What the CBN’s Baseline Standards Mean for Transaction Monitoring Governance in Nigerian Financial Institutions

CBN transaction monitoring requirements changed shape on 10 March 2026. On that date the Central Bank of Nigeria issued Circular BSD/DIR/PUB/LAB/019/002, titled “Issuance of Baseline Standards for Automated Anti-Money Laundering (AML) Solution for Financial Institutions in Nigeria”. It followed Nigeria’s removal from the FATF grey list in October 2025.

According to DLA Piper Africa’s analysis, the Standards apply to all CBN-regulated entities: deposit money banks, microfinance banks, mortgage institutions, finance companies, mobile money operators, international money transfer operators, payment service providers and other financial institutions. They set minimum functional, governance and control requirements for automated AML/CFT/CPF solutions, of which transaction monitoring is one function among several.

That framing matters for a risk leader. The Standards are less a rule about monitoring than a requirement to run monitoring as part of a linked, auditable system on a fixed timetable.

Monitoring is one of nine functions the Baseline Standards expect to be linked, logged and auditable.

The nine functions the Standards expect

As summarised by DLA Piper Africa, an institution’s automated solution must at a minimum support nine functions: customer identification and verification, risk profiling, sanctions and watchlist screening, PEP and high-risk customer screening, transaction monitoring, case management, reporting, audit and governance, and data protection and security. For monitoring teams the linkage between them matters as much as any single function, because an alert needs a profile to be judged against, a case to be investigated in and a reporting route when it becomes a suspicious transaction report.

Context, not raw transactions

Press reporting of the circular says the CBN expects automated AML solutions to assess activity in the context of the full customer profile rather than monitor on raw transactional data alone. Read with the profiling function, that points to a design test: does an alert for a given customer use that customer’s risk category, expected activity and relationship history, or only the transaction?

Fraud monitoring on the same platform

Where an AML solution is also used to monitor fraud, DLA Piper Africa reports, the institution has a duty to segregate, govern and tune the platform’s fraud-related capabilities so that they do not dilute AML/CFT/CPF detection effectiveness. The circular also expects fraud-specific controls to meet real-time or near-real-time expectations.

That is a cross-domain governance rule. A rule change that reduces fraud false positives can change AML alert volumes, and the reverse. Someone has to own both effects.

Deadlines and accountability

The CBN set a tiered timeline from the date of issue. All regulated institutions were to submit implementation roadmaps to the CBN’s Compliance Department within three months, deposit money banks must achieve full compliance within 18 months, and other financial institutions have 24 months. Counted from 10 March 2026, those dates fall on 10 June 2026, 10 September 2027 and 10 March 2028. The dates are calculated, so each institution should confirm them against the circular.

Three further points come from the same analysis. Institutions seeking fresh CBN authorisation must show compliance or a credible implementation plan. Institutions that operate ineffective AML solutions may face remedial directives, administrative sanctions and penalties, with potential liability for accountable individuals. Institutions using third-party AML solutions must keep a vendor policy covering procurement, implementation, support, change management, incident handling and exit.

Four checks for the Board and the MLRO

The roadmap date has passed, so the live questions are about evidence of progress.

How Nexiant supports governed automated monitoring

FraudShield, Nexiant’s specialist transaction-monitoring brand, is built around real-time detection, configurable rule logic and case-management workflows. For automated monitoring under the Baseline Standards, the useful tests of any capability are whether customer profile data reaches rule logic, whether configuration changes leave an audit trail, and whether fraud and AML rules can be governed separately on one platform. Nexiant brings these questions together across KYC, fraud and monitoring as a design discipline, not as a claim about one integrated system.

Frequently Asked Questions

This article was accurate at the time of publication in October 2026 and is intended for general informational purposes only. It does not constitute legal, regulatory or compliance advice. Organisations should seek qualified professional guidance in relation to their specific obligations.