Ongoing CDD obligation
Implement the mandatory 2026 CBN standards
- Action d’implémentation
- For every CBN circular addressee, implement the Baseline Standards as mandatory minimum requirements effective 10 March 2026. The approved roadmap was due within three months and is overdue if not submitted. DMBs have 18 months for full compliance; OFIs and applicable non-DMB addressees have 24 months, subject to written CBN classification or direction.
- Preuves à conserver
- Submitted roadmap, gap plan and accountable owners
- Source primaire
- CBN circulars of 10 and 31 March 2026
Prove institution-level effectiveness
- Action d’implémentation
- Demonstrate institutional accountability, consolidated customer-risk visibility, data and system integration, governance, model or scenario testing, alert and case management, auditability, access controls, change management and operational effectiveness. Vendor claims alone do not establish compliance.
- Preuves à conserver
- Architecture, validation, testing and governance records
- Source primaire
- CBN Baseline Standards 2026
07Reporting, records, privacy and assuranceEscalate suspicion without delay, preserve retrievable evidence and process personal data lawfully.12 éléments+
Escalate suspicion internally
- Action d’implémentation
- Give staff a confidential route to escalate unusual transactions or activity promptly to the compliance function without alerting the customer.
- Preuves à conserver
- Escalation procedure, cases and training
- Source primaire
- MLPPA 2022, s.7
File STRs without delay
- Action d’implémentation
- File to NFIU immediately once the statutory suspicion threshold is met. MLPPA section 7 requires immediate reporting and written reporting and action within 24 hours after the suspicious transaction; TPPA section 84 requires relevant TF/PF reports within 24 hours. NFIU's FAQ describes an FI-only 48-hour examination plus 24 hours after confirmation but misstates that as 78 hours. Guidance does not amend the Acts: do not delay established suspicion or rely on longer timing without current written confirmation.
- Preuves à conserver
- Filing reference and complete decision timeline
- Source primaire
- MLPPA 2022, s.7; TPPA 2022, s.84; NFIU FAQ
Prevent tipping off
- Action d’implémentation
- Restrict knowledge of reports and investigations and avoid disclosures that may prejudice analysis, restraint or investigation.
- Preuves à conserver
- Access controls and communications guidance
- Source primaire
- CBN CDD Regulations 2023, regs. 19 and 22
Report domestic mandatory disclosures
- Action d’implémentation
- Report any single transaction, lodgment or transfer exceeding N5 million for an individual or N10 million for a body corporate within seven days. Financial institutions report to NFIU; DNFBPs report the applicable CTR to SCUML.
- Preuves à conserver
- Threshold rules, filings and reconciliation
- Source primaire
- MLPPA 2022, ss.2 and 11; SCUML rules
Report cross-border transfers
- Action d’implémentation
- Report transfers to or from a foreign country exceeding US$10,000 or equivalent to NFIU, CBN and SEC in writing within one day of the transaction.
- Preuves à conserver
- Cross-border report and delivery evidence
- Source primaire
- MLPPA 2022, s.3
Enforce cash limits and anti-structuring
- Action d’implémentation
- Do not make or accept cash above N5 million for an individual or N10 million for a body corporate except through a financial institution. Detect deliberate splitting across transactions or institutions to evade reporting.
- Preuves à conserver
- Cash controls, aggregation logic and cases
- Source primaire
- MLPPA 2022, s.2
Apply DNFBP-specific returns
- Action d’implémentation
- Under S.I. No. 39 of 2024, file CTRs above NGN 5 million for an individual or NGN 10 million for a body corporate with SCUML within seven days, with monthly nil returns where applicable. File the Standard Data Form for cash above US$1,000 within seven days, with applicable monthly nil returns. Report domestic foreign-currency transfers above US$10,000 within seven days, public-sector and PEP transactions monthly, employee-training returns yearly and the training plan annually. Follow current SCUML portal instructions.
- Preuves à conserver
- SCUML return matrix, filings and nil returns
- Source primaire
- SCUML S.I. No. 39 of 2024, regs. 36-38
Resolve threshold wording conservatively
- Action d’implémentation
- MLPPA uses exceeding or in excess of, while the NFIU FAQ uses at or above. Configure conservatively and document the current portal instruction. Evaluate linked transactions for CDD, structuring and suspicion; STRs have no monetary threshold.
- Preuves à conserver
- Approved threshold interpretation and test cases
- Source primaire
- MLPPA 2022; NFIU FAQ
Retain CDD and related records
- Action d’implémentation
- Keep CDD records, account files, business correspondence and analysis for at least five years after relationship termination or the occasional transaction, and longer where another rule or lawful direction applies.
- Preuves à conserver
- Retention schedule and retrieval test
- Source primaire
- CBN CDD Regulations 2023, reg. 23
Apply data-protection controls
- Action d’implémentation
- Apply the NDPA and GAID 2025. Determine DCPMI status and complete registration and returns. Document lawful bases, transparency, minimization, security, retention, processor governance, rights, transfers, breach response, DPO duties and DPIAs for high-risk processing. Preserve legally required AML records despite an erasure request.
- Preuves à conserver
- Registration, privacy records, DPIAs and security controls
- Source primaire
- Nigeria Data Protection Act 2023; GAID 2025
Map professional privilege and activity scope
- Action d’implémentation
- For law firms, notaries and independent legal professionals, apply CDD and reporting when preparing for or carrying out buying or selling real estate or businesses; managing client money, securities, assets or bank, savings or securities accounts; organizing company contributions; creating, operating or managing companies, trusts or other arrangements; or acting or arranging another to act as formation agent, director, secretary, partner, trustee or equivalent. Privilege and confidentiality do not apply to section 11(4) activities or material produced in furtherance of an unlawful act. Document other privilege and reporting-route decisions.
- Preuves à conserver
- Activity-scope, privilege and reporting-route protocol
- Source primaire
- MLPPA 2022, s.11(4); SCUML S.I. No. 39, reg. 8(2)
Train, test and remediate
- Action d’implémentation
- Provide role-based training, independently test the program and track findings to accountable owners and closure.
- Preuves à conserver
- Training register, audit report and remediation log
- Source primaire
- Applicable CBN or SCUML requirements
Guide pays 2026
7 domaines de contrôle et 45 vérifications d'implémentation avec sources réglementaires directes.
Téléchargez la checklist KYC, KYB et AML pour Nigeria
Partagez vos coordonnées professionnelles pour accéder immédiatement à la checklist d'implémentation sourcée pour Nigeria. Date de revue réglementaire : 15 July 2026.
Recevez le PDF immédiatement
Envoyez vos coordonnées pour démarrer automatiquement le téléchargement
Revue et sourcée
Version 1.1, revue le 15 July 2026
Approuvé par des équipes conformité de premier plan
Registre des sources primaires
19 sources utilisées pour cette checklist
Utilisez ces liens pour vérifier la législation, les lignes directrices, les procédures de déclaration et les statuts internationaux.
- Money Laundering (Prevention and Prohibition) Act, 2022Nigerian Financial Intelligence Unit - Laws and Regulations · primary
- Terrorism (Prevention and Prohibition) Act, 2022Nigerian Financial Intelligence Unit - Laws and Regulations · primary
- Customer Due Diligence Regulations, 2023Central Bank of Nigeria · primary
- AML/CFT supervision and regulatory materialsCentral Bank of Nigeria · primary
- Baseline Standards for Automated AML/CFT/CPF Solutions, 10 March 2026Central Bank of Nigeria · primary
- Implementation Guidance for the Baseline Standards, 31 March 2026Central Bank of Nigeria · primary
- Frequently asked questions on suspicious transaction reportingNigerian Financial Intelligence Unit · primary
- Persons with Significant Control Regulations, 2022Corporate Affairs Commission · primary
- Economic and Financial Crimes Commission AML/CFT/CPF Regulations for DNFBPs, 2024 (S.I. No. 39 of 2024)Special Control Unit against Money Laundering, Economic and Financial Crimes Commission · primary
- RapidAML reporting portal and channel noticesNigerian Financial Intelligence Unit · primary
- Rules and RegulationsSecurities and Exchange Commission Nigeria · primary
- Investments and Securities Act, 2025Securities and Exchange Commission Nigeria · primary
- Guidance on Politically Exposed Persons, May 2023Central Bank of Nigeria · primary
- Guidance on Ultimate Beneficial OwnershipCentral Bank of Nigeria · primary
- Targeted Financial Sanctions Implementation GuidanceNigeria Sanctions Committee · primary
- Nigeria Data Protection Act, 2023Nigeria Data Protection Commission · primary
- General Application and Implementation Directive, 2025Nigeria Data Protection Commission · primary
- Nigeria country profileFinancial Action Task Force · primary
- CBN Baseline Standards 2026: KYC, KYB and AML guide for Nigerian fintechsVOVE ID · context
Réponses directes
Questions KYC, KYB et AML pour Nigeria
Which regulator oversees KYC and AML compliance in Nigeria?+
It depends on the activity: CBN for specified banks, OFIs and payment institutions; SEC for capital-market operators and VASPs; NAICOM for insurance; PenCom for pensions; and SCUML for DNFBPs. STRs go to NFIU through the applicable channel, while threshold and sector returns may also go to SCUML or a sector regulator.
What information is required for KYC at a CBN-supervised financial institution?+
The 2023 CBN CDD Regulations list identity, address, contact, date and place of birth, nationality, occupation or public position, employer, BVN, TIN, an official identifier, relationship type, signature and PEP status, with verification from reliable independent sources. Applicability can depend on the customer and product.
How should beneficial ownership be checked in Nigeria?+
Understand the legal person's ownership and control structure, identify and verify the natural persons who ultimately own or control it, and compare declarations with reliable sources such as CAC records. The CAC PSC threshold of at least 5% is a disclosure trigger and does not replace broader control analysis.
When must a suspicious transaction be reported in Nigeria?+
File immediately once the statutory threshold is met. MLPPA section 7 requires immediate reporting and written reporting and related action within 24 hours after the suspicious transaction; TPPA section 84 requires relevant TF/PF reports within 24 hours. NFIU's FAQ describes a longer FI examination workflow but administrative guidance does not amend the Acts, so do not delay an established suspicion without current written confirmation.
How long must CDD records be retained in Nigeria?+
The CBN CDD Regulations require CBN-supervised financial institutions to keep CDD records, account files, business correspondence and analysis for at least five years after relationship termination or the occasional transaction. Another applicable law, supervisor or legal direction may require longer.
Is Nigeria currently on the FATF grey list?+
No. FATF removed Nigeria from increased monitoring on 24 October 2025. Institutions should keep country-risk data current and continue applying a documented risk-based approach rather than relying on obsolete list status.
Méthode de recherche et de revue
VOVE ID Compliance Research cartographie le périmètre réglementaire, traduit les obligations en contrôles opérationnels, relie les affirmations importantes aux sources et date chaque revue.
VOVE ID Compliance Research · Revue le 15 July 2026 · Version 1.1
This is a general Nigeria baseline with a detailed CBN overlay, not legal advice or a complete sector checklist. A fintech technology provider is not automatically a reporting entity. Obligations depend on regulated services and authorization. Apply the relevant CBN, SEC, NAICOM, PenCom, SCUML or professional-sector overlay and confirm current reporting-channel instructions.