CBN KYC Requirements: The 3-Tier Framework for Developers

The CBN's tiered KYC framework matches the amount of due diligence to the amount of risk. A customer with a low-limit account can open it with less evidence. A customer who wants to hold and move more must prove more. Three tiers cover the range, from basic accounts and wallets up to full accounts with no low-value limits.

The practical rule for developers is simple: design for upgrade. Do not build three separate onboarding flows. Build one flow that collects more evidence as the customer asks for more.

The CBN's BVN page records a December 2023 circular on individual accounts and wallets:

• Tier 2 and Tier 3: both a BVN and an NIN.
• Tier 1: a BVN or an NIN.
• How onboarding starts: by retrieving the BVN or NIN data electronically from the issuing systems.

I have left out the transaction and balance limits for each tier on purpose. Secondary sources disagree on the figures, and they are the sort of detail that changes. Take them from the CBN directly.

A clean way to build it is as layers of evidence, each one added only when the customer needs the next tier.

Layer 1: identity numbers and basic details

Collect the name, date of birth and the BVN or NIN your tier requires. Retrieve the matching record from the issuing system. This lookup is a separate service and is not part of Veris.

Layer 2: a live person with a matching document

For higher tiers, add evidence that the person is real and present:

• a live face capture with liveness checks,
• a document read of the ID, such as the NIN slip or national ID card,
• a face match between the live face and the photo on the document.

This is what Veris Capture, Scan and Compare do. The result is a signed record your backend can verify, which becomes part of your audit trail.

Layer 3: address and source information

Where your policy requires proof of address, add a document read of a utility bill or bank statement. See Utility Bill Verification for KYC.

Layer 4: your own risk checks

Sanctions screening, transaction monitoring and risk scoring sit in your AML systems. See CBN AML Baseline Standards for Fintech Developers.

• Make the tier a property of the account, not of the flow. The flow checks which evidence is already stored and asks only for what is missing.
• Store decisions, not images. Keep the tier, the checks that passed, the time and the score. Keep the pictures off your servers.
• Use the right face-match preset. A live selfie against an ID photo uses the onboarding preset. A step-up against the face from onboarding uses the stricter one.
• Handle failure kindly. A failed match goes to retry, then to manual review, never to a dead end.
• Log the reason for every decision, so you can explain it later.

If you build for one tier first and bolt the others on later, you rebuild the flow when the first customer outgrows the limits. If you skip layer 2, you take numbers on trust, which means you cannot show that the person using the account is the person the record belongs to.

• One flow for Layer 2 across tiers: live capture, document read and face match on one key.
• Signed results and a nonce per session, so each decision is verifiable.
• No images stored by Veris, so the data you keep stays small.
• A flat plan with a ceiling, from a free sandbox and a free Spark plan to Launch at $19 a month.

"Does using Veris satisfy the tiered KYC rules?" It supplies strong evidence for the identification step. Your compliance officer decides how it fits your obligations, and the number lookups stay separate.

"Do we need liveness for every tier?" That is a policy decision. Many teams add it at the tiers where the risk and limits are higher. Veris lets you move up in stronger liveness as your plan grows.

"What if a user cannot complete the check?" Offer a retry, then a manual route. Never leave them stuck.

Write down your three tiers and the evidence each needs. Then build Layer 2 once, in the sandbox, and reuse it for every upgrade.

Create your free Veris account · Free to start · no card · all three products. For a rollout or security question, talk to the team.