CBN introduces 24-hour watchlist for suspicious BVNs, tightens banking rules

From Adanna Nnamani, Abuja

The Central Bank of Nigeria (CBN) has unveiled new regulations aimed at strengthening fraud control and digital banking security across the country.

The apex bank issued a circular to all banks, other financial institutions and payment service providers detailing amendments to the Revised Regulatory Framework for Bank Verification Number (BVN) operations and additional requirements for instant payment services.

Under the new BVN framework, financial institutions are required to maintain a temporary watchlist for BVNs implicated in suspected fraudulent transactions.

Any BVN placed on this list will remain there for a maximum of 24 hours, during which the account holder will be contacted to provide clarification.

The circular also sets age restrictions for BVN enrolment, limiting registration to individuals 18 years and above, and restricts phone number amendments linked to BVNs to a single change.

Access to BVN databases will now be exclusively for CBN-licensed financial institutions, with the central bank retaining the right to grant access in extenuating circumstances under existing laws. These provisions are set to take effect from 1 May 2026.

In addition, the CBN issued guidelines for instant payment (IP) services, aimed at enhancing security and customer control.

Financial institutions are now required to implement voluntary opt-in/opt-out functionality, allowing customers to choose whether to participate in instant payment services.

Default onboarding will be opt-in, but customers who opt out will still be able to conduct physical transfers at bank branches.

Customers can also set voluntary transaction limits, subject to maximum thresholds of ₦25 million for individuals and ₦250 million for corporates, with adjustments requiring enhanced due diligence and risk assessment.

To combat fraud, the CBN mandated that all financial institutions activate enterprise fraud monitoring for both inflows and outflows, and introduce liveliness checks for online account opening or reactivation, validating accounts in real time with the BVN/NIN databases and using appropriate authentication measures such as soft or hard tokens.

For mobile financial services, apps must be device-bound, allowing operation on only one device at a time. Migration to another device will trigger automatic reactivation and authentication. New and existing accounts using mobile apps will face transaction limits for the first 24 hours, capped at ₦20,000, while first-time logins on a new device will require additional multi-factor authentication.

These measures, the bank said, are intended to reinforce security, enhance fraud detection and give customers greater control over digital transactions. Implementation of the new instant payment provisions will begin on 1 July 2026.

“Financial institutions are mandated to establish and maintain a temporary watchlist for BVNs implicated in suspected fraudulent transaction(s). A BVN may remain on this temporary watchlist for a maximum period of twenty-four (24) hours; during this period, the BVN owner shall be contacted to provide clarification regarding the identified transaction(s),” the circular stated.