CBN Issues Baseline Standards for Automated AML Solutions [2026]: What Every Nigerian Financial Institution Needs to Know
A hard June 2026 roadmap deadline and ten technical requirements — what Circular BSD/DIR/PUB/LAB/019/002 actually demands.
On 10 March 2026, the Central Bank of Nigeria issued Circular BSD/DIR/PUB/LAB/019/002, establishing mandatory baseline standards for automated AML/CFT/CPF solutions across the Nigerian financial sector. Every CBN-supervised bank, fintech, mobile money operator, and payment service provider now has a hard deadline to act. VOVE ID has been tracking the circular's requirements closely with fintech and payments clients preparing their roadmaps.
For a broader view of how this fits into Nigeria's AML obligations overall, see our AML compliance guide for Nigeria.
For the underlying AML/CFT framework and definitions, see our AML requirements explained.
Why the CBN Acted Now
Nigeria's financial sector has digitized fast enough that manual AML/CFT/CPF controls are no longer proportionate to transaction volume and complexity — a point the CBN made directly in the circular. The timing also follows Nigeria's removal from the FATF grey list in October 2025: having exited increased monitoring, the CBN is now pressing institutions to demonstrate that progress is backed by genuine automation and governance, not just improved optics.
The Baseline Standards represent a minimum compliance threshold. Institutions with higher-risk profiles — cross-border remittances, virtual asset services, correspondent banking, high-value merchant exposure — are expected to go beyond it.
Who Is Affected
The circular applies to every CBN-supervised institution: deposit money banks, fintechs and payment service providers (including switching companies and super agents), mobile money operators, international money transfer operators, microfinance banks, and other CBN-regulated entities. New license applicants must also demonstrate compliance or present a credible implementation plan as part of authorization.
The Three Deadlines
| Deadline | Timeline | Obligation |
|---|---|---|
| 10 June 2026 | 3 months | Submit implementation roadmap to the CBN Compliance Department |
| 10 September 2027 | 18 months | Full compliance — deposit money banks |
| 10 March 2028 | 24 months | Full compliance — all other supervised institutions |
The roadmap deadline is the immediate one. Institutions that haven't yet assessed their AML infrastructure against the ten capability areas below are already behind.
The Ten Technical Requirements
- Customer identification and verification — integration with BVN, NIN, and other national identity data to support KYC/KYB.
- Risk-based customer profiling — dynamic scoring based on the full customer profile, not raw transaction data alone.
- Sanctions screening — real-time screening against CBN, OFAC, UN, and EU lists, with automatic blocking on a confirmed match.
- PEP screening and adverse-media monitoring — continuous screening with automated alerting.
- Transaction monitoring — real-time or near-real-time, across cards, e-channels, deposits, and lending.
- Case management — automated case generation, assignment, and tracking.
- Regulatory reporting — automated STR and CTR generation and submission to CBN and NFIU.
- Audit trails and governance — tamper-proof logging, role-based access, MFA, and NDPA-compliant data handling.
- AI/ML model governance — independent annual validation covering accuracy, drift, fairness, and bias.
- Vendor management — documented policies for procurement, oversight, incident management, and exit.
The Integration Requirement
The circular doesn't just require an AML platform to exist — it requires that platform to connect to core banking systems and other operational infrastructure so monitoring covers all customers, products, and channels simultaneously. Institutions running AML through standalone tools or batch processes will need to plan not just which platform to adopt, but how to wire it into their existing stack. VOVE ID's identity verification, transaction monitoring, and sanctions-screening modules are built to support this kind of integration; the specific connection points still depend on each institution's existing infrastructure.
Free CBN AML Implementation Roadmap Template. A structured template aligned to the circular's requirements, built to help institutions prepare their 10 June 2026 submission. Download it here.
Consequences of Non-Compliance
The CBN has been explicit: institutions that fail to meet the Baseline Standards, or whose AML systems prove ineffective in practice, are subject to remedial directives, administrative sanctions, and financial penalties — and these consequences can attach to accountable individuals, not just the institution. Compliance is being monitored through off-site surveillance, on-site examinations, and thematic reviews.
How to Prepare
- Run an honest gap assessment against each of the ten capability areas — specifically whether monitoring covers all four channel types and whether sanctions screening blocks automatically on a match.
- Determine your risk tier, since the CBN calibrates expectations to risk profile, business model, and volume.
- Prepare and submit the roadmap — current-state assessment, target architecture, phased timeline with named owners, governance framework, and budget commitment, signed by both the CEO and Chief Compliance Officer.
Final Thoughts
This circular is one of the more substantive updates to Nigeria's AML framework in recent years — a new technological floor, not a light-touch adjustment. Institutions that treat the June 2026 roadmap as a real regulatory commitment, rather than a formality, will be better positioned as enforcement scrutiny increases.
Speak with the VOVE ID team about your institution's roadmap, or download the free template to get started.
This article is published for informational purposes and does not constitute legal or regulatory advice. Source: Central Bank of Nigeria, Circular BSD/DIR/PUB/LAB/019/002, 10 March 2026.
