NigeriaCBN Guidelines on Operations of Electronic Payment Channels, Security and Fraud Controls for ATM, POS, Mobile POS and Web Acquiring
Guidelines on Operations of Electronic Payment Channels in Nigeria, ss. 1.5, 2.3, 3.2 and 4.3
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2020. Publisher's page: https://www.cbn.gov.ng/Out/2020/CCD/Reviewed%20and%20Approved%20Guidelines%20on%20Operations%20of%20Electronic%20Payment%20Channels%20in%20N…In force.
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds a bank or independent organization that deploys an ATM, a CBN licensed merchant acquirer, a Payment Terminal Services Provider, the Payments Terminal Service Aggregator, an issuer and a switch, for the channel each section names (reached by declaring that you are a bank or a payment provider); the Guidelines also place duties on merchants and cardholders that no declaration here reaches.
- If you deploy or acquire for ATMs, comply with the Payment Card Industry Data Security Standards (section 1.1.1).
- Fit every ATM with cameras that view and record all persons using the machine and every activity at the ATM without recording customers' key strokes, and with anti-skimming devices (section 1.5).
- Change ATM keys regularly, every year, never use the same keys at multiple ATMs, and demonstrate that the networks carrying ATM transactions have data confidentiality and integrity (section 1.5).
- Monitor suspicious ATM transactions and report them to the CBN in the agreed format and timeframe (section 1.3).
- Ensure that the terminals, applications and processing systems you use to process or store cardholder information comply with the minimum requirements of PA DSS, PCI PED, PCI DSS, Triple DES, which is the minimum standard for data transmitted and authenticated between parties, and EMV (sections 2.3 and 2.3.4).
- Connect all your PoS terminals or other acquiring devices directly to a Payments Terminal Service Aggregator, and do not deploy POS terminals other than through a CBN licensed Payment Terminal Services Provider (sections 2.4.1.5 and 2.4.2.4).
- Ensure, with your Payment Terminal Services Providers, that merchants are trained and put in place reasonable processes and systems for confirming cardholder identity and detecting suspicious or unauthorized usage of electronic payment instruments where the customer and card are physically present (section 2.4.1.9).
- Provide mobile POS solutions that use PCI PIN Transaction Security in accordance with the PCI Point-to-Point Encryption Solution Requirements (section 3.2.2).
- Use only gateway providers that comply with PCI DSS, PA DSS, Triple DES and second factor authentication for web acquiring, and implement a fraud management system that detects customer usage pattern and declines or accepts transactions based on its rules (sections 4.3 and 4.5.1.13).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Central Bank of Nigeria, which imposes sanctions, in the form of monetary penalties or suspension of the acquiring or processing services or both, on erring institutions.
Settledness
- As of
- Open questions
- Has the Central Bank of Nigeria replaced the 2020 Guidelines on Operations of Electronic Payment Channels in Nigeria with a later revision?
What this law does
The Central Bank of Nigeria issued the Guidelines on Operations of Electronic Payment Channels in Nigeria in exercise of the powers conferred on it by sections 2(d) and 47(2) of the CBN Act, 2007. The Guidelines supersede the Guidelines on Operations of Electronic Payment Channels in Nigeria (2016) issued by the CBN. The CBN's Payments System Guidelines page lists the Guidelines under the reference PSMD/31/05/2020 as published on .
Section 1.1.1 of the Guidelines requires all ATM deployers and acquirers to comply with the Payment Card Industry Data Security Standards. Section 1.5 of the Guidelines requires every ATM to have cameras that view and record all persons using the machine and every activity at the ATM, without recording the key strokes of customers.
Section 1.5 of the Guidelines requires ATM key management processes to ensure that keys are changed regularly, every year, and that the same keys are not used at multiple ATMs. Section 1.5 of the Guidelines requires ATMs to be installed with anti-skimming devices. Section 1.5 of the Guidelines requires networks used for the transmission of ATM transactions to be demonstrated to have data confidentiality and integrity.
Section 1.3 of the Guidelines requires a bank or independent organization that deploys an ATM to ensure that acquirers monitor suspicious transactions and report them to the CBN, based on the agreed format and timeframe. Section 2.3 of the Guidelines requires all industry stakeholders who process or store cardholder information to ensure that their terminals, applications and processing systems comply with the minimum requirements of PA DSS, PCI PED, PCI DSS, Triple DES and EMV.
Section 2.3.4 of the Guidelines provides that the Triple DES algorithm is the minimum standard for all data transmitted and authenticated between each party. Section 2.4.1.5 of the Guidelines requires every Merchant Acquirer to connect all its PoS terminals or other acquiring devices directly to a Payments Terminal Service Aggregator.
Section 2.4.2.4 of the Guidelines provides that only the Payment Terminal Services Providers shall be allowed to deploy POS terminals, and that any other party that deploys POS terminals shall be fined 50,000 Naira for each day that the terminal remains deployed.
Section 2.4.1.9 of the Guidelines requires Merchant Acquirers, in conjunction with their Payment Terminal Services Providers, to ensure that merchants are trained and put in place reasonable processes and systems for confirming cardholder identity and detecting suspicious or unauthorized usage of electronic payment instruments where the customer and card are physically present.
Section 3.2.2 of the Guidelines requires acquirers to provide mPOS solutions that use PCI PIN Transaction Security in accordance with the PCI Point-to-Point Encryption Solution Requirements. Section 4.3 of the Guidelines requires web acquirers to use only the services of gateway providers that comply with PCI DSS, PA DSS, Triple DES and second factor authentication.
Section 4.5.1.13 of the Guidelines requires acquirers to implement a fraud management system that will detect customer usage pattern and decline or accept transactions based on rules defined on the system. Section 1.8 of the Guidelines provides that sanctions, in the form of monetary penalties or suspension of the acquiring or processing services or both, would be imposed on erring institutions for failure to comply with any of the provisions of the Guidelines.
Section 2.10 of the Guidelines provides that non compliance with the Guidelines shall attract appropriate sanctions from the CBN.
When LexLint raises it
When your app profile says your app is a bank or is a payment provider.