Law / Nigeria

Central Bank of Nigeria Regulatory Framework for Bank Verification Number (BVN) Operations and Watch-list for the Nigerian Banking Industry (revised October 2021)

Central Bank of Nigeria Revised Regulatory Framework for Bank Verification Number (BVN) Operations and Watch-list for the Nigerian Banking Industry (October 2021)

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2022. Publisher's page: https://www.cbn.gov.ng/Out/2021/CCD/REVISED%20REGULATORY%20FRAMEWORK%20FOR%20BANK%20VERIFICATION%20NUMBER%20(BVN)%20OPERATIONS%20AND%20WATCH…

In force since 12 Oct 2021.

A sensitive categories rule binding private bodies.

Enforcement body: Central Bank of Nigeria
Obligation class: Biometric, Consent, Access restriction, Transfer, Security, Reporting

As of 24 October 2026.

What it requires

Capture BVN data properly, including data captured by your agents, and validate it before you link it to a customer's account or wallet, except Tier 1; link every operated account or wallet, except Tier 1, to the signatories' BVNs within 24 hours of NIBSS making the BVN available, and link the BVNs of all signatories, Directors and beneficial owners to non-individual accounts or wallets (clause 1.5.3(i), (ii) and (iv)).
Let no new account or wallet, except Tier 1, operate without a BVN, except for inflows, and close any account or wallet, except Tier 1, that has no BVN within 30 days (clause 1.6(v)).
Require a BVN or a NIN for each individual Tier 1 account or wallet, and a BVN and a NIN for each individual Tier 2 and Tier 3 account or wallet, as the Central Bank's December 2023 circular directs (Central Bank BVN page).
Report the BVNs of individuals in breach to NIBSS for update on the Watch-list within 1 business day of breach, and report the BVNs of confirmed deceased customers to NIBSS for designation as "DECEASED" within 24 hours of confirmation (clause 1.5.3(vi) and (vii)).
Investigate an alleged breach within one month, place the customer's account on Post-No-Debit once a breach is established, notify the customer through verifiable means within five business days, and give the customer three business days to present documentary evidence before a decision to watch-list the BVN (clauses 2.1 and 2.2).
Integrate your banking application with the Watch-list for online identification and verification of watch-listed individuals as transactions occur, and enforce the sanctions in the Framework on customers' accounts or wallets, except Tier 1 (clause 1.5.3(xiii) and (xiv)).
Use the BVN API only for account or wallet opening, maintenance and validation, and do not use a BVN to sanction an individual for a non-financial offence or for identification outside the banking system (clauses 1.5.3(xvi) and 1.9).
Allow access to the BVN database only as clause 1.7 provides: other financial institutions, excluding payment service providers, and payment service providers through NIBSS need the customer's consent, and foreign entities are not allowed access (clause 1.7).
Store BVN data within Nigeria and do not route it across borders without the consent of the Central Bank, treat BVN information as confidential, put in place secure hardware, software and encryption of messages transmitted through a secured network, and comply with the Nigeria Data Protection Regulation or any Central Bank regulation on data protection (clause 1.11).

These lines are LexLint's reading of the law's text, as of 24 October 2026.

If you get it wrong

Penalty structure

Table 3 of the Framework sets N2,000,000 per infraction per customer as its highest per-infraction amount, for operating an account without a BVN and for failing to capture or validate BVN data as the Framework requires. Other lines of the Table carry N200,000 or N100,000 per infraction per customer, with daily amounts of N20,000 or N5,000 per infraction per customer per day after the infraction exists, and the first line adds 15% of the total amount credited into the account during the period the infraction exists.

Rule: Per violation only
As of: 24 October 2026
Currency: NGN
Per violation unit: Violation
Per violation amount: 2,000,000

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

The Central Bank of Nigeria issued the revised Regulatory Framework for Bank Verification Number (BVN) Operations and Watch-list for the Nigerian Banking Industry in exercise of the powers conferred on it by the Central Bank of Nigeria Act, 2007 and the Banks and Other Financial Institutions Act 2020. The Central Bank's own BVN page states that it issued the revised Framework on October 12, 2021.

Banks and Other Financial Institutions must ensure that all operated accounts and wallets, except Tier 1, are linked with the signatories' BVNs within 24 hours of NIBSS making the BVN available. Banks and Other Financial Institutions must report the BVNs of individuals in breach to NIBSS for update on the Watch-list within 1 business day of breach.

Clause 1.9 restricts the use of the BVN to purposes specified by the Central Bank and treats use of the BVN to sanction individuals for non-financial offences, and use of it for identification outside the banking system, as abuse. Clause 1.7 requires the consent of customers for access to the BVN database by Other Financial Institutions, excluding payment service providers, and by payment service providers through NIBSS.

Clause 1.11 requires BVN data to be stored within the shores of Nigeria and not routed across borders without the consent of the Central Bank. Clause 3.1 provides that a participant who fails to perform its stipulated responsibilities is penalised by the Central Bank of Nigeria.

Table 3 penalises operating an account or wallet, except Tier 1, without a BVN at N2,000,000 per infraction per customer, 15% of the total amount credited into the account during the period the infraction exists, and N20,000 per infraction per customer per day after the infraction exists. The Central Bank's BVN page states that a December 2023 circular requires all individual Tier 2 and Tier 3 accounts and wallets to have a BVN and a NIN, while Tier 1 accounts and wallets shall have either.

When LexLint raises it

When your app profile says your app is a bank, is a payment provider or processes biometric data.

Back to the example · Lint your app