If you're building a fintech, wallet, or lending product in Nigeria, CBN KYC requirements aren't optional - they decide what your users can do, how much they can transact, and whether your business stays licensed. Yet most engineering teams meet these rules late, bolt them on after launch, and pay for it in rework and risk.
This guide breaks the Central Bank of Nigeria's three-tier KYC framework down for developers: what identity each tier requires, what changed recently, and exactly where biometric verification fits. Veris provides the on-device pieces of that stack - Veris Capture for face liveness, Veris Scan for document OCR, and Veris Compare for face matching - behind one API key, and no biometric data is ever stored.
The Three Tiers at a Glance
The CBN's tiered framework lets customers open accounts with light verification and unlock higher transaction limits as they provide more identity. The identity requirements are the stable part to design around (exact transaction thresholds are set by the CBN and revised periodically, so always confirm current limits against the latest CBN circular):
Tier 1 - minimal. The lowest limits. Requires linkage to BVN or NIN (at least one). Basic details like name and phone number.
Tier 2 - intermediate. Higher limits. Requires a verified government-issued ID and address, on top of identity linkage.
Tier 3 - full. The highest or unlimited limits. Full verification, including address and, for businesses, beneficial-ownership checks.
A pivotal change: since December 2023, the CBN has required all Tier 2 and Tier 3 individual accounts and wallets to carry both BVN and NIN, while Tier 1 needs either BVN or NIN. Self-declaration alone no longer satisfies any tier - identity must be verified against authoritative sources.
Two Different Verification Problems
Here's the distinction that trips up most teams. "KYC" actually bundles two separate checks, and you need both:
Database matching - does this BVN/NIN belong to a real, registered identity, and do the details match? This is a lookup against NIBSS (for BVN) and NIMC (for NIN). It answers "is this a valid, registered identity?"
Biometric and document verification - is the person actually here, and are they the rightful owner of that identity? This is face liveness (a real, present human - not a photo or replay), document capture/OCR (reading the physical ID), and face matching (the live face matches the ID portrait). It answers "is this really them?"
Database matching alone can be defeated by anyone who simply knows a valid BVN/NIN. Biometric verification is what ties the claimed identity to the person in front of the camera - which is exactly why the CBN's move toward automated, real-time verification pushes fintechs toward layered checks.
Where Veris fits: Veris is the biometric-and-document layer. You pair your NIBSS/NIMC (or lookup-provider) database check with Veris to prove the human is real and matches the ID. Veris does not perform government-database lookups - and deliberately never stores biometric data - so you keep that sensitive step in your own control.
CBN three-tier KYC framework
Designing Each Tier in Your App
A clean way to implement tiers is progressive verification - collect the minimum to open an account, then step up as the user needs higher limits.
Tier 1 (account opening):
Capture name and phone
Link BVN or NIN (database check)
Optionally add a quick face-liveness check with Veris Capture to stop bulk fake-account creation early
Tier 2 (raise limits):
Confirm both BVN and NIN
Capture a government ID and extract fields with Veris Scan (NIN Slip, National ID Card (NIMC), Driver's Licence, International Passport, Voter's Card)
Run face liveness and match the live face to the ID portrait with Veris Compare
Capture proof of address (a utility bill or bank statement, also via Veris Scan)
Tier 3 (full):
Everything in Tier 2
For businesses, add beneficial-ownership and registration checks (KYB)
Why "Automated and Real-Time" Now Matters
Regulators have made clear that manual, self-declared KYC is no longer acceptable - verification should be automated and happen in real time at onboarding. For developers that means:
Reading documents automatically instead of asking users to type fields
Confirming a live human at capture time, not trusting an uploaded selfie
Matching the face to the document before granting access
Logging each verification for audit
Getting this right protects you from a real cost: enforcement. In 2024 alone, the CBN fined 29 banks a combined ₦15 billion for AML/CFT-related failings - a reminder that weak KYC is a balance-sheet risk, not just a checkbox.
Building for Nigerian Users
Whatever tier you're verifying, your users are on real devices - entry-level Android phones, older cameras, variable lighting, and slow networks. Verification has to stay fast and reliable there, which is why Veris Labs continuously tunes performance across the devices common across Nigeria and Africa. A verification flow that only works on flagships fails most of your Tier 1 signups.
Privacy and NDPR
KYC and privacy are not opposites. Collect only what each tier requires (data minimisation), get consent, secure data in transit, set retention policies, restrict access, and keep audit logs - the core of NDPR alignment. Veris keeps liveness on-device and stores no biometric templates, so the most sensitive category of KYC data never accumulates in a database that could be breached.
Frequently asked questions
Does Veris check BVN or NIN against the government database?
No. Veris handles the biometric and document layer - face liveness, document OCR, and face matching. BVN/NIN database matching is a separate lookup against NIBSS and NIMC, which you run yourself or through a lookup provider. Veris proves the person is real and matches their ID, the lookup proves the identity is registered.
What identity does each CBN tier require?
Tier 1 requires BVN or NIN. Tier 2 and Tier 3 require both BVN and NIN, plus a verified government ID and address (Tier 3 adds full/beneficial-ownership verification for businesses). Exact transaction limits are set by the CBN and revised periodically, so confirm current thresholds against the latest circular.
Is face liveness required by the CBN?
The CBN mandates automated, real-time identity verification rather than a specific vendor technology. Face liveness and face matching are how you satisfy the "is this really the person" side of that requirement and prevent someone using a stolen BVN/NIN - so they are strongly recommended for Tier 2 and above.
Does Veris store customer face images?
No. Face liveness runs on the user's device and no biometric templates are stored by Veris. This reduces your privacy risk and simplifies NDPR alignment.
Key Takeaways
The CBN's three-tier framework decides what your users can do - and it now expects automated, real-time verification, not self-declaration. Treat KYC as two problems: a database check (BVN/NIN via NIBSS/NIMC) and a biometric check (is this really the person). Design tiers progressively, verify on real devices, and keep privacy built in.
By pairing your database checks with Veris Capture, Veris Scan, and Veris Compare, you cover the biometric layer cleanly - and across every Veris product: no biometric data is ever stored.
Related Veris Resources
Veris Capture - on-device face liveness
Veris Scan - Nigerian document OCR
Veris Compare - 1:1 face matching API
