NigeriaMoney Laundering (Prevention and Prohibition) Act 2022, customer due diligence, record retention and risk assessment of new technologies
Money Laundering (Prevention and Prohibition) Act, 2022, ss. 4, 8 and 13
In force since .
An AI sector rules rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Governance, Retention, DPIA
- Audit expectation
- on_request
- Who audits it
- Regulator
As of .
What it requires
- It reaches you if you are a financial institution as section 30 of the Act defines the term, or a designated non-financial business or profession. Identify each customer, whether permanent or occasional, natural or legal person or any other form of legal arrangement, using the identification documents prescribed in any relevant regulation, and verify the customer's identity using reliable, independent source documents, data or information (section 4(1)(a) and (b)).
- Identify the beneficial owner using relevant information or data from a reliable source so that you are satisfied you know who the beneficial owner is, and take reasonable measures to verify that any person purporting to act on behalf of the customer is so authorised, identified and verified (section 4(1)(c) and (d)).
- Undertake customer due diligence when establishing business relationships, when carrying out occasional transactions above the applicable designated threshold prescribed by relevant regulations (including transactions carried out in a single operation or in several operations that appear to be linked), when carrying out occasional wire transfers, when there is a suspicion of money laundering or terrorist financing regardless of any exemption or threshold, and when you doubt the veracity or adequacy of previously obtained customer identification data (section 4(2)).
- Conduct ongoing due diligence on each business relationship, scrutinise transactions undertaken during the relationship to ensure they are consistent with your knowledge of the customer, their business and risk profile and, where necessary, the source of funds, and keep customer due diligence documents, data and information up to date by reviewing existing records, particularly for higher risk customers and relationships (section 4(3)).
- Apply enhanced measures where higher risks are identified, and simplified measures only where lower risks are identified and never where there is suspicion of money laundering or terrorist financing (section 4(4)(a) and (b)). Put in place appropriate risk management systems and procedures to determine whether a customer or beneficial owner is a politically exposed person (section 4(7)).
- Preserve records on transactions, both domestic and international, for at least five years following completion of the transaction, and all records obtained under section 4, including account files and business correspondence and the results of any analysis, for at least five years following the termination of the business relationship or after the date of the occasional transaction. Keep the records sufficient to permit individual transactions to be readily reconstructed at any time and make them swiftly available to the competent authorities (section 8).
- Identify and assess the money laundering and terrorism financing risks that may arise from new products, new business practices, new delivery mechanisms and new or developing technologies, undertake the risk assessment prior to launch or use, and take appropriate measures to manage and mitigate the risks (section 13).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Contravening section 4, 8 or 13 is an offence under section 19(1)(f), punishable on conviction by a fine of N10,000,000 or imprisonment for a term of at least three years or both in the case of an individual, and by a fine of N25,000,000 in the case of a body corporate.
Penalty structure
A person who contravenes the listed sections commits an offence and is liable on conviction to a fine of N10,000,000 or imprisonment for a term of at least three years or both in the case of an individual, and to a fine of N25,000,000 in the case of a body corporate.
- Rule
- Fixed only
- As of
- Currency
- NGN
- Fixed cap
- 25,000,000
Who enforces it
Enforcement body
The Central Bank of Nigeria, the Securities and Exchange Commission, the National Insurance Commission and, for designated non-financial businesses and professions, the Special Control Unit Against Money Laundering
What this law does
A financial institution and a designated non-financial business and profession must identify a customer, whether permanent or occasional, natural or legal person or any other form of legal arrangement, using identification documents prescribed in any relevant regulation, and verify the identity of that customer using reliable, independent source documents, data or information.
A financial institution and a designated non-financial business and profession must also identify the beneficial owner, and take reasonable measures to verify that any person purporting to act on behalf of the customer is so authorised, identified and verified.
Customer due diligence measures are also required when carrying out occasional transactions above the applicable designated threshold prescribed by relevant regulations, including transactions carried out in a single operation or in several operations that appear to be linked, when carrying out occasional wire transfers, when there is a suspicion of money laundering or terrorist financing regardless of any exemptions or thresholds, and when the institution has doubts about the veracity or adequacy of previously obtained customer identification data.
A financial institution and a designated non-financial business and profession must scrutinise transactions undertaken during the course of the relationship to ensure that the transactions are consistent with the institution's knowledge of the customer, the customer's business and risk profile and, where necessary, the source of funds, and keep customer due diligence documents, data and information up to date and relevant.
Where higher risks are identified a financial institution and a designated non-financial business and profession must apply enhanced measures, and simplified customer due diligence measures are not permitted whenever there is suspicion of money laundering or terrorist financing.
A financial institution and a designated non-financial business and profession must put in place appropriate risk management systems and procedures to determine whether a customer or the beneficial owner of a customer is a politically exposed person.
A financial institution and a designated non-financial business and profession must preserve records on transactions, both domestic and international, for at least five years following completion of the transaction, and all records obtained under section 4, including account files, business correspondence and the results of any analysis, for at least five years following the termination of the business relationship or after the date of the occasional transaction.
Records preserved under section 8 must be sufficient to permit individual transactions to be readily reconstructed at any time by the competent authorities and be made swiftly available to the competent authorities.
Financial institutions and designated non-financial businesses and professions must identify and assess the money laundering and terrorism financing risks that may arise in relation to new products, new business practices, new delivery mechanisms and the use of new or developing technologies for both new and pre-existing products.
Financial institutions and designated non-financial businesses and professions must undertake the section 13 risk assessments prior to the launch or use of the products, business practices and technologies, and take appropriate measures to manage and mitigate the risks. A director or an employee of a financial institution or designated non-financial business and profession who contravenes sections 3, 4, 5, 6, 7, 8, 10, 11, 13, 14 or 15 of the Act commits an offence under section 19.
An offence under section 19(1)(f) of the Act is punishable on conviction by a fine of N10,000,000 or imprisonment for a term of at least three years or both in the case of an individual, and by a fine of N25,000,000 in the case of a body corporate.
When LexLint raises it
When your app profile says your app provides financial services.