AML

How KYB Is Powering Nigeria’s Business Growth

How to verify a Nigerian company: what to pull from the CAC, why the 5% PSC threshold is not a safe harbor, which people to verify, and how often to refresh the file.

A CAC registration proves that a Nigerian company exists. It does not show who controls it, who may sign for it, or whether its owners appear on a sanctions list. VOVE ID builds business verification workflows for regulated teams, and Nigeria's rules make clear where a corporate onboarding file has to go beyond the registry extract.

This guide covers KYB requirements in Nigeria. For a full breakdown of the KYB framework, see our KYB Requirements Explained 2026.

Direct answer: For a corporate customer in Nigeria, a CBN-supervised institution must confirm that the company legally exists (through the CAC or another reliable registry), verify the people who can bind it, and identify and verify the natural persons who ultimately own or control it, including through voting rights or other means. The CAC's 5% threshold for persons with significant control is a disclosure trigger, not a safe harbor. If due diligence cannot be completed, the institution should not open the account and should file an STR with the NFIU. Records are kept for at least five years.

The rules behind KYB in Nigeria

Three instruments carry most of the weight. The CBN Customer Due Diligence Regulations, 2023 set the due diligence duties for CBN-supervised institutions, including for legal persons. The Money Laundering (Prevention and Prohibition) Act, 2022 sets the reporting duties (NFIU). The CAC Persons with Significant Control Regulations, 2022 govern what companies disclose about who controls them. The CBN has also issued guidance on beneficial ownership of legal persons and arrangements and on politically exposed persons.

Which supervisor applies depends on the regulated activity, and a technology provider is not automatically a reporting entity. Map the service and license first, then apply the matching overlay.

For supervisors, reporting channels, and thresholds, see our AML compliance guide for Nigeria.

Verify that the company exists

Search the CAC, or another reliable registry, and obtain evidence of incorporation or registration, the registration number, the legal form, and the governing documents. Then confirm the registered and operating addresses, the nature and purpose of the business, the expected transactions, and its financial profile (regulations 6(b), 7(3), and 10–11). A registry hit is the start of the file, not the end of it. Compare the directors and address the registry shows with what the customer submitted, and record every difference.

Verify who can act for it

Obtain the board resolution or an equivalent mandate, then identify and verify the directors, senior management, controllers, and authorized signatories (regulations 6(b), 8, and 9). Each of them is a person to be verified in their own right, so the corporate file is only as strong as the individual files behind it.

Find the beneficial owners

The CDD Regulations require the institution to understand the ownership and control structure and to identify and verify the natural persons who ultimately own or control the customer, including through voting rights or other means (regulations 5 and 8).

The CAC's beneficial-ownership register is a useful cross-check. Compare the customer's declaration with it, but note two traps. The PSC Regulations use a threshold of at least 5%, or other control tests, as a disclosure trigger. That does not make the register complete, and it does not make 5% the cut-off for your own analysis. Your duty is to find who ultimately owns or controls the company whatever the percentage, so a small holder who controls it through voting arrangements or other means still belongs in the file.

CBN-supervised institutions must also keep a beneficial-owner register with names, identification details, the nature of ownership, shareholding, voting rights, controlling interests, source of wealth, and PEP status (regulation 8(f)).

For the identity checks on each individual, see our KYC guide for Nigeria.

Screen the entity and the people behind it

Screen the company, its beneficial owners, directors, signatories, and agents against current UN and Nigerian sanctions lists before onboarding, whenever the lists change, and on an ongoing basis. On a confirmed match, freeze the assets without delay or prior notice, report immediately to NIGSAC, the NFIU, and the sector regulator, and do not unfreeze without authorization (NIGSAC guidance).

For PEPs, identify foreign, domestic, and international-organization PEPs among owners and controllers, together with their family members and close associates. Risk-rate them, obtain senior approval, apply enhanced due diligence to foreign and higher-risk PEPs, establish the source of funds and wealth, and monitor more closely. PEP status alone does not call for an STR.

Enhanced due diligence for complex structures

Layered or cross-border ownership, a PEP in the chain, or an owner who cannot be traced should move the file to enhanced due diligence under regulation 17. That means additional information on the customer, its owners, its business, and the purpose of the relationship, verified against reliable sources. It also means source-of-funds and source-of-wealth analysis, documented senior-management approval, and deeper or more frequent monitoring.

Do not give every Nigerian company an automatic high-risk label. Nigeria left FATF increased monitoring in October 2025 (FATF), so rate each customer on its own ownership, activity, and channels.

Keep the file current

CBN-supervised institutions must review customer records at least every 12 months for high risk, 18 months for medium risk, and three years for low risk, or earlier when a trigger arises (regulation 23(b)). Triggers include changes in ownership or management, a new product, a new geography, a change in behavior, or a change to a sanctions list. Each should lead to rescreening and a fresh risk assessment, and the transaction monitoring described in regulation 12 should be checking activity against the profile you recorded.

When KYB cannot be completed

If due diligence cannot be completed, do not open the account, establish the relationship, or execute the transaction. Terminate a relationship that has already started, and file an STR with the NFIU. If continuing due diligence would tip off the customer, stop it and file immediately (regulations 19 and 22). Keep the records for at least five years after the relationship ends (regulation 23).

Ownership files hold personal data about individuals, so the Nigeria Data Protection Act 2023 and the 2025 implementation directive apply to them (NDPA). Records that AML rules require you to keep must be preserved even when an erasure request arrives.

How VOVE ID fits

VOVE ID supports KYB cases in which the company submits its registration documents and profile details, adds its beneficial owners, and has each owner complete identity verification before your team reviews the case. Sanctions screening and audit-ready logs sit in the same workflow, so the file shows what was checked and who approved it. Your team still decides which CAC records to pull and how to resolve discrepancies. The workflow keeps the evidence in one place.

For the full source-linked version, with 7 control areas and 45 implementation checks, see VOVE ID's Nigeria KYC, KYB, and AML compliance checklist.

FAQ

What is the PSC threshold in Nigeria?

The CAC's Persons with Significant Control Regulations use a threshold of at least 5%, or other control tests, as a disclosure trigger. It is not a safe harbor, and it does not replace the broader analysis of who ultimately owns or controls the company.

Who has to be verified for a corporate customer?

The company itself, its directors, senior management, controllers, and authorized signatories, and the natural persons who ultimately own or control it. Obtain a board resolution or equivalent mandate for whoever acts on the company's behalf.

How long must KYB records be kept?

At least five years after the relationship ends or the occasional transaction is completed, and longer where another rule or lawful direction requires it.

Sources

Conclusion

A company can look complete on the registry and still leave the real question open: who stands behind it? The Nigerian rules put that question at the center of the file, and they expect the answer to be documented, refreshed on a schedule, and backed by a clear decision when it cannot be found.

If your corporate onboarding still treats the CAC extract as the finish line, we can show how ownership, authority, and screening fit into one case.

Get in touch

This article is intended for general informational purposes only and does not constitute legal, financial, or regulatory advice. KYC/KYB/AML requirements may vary depending on jurisdiction, industry, and specific business circumstances. For up-to-date and binding compliance obligations, readers should refer to the relevant regulatory authorities or consult qualified professionals.