CBN AML Baseline Standards for Fintech Developers

According to published reports of the circular, the CBN issued "Baseline Standards for Automated Anti-Money Laundering Solutions for Financial Institutions in Nigeria" on 10 March 2026. It applies to banks, mobile money operators, payment service providers, international money transfer operators and other regulated financial institutions. You can read the news coverage in Nairametrics, and find the circular itself through the CBN website.

The key points that were widely reported:

• Institutions are expected to run automated, technology-driven AML systems rather than rely on manual processes.
• The systems are expected to cover customer identification, transaction monitoring, sanctions screening and risk assessment.
• The standards recognise the use of artificial intelligence and machine learning for monitoring.
• Implementation roadmaps were due to the CBN within three months of issue, and full compliance was reported as due 18 months after issue for deposit money banks and 24 months for other financial institutions.

Check each of those against the circular text, especially the dates, since reports vary.

An AML programme has two halves. The first is who the customer is (identification and due diligence). The second is what the customer does (transaction monitoring, screening, reporting). The standards concern both, and they ask for automation across the lifecycle, so engineers should think in terms of systems that run continuously and leave evidence.

Practical consequences for an engineering team:

• Auditability. Every decision needs a record of what was checked, when, by which system and with what result. Build audit logging in from day one rather than retrofitting it.
• Automation with human review. Automate the routine decisions and route uncertain cases to a person, with the reviewer and outcome recorded.
• Integration points. Identification, monitoring and screening are separate capabilities. Expect to integrate several, and design your data model so you can swap a component.
• Data minimisation alongside retention. AML rules ask you to keep certain records. Data protection rules ask you to keep less. Decide what must be retained, for how long, and keep it separate from biometric images.

The customer-identification part of the standards is the part a verification flow supports. A good flow gives you reliable evidence that:

1. A live person was present during onboarding (liveness).
2. The identity document said what you recorded (document reading, with validated fields).
3. The person matched the photo on the document (face matching).
4. The whole sequence was tamper-evident, so a result cannot be replayed or forged.

That is evidence for your customer-identification process. It is not, on its own, an AML programme. Identity verification does not replace:

• Database checks. If your obligations require validating a BVN or NIN against the issuing database, you run that separately. Veris reads documents and compares faces. It does not query NIN or BVN records.
• Sanctions and watchlist screening.
• Transaction monitoring.
• Risk scoring and reporting.

Be clear with your compliance team about which of these a tool covers, so nobody assumes the verification vendor handles the rest.

1. Map your obligations to systems. For each requirement in the circular, write down which system satisfies it and who owns it.
2. Fix the data model. Store verification decisions, scores, timestamps and reviewer outcomes as structured records. Keep images out of that store.
3. Make decisions explainable. Record the threshold, the check results and the recommendation for each decision.
4. Add escalation. Define when an automated decision becomes a manual review, and record the outcome.
5. Test the failure paths. Check what happens when a vendor is down, a quota is reached or an input is poor.
6. Document it. Examiners ask for documentation. Write down how each control works while the team still remembers.

The architecture patterns for the verification part are in Document Verification API Design. For the identity requirements on accounts, see the complete developer guide, and for data protection obligations see NDPR Compliance for Identity Verification.

Deadlines and scope differ by type of institution. Do not rely on a blog post, including this one, for your own deadline. Confirm which category your business falls into and the exact dates in the circular, and ask the CBN or your adviser if it is unclear.

Reported timelines give banks 18 months and other institutions 24 months from issue, with a roadmap due within three months. Confirm your own dates in the circular. The point for engineers is that the work is a build, not a form. Identification, monitoring and screening each take time to integrate, test and document, and an examiner will ask for the documentation.

Teams that start late compress that work into the last quarter, and buy whatever is available. Teams that start early pick tools on evidence.

It supports the customer-identification part: a live person was present, the document said what you recorded, the face matched the photo on the document, and the result is signed so it cannot be replayed. It also holds no face images, which keeps your data story simple.

It does not replace database checks of a BVN or NIN, sanctions screening, transaction monitoring, risk scoring or reporting. We tell you this now so your compliance team plans for it, rather than finding out later.

"Does using Veris make us compliant?" No tool does. It gives you strong evidence for one part of your programme. Your compliance officer decides how it fits the whole.

"Our regulator wants records." Keep a structured record per decision: session id, time, checks run, liveness status, score, threshold preset, recommendation and reviewer. Keep images out of it.

"We need a security review." Talk to the team. Tell us your use case and we will walk through where data goes.

"What if we need more than identification?" Run Veris for identification and add the database, screening and monitoring services you need next to it. They are separate by design.

Start by mapping each requirement in the circular to a system and an owner. For the identification line, test Veris in the free sandbox and check the evidence it produces against what your compliance officer needs.

Create your free Veris account · Free to start · no card · all three products. For a security review or rollout questions, talk to the team.