On 10 March 2026, the Central Bank of Nigeria published Circular BSD/DIR/PUB/LAB/019/002, setting mandatory minimum standards for automated AML solutions across every CBN-supervised institution, from deposit money banks to fintechs, payment service providers and mobile money operators. This is a binding compliance obligation with firm deadlines, not guidance. This article sets out what the circular requires for transaction monitoring specifically, and the deadlines compliance teams need to track.
Who the circular reaches and what it requires
The circular applies universally across CBN-supervised institution types, including deposit money banks, merchant banks, microfinance banks, finance companies, fintechs and startups holding CBN licences, payment service providers, mobile money operators, mortgage banks and primary mortgage institutions, with specific technical requirements scaling to each institution's size, transaction volume and risk profile. For payment service providers specifically, monitoring must operate at the individual merchant level, not only at the aggregate PSP level, with alerts generated and investigated for suspicious patterns across the merchant portfolio.
Core requirements include automated, real-time screening of transactions across all payment channels, automated generation of Suspicious Transaction Reports for submission to the Nigerian Financial Intelligence Unit, and a unified customer view that treats a single customer's activity across all accounts, channels and products as one risk profile rather than siloed views per product.
The specific thresholds and deadlines compliance teams should track
Reported requirements include suspicious transaction report submission to the NFIU within 24 hours of detection, cash transaction reporting thresholds around ₦25 million for individuals and ₦250 million for corporates, and a new-device rule capping transactions at ₦20,000 within 24 hours of a new device being linked to an account, intended to slow down fraud that relies on rapid device switching.
Institutions were required to submit an implementation roadmap for their automated AML solution to the CBN Compliance Department by 10 June 2026, with full compliance reportedly required within 18 months of the circular for deposit money banks (commonly cited as around 10 March 2028), and mobile money operators expected on a similar timeline. Given the operational significance of these figures, institutions should confirm the exact thresholds and deadlines directly against the CBN's published circular rather than relying solely on secondary summaries.
How this interacts with SCUML and NFIU obligations
The circular sits alongside Nigeria's existing AML/CFT framework for designated non-financial businesses and professions, where the Special Control Unit against Money Laundering (SCUML) has a mandate over sectors including real estate, precious metals, accountants and lawyers under the Money Laundering (Prevention and Prohibition) Act 2022. Payment service providers are themselves classified as Other Financial Institutions under that Act and subject to the same AML/CFT obligations as banks.
The Nigerian Financial Intelligence Unit's increasing scrutiny of STR data quality and completeness means that simply generating more automated reports is not sufficient on its own. A monitoring system that produces high volumes of poorly substantiated STRs creates its own operational and regulatory friction, so investment in automated detection needs to be matched with investment in the investigation and documentation process behind each report.
Building a compliant monitoring programme against a firm deadline
With an implementation roadmap already due to the CBN and a hard compliance deadline attached to the circular, institutions that have not yet automated merchant-level monitoring, real-time screening across channels, and a unified customer view are working against the clock rather than a general direction of travel. A practical sequence is to first establish the unified customer view, since merchant-level and channel-level monitoring both depend on knowing which activity belongs to the same underlying customer, then build automated real-time screening on top of that consolidated view, and finally connect detection to an NFIU-ready reporting workflow that can meet the 24-hour STR submission expectation without manual bottlenecks.
