AML Compliance Nigerian Fintechs: NFIU and GIABA Requirements Explained
AML Compliance for Nigerian Fintechs: NFIU and GIABA Requirements Explained
A fintech can have a functioning app, thousands of customers and a reliable payment process and still have a serious compliance weakness: it may not know who is ultimately using its service, why money is moving through its platform, or what its team must do when a transaction does not make sense.
That is the practical problem behind anti-money laundering compliance in Nigeria. It is not simply a matter of collecting a customer's Bank Verification Number (BVN), asking for a National Identification Number (NIN), or installing software that flags unusual transfers. A functioning AML programme connects customer identification, business-risk assessment, transaction monitoring, escalation, reporting, record keeping and management accountability.
The difficulty for fintech operators is that the phrase “Nigerian fintech” covers different legal and operating models. A payment service provider, a digital lender, a mobile-money operator, a capital-market technology company and a business that supplies software to a licensed institution do not automatically have identical regulatory obligations.
This guide explains how to identify the relevant compliance perimeter, what the NFIU and GIABA actually do, how CBN and SEC requirements fit into the picture, and how a fintech can turn legal duties into controls that work in its daily operations.
1. What AML compliance means in a fintech business
Anti-money laundering (AML) controls are designed to stop criminals from using financial products and services to disguise the origin, movement or ownership of proceeds of crime. In practice, AML compliance is commonly discussed alongside combating the financing of terrorism (CFT) and countering proliferation financing (CPF). These areas overlap in the systems businesses use to identify customers, understand transactions, screen relevant parties and report concerns.
Money laundering does not always look like a large transfer from an obviously suspicious account. It may involve many small transactions, multiple accounts, false identities, business accounts used for personal flows, unexplained third-party payments, or activity that does not fit the customer's stated occupation and expected use of a product.
A fintech therefore needs to understand more than the identity document presented during onboarding. It needs to understand the customer relationship and the activity taking place through the service.
AML is a connected operating system
Consider the difference between these two approaches:
- Document-only approach: collect identification details, store a photograph and allow transactions to proceed without meaningful review.
- Risk-based approach: identify and verify the customer, understand the purpose of the relationship, assess the risks, monitor activity against expected behaviour, investigate relevant alerts and report suspicion where the legal threshold is met.
The second approach is more useful because it connects the information collected at onboarding to what happens after the account becomes active. A customer profile that is never used to interpret transactions is an incomplete control.
2. Start with the legal perimeter, not the app
The first question for a fintech founder should not be, “Which AML checklist do other fintechs use?” It should be, “What regulated activity does our company actually perform, and under whose authority?”
A brand may describe itself as a fintech, but the legal analysis depends on the activities carried out by the entity. A company that holds customer funds, operates a payment service, provides credit, manages investments, facilitates securities transactions or performs a technical service for another regulated institution may occupy a different regulatory position from a company that merely supplies software.
Map the money and the legal entity
Prepare a simple description of the customer journey. Identify who contracts with the customer, who receives the money, who holds or controls it, who executes the transaction, who maintains the ledger, who can block or reverse activity, and who is responsible for regulatory reporting.
This exercise often reveals that the public-facing app and the regulated entity are not the same company. A fintech may use a licensed bank or payment partner, but the existence of that relationship does not automatically transfer every legal responsibility to the partner.
Questions to resolve before choosing controls
- Which company is the customer contracting with?
- What licence or authorisation permits the relevant financial activity?
- Does the business hold, control, transmit, exchange, lend, invest or safeguard customer value?
- Does it onboard customers directly or rely on another institution?
- Who performs customer due diligence, and who remains accountable for the outcome?
- Who monitors transactions and receives internal alerts?
- Which entity is required to submit reports to the NFIU or another authority?
- Do the contracts, product design and actual money flows match the compliance description?
If the answers are unclear, the business should not assume that a partner's licence covers its own activities. The legal structure, service agreements and actual conduct need to be reviewed together.
Technology provider or regulated financial business?
A software vendor that supplies fraud-detection tools to a bank is not automatically in the same position as the bank. But a company should not use the label “technology provider” to avoid examining what it actually does. If it independently performs a regulated activity, controls customer funds or provides a service that falls within a regulated category, the relevant legal analysis must reflect that reality.
The practical lesson is simple: classify the activity before designing the AML programme. A wrong classification can lead to the wrong policies, reporting arrangements, staffing model and regulator-facing disclosures.
4. Where fintech business models create exposure
A fintech's AML risks are shaped by its customers, products, delivery channels, counterparties, transaction patterns and geographic reach. Two companies with similar apps may have very different exposure because one holds customer balances while the other only provides software to a licensed institution.
Payment and transfer services
Payment businesses may face risks involving rapid movement of funds, mule accounts, third-party funding, account takeovers, unusual beneficiary patterns and transactions that are inconsistent with the customer's profile. A monitoring system should be designed around the actual payment flows rather than a generic list of suspicious keywords.
Digital lending
A lender should understand the borrower, the source and destination of funds, repayment arrangements and any third-party involvement that may affect the risk assessment. A loan product can be misused where disbursement and repayment flows are inconsistent with the stated purpose or where accounts are used by people other than the borrower.
AML controls should not be confused with debt collection. A missed repayment is not, by itself, proof of money laundering. A lender should distinguish ordinary credit risk from indicators that may justify an AML review.
Wallets and stored-value products
Wallet products can create exposure where one customer controls multiple accounts, where accounts are funded by unrelated third parties, or where value moves rapidly between accounts without an understandable purpose. Product limits, identity assurance, monitoring and escalation should reflect the actual risks and applicable regulatory requirements.
Investment and digital-asset services
A platform that facilitates investment, securities or other capital-market activity should examine the SEC's applicable rules. The SEC's 2023 regulations expressly address customer due diligence, beneficial ownership, politically exposed persons, non-face-to-face business, new technologies and virtual-asset transfer requirements within their scope.
A business should not assume that calling a product a “digital asset” automatically settles its regulatory classification. The legal nature of the product, activity and service must be assessed under the applicable Nigerian framework.
Agent and merchant networks
Agent networks introduce additional parties and locations into the customer and transaction chain. A fintech should understand who is authorised to act, how agents are identified and monitored, what transaction activity is expected at each location, and how exceptions are escalated. An agent's activity should not become invisible simply because the platform does not operate a conventional branch.
5. The Nigerian legal and regulatory framework
There is no single document that can be used as a complete AML manual for every fintech. The applicable framework is made up of legislation, regulations, sector-specific rules, supervisory directions and guidance. A business must identify which instruments apply to its actual activities.
Money Laundering (Prevention and Prohibition) Act 2022
The Money Laundering (Prevention and Prohibition) Act 2022 is a central part of Nigeria's AML framework. It addresses reporting obligations, suspicious transactions, customer-related duties and offences. The NFIU lists the Act in its official laws and regulations register.
Section 7 is particularly relevant to suspicious transactions. The statutory provisions must be read carefully: the reporting obligation is not the same thing as a fixed monetary threshold for every suspicious transaction. A transaction can be suspicious because of its circumstances, pattern, purpose or inconsistency with the known customer relationship.
Terrorism (Prevention and Prohibition) Act 2022
The Terrorism (Prevention and Prohibition) Act 2022 forms part of the legal framework addressing terrorism and terrorist financing. Fintech controls should therefore consider relevant screening, escalation, reporting and targeted-financial-sanctions requirements that apply to the entity.
Nigerian Financial Intelligence Unit Act 2018
The NFIU Act establishes the institutional framework for Nigeria's financial intelligence unit and provides the statutory basis for its functions. It should be considered alongside the substantive AML and terrorism-prevention legislation.
Proceeds of Crime (Recovery and Management) Act 2022
The Proceeds of Crime (Recovery and Management) Act 2022 is relevant to the wider framework for identifying, restraining, recovering and managing proceeds of crime. It does not mean that a fintech can independently freeze an account whenever an internal alert is generated. Any restraint or restriction must have a lawful basis and follow the applicable process.
Sector-specific rules still matter
CBN-regulated institutions must identify the CBN rules applicable to their category. Capital-market operators must examine SEC requirements. Other regulated categories may have additional supervisors and reporting arrangements. A fintech with more than one regulated activity may need to comply with more than one applicable framework.
The official legislation and regulator documents should be checked for amendments, later directions and current status before a compliance policy is approved. A saved PDF or an old compliance manual is not proof that no later requirement exists.
6. The operating controls a fintech needs
A written AML policy is necessary, but it is not enough. A programme becomes meaningful when staff know what to do, systems capture the right information, management receives useful reporting and identified weaknesses lead to corrective action.
Customer identification and verification
The fintech should establish who the customer is using reliable information and a process appropriate to the risk and legal requirements. For an individual, this may involve identity information and verification checks. For a company, the process may need to establish legal existence, authorised representatives, ownership and control.
Collecting a BVN or NIN should not be treated as a complete AML programme. Identity verification is one part of customer due diligence. It does not, by itself, explain the purpose of the relationship, identify every beneficial owner, establish source of funds or monitor future transactions.
Beneficial ownership
A fintech dealing with a corporate customer should understand who ultimately owns or controls the business, where required by the applicable framework. The name of the person who submitted the onboarding form may not be the person who benefits from or controls the account.
The SEC's 2023 regulations expressly address verification of beneficial ownership and understanding the ownership and control structure of legal-person clients. The practical lesson is that corporate onboarding should not stop at collecting a certificate of incorporation and the name of one director.
Purpose and expected account activity
The business should understand why the customer wants the product and what activity is reasonably expected. This information helps the fintech assess later activity.
For example, a small retail merchant may reasonably receive many low-value customer payments. A newly opened personal account receiving repeated large transfers from unrelated parties may require a different level of review. Neither pattern proves criminal activity. The point is that the expected use of the account provides context for assessing exceptions.
Risk assessment
Risk assessment should consider more than the customer's location. Relevant factors may include customer type, product, delivery channel, transaction behaviour, ownership structure, counterparties, geography and the nature of the business relationship.
A risk score should be explainable. If the system marks a customer as high risk, the business should be able to identify the factors that produced the result and the controls that follow from it.
Politically exposed persons and sanctions screening
A politically exposed person (PEP) is not automatically a criminal or prohibited customer. PEP-related controls are designed to manage the additional risks that may arise from a person's public position, influence or associated relationships. The fintech should apply the enhanced measures required by the rules that govern it and document the decision.
Screening against applicable sanctions and targeted-financial-sanctions lists should be handled through a controlled process. A possible name match requires careful review; it should not be treated as a confirmed match merely because two names look similar.
Transaction monitoring
Monitoring should identify activity that may be inconsistent with the customer's profile or that presents other relevant indicators. A system that only checks whether a transaction exceeds a fixed amount may miss patterns involving multiple smaller transactions or activity spread across connected accounts.
Monitoring rules should be tested against real product flows and reviewed when the business changes its products, customer base, transaction limits or delivery channels. A rule that creates thousands of low-quality alerts can overwhelm the compliance team and make genuine risk harder to identify.
Records and audit trail
A fintech should retain the records required by its applicable legal and regulatory framework. These may include identity and verification records, customer risk assessments, transaction records, investigation notes, reporting records, training evidence, policy approvals and audit findings.
Records should be retrievable, protected from unauthorised alteration and retained for the required period. A compliance officer should be able to reconstruct why a decision was made, who approved it and what information was available at the time.
7. Regulatory and reporting responsibility matrix
The following is the article's central reference table. It brings the main institutions, their roles and the practical questions for a fintech into one place. It is not a substitute for checking the precise rules that apply to a particular licence or product.
| Institution or instrument | Core role | Where a fintech may encounter it | Practical compliance response | What not to assume |
|---|---|---|---|---|
| NFIU | Receives and analyses financial intelligence reports and disseminates relevant intelligence to competent authorities. | Suspicious transaction reporting and other applicable reporting duties for reporting entities. | Confirm reporting-entity status, reporting channel, access arrangements, escalation process and confidentiality controls. | The NFIU is not the licensing regulator for every fintech. |
| CBN | Regulates and supervises institutions within its jurisdiction. | Banks and relevant CBN-regulated financial institutions, including applicable payment and other financial-service categories. | Map the exact licence, CBN guidelines, applicable AML/CFT rules, governance duties and supervisory returns. | A partner bank's licence does not automatically authorise a separate fintech to perform every financial activity. |
| SEC | Regulates the Nigerian capital market and relevant operators. | Capital-market operators and fintech activities that fall within SEC's regulatory perimeter. | Review the SEC AML/CFT/CPF regulations and the rules applying to the actual service. | Not every digital-asset or investment-related product has the same legal classification. |
| GIABA | Regional AML/CFT body that assesses and supports member-state frameworks. | National policy developments, mutual evaluations, follow-up assessments and regional risk context. | Monitor Nigeria's assessment findings and understand how national reforms may affect the sector. | GIABA does not ordinarily issue an individual fintech's Nigerian operating licence. |
| MLPPA 2022 | Provides core statutory AML obligations and offences. | Relevant reporting entities and activities within the Act's scope. | Review the statutory duties, suspicious-transaction provisions, reporting rules and applicable sanctions. | Do not treat every transaction threshold as a suspicion threshold. |
| TPPA 2022 | Addresses terrorism prevention and related financing obligations. | Applicable reporting entities and controls involving terrorism financing and related measures. | Identify applicable screening, reporting, escalation and confidentiality requirements. | An ordinary fraud alert is not automatically a terrorism-financing case. |
| Proceeds of Crime Act 2022 | Provides a framework for recovery and management of proceeds of crime. | Legal processes involving restraint, recovery and management of assets. | Maintain lawful escalation procedures and respond to valid authority requests. | An internal alert alone is not a legal freezing order. |
Source basis: NFIU laws register and reporting guidance; CBN AML/CFT/CPF licensing guideline; SEC AML/CFT/CPF Regulations 2023; GIABA Nigeria 2024 follow-up report. Always check for later amendments or directions.
How to use the matrix
Start with the row that matches the company's legal status and activity. Then identify the applicable reporting and supervisory obligations. A business may need to consider more than one row: for example, a capital-market operator may be supervised by SEC while also having reporting obligations involving the NFIU.
Do not copy the whole matrix into an internal policy and call that compliance. The company should turn each applicable row into named owners, procedures, evidence records and review dates.
8. Suspicious transactions: from alert to report
A suspicious transaction report (STR) is not the same thing as an ordinary fraud complaint, a customer-service escalation or an internal monitoring alert. It is a report made under the applicable legal framework when the reporting threshold is met.
Suspicion is based on circumstances, not only transaction size
Section 7 of the Money Laundering (Prevention and Prohibition) Act 2022 addresses suspicious transactions. The statutory indicators include unjustifiable frequency, unusual or unjustified complexity, lack of apparent economic justification or lawful objective, inconsistency with the known pattern of an account or business relationship, and circumstances suggesting proceeds of criminal activity or money laundering.
These indicators should not be reduced to a rigid checklist in which every unusual transaction automatically becomes an STR. The reporting entity must assess the facts, document the reasoning and apply the law and relevant guidance.
What the NFIU says about timing
The NFIU FAQ states that reporting entities should file STRs immediately and no later than 24 hours after establishing reasons for suspicion, referring to section 7(1) of the MLPPA 2022 and section 84(1) of the TPPA 2022. The same FAQ then describes a financial-institution examination period of 48 hours plus 24 hours for filing, but states a total of 78 hours. Those figures do not add up.
A fintech should not copy the inconsistent arithmetic into its compliance manual. It should obtain and read the applicable NFIU financial-institution guideline, the governing statutory provision and any relevant sector direction, then obtain legal advice where the timing requirements appear to conflict. The operational process should be designed so that internal review does not cause a statutory reporting deadline to be missed.
The NFIU's official FAQ and advisory and guidance page should be checked directly for the current guidance and reporting instructions.
A useful internal escalation sequence
- Alert: a system, employee, customer report or external request identifies activity requiring review.
- Triage: the assigned reviewer checks whether the alert is a duplicate, a data error, an explainable event or a genuine concern.
- Investigation: the reviewer examines the customer's profile, transaction history, counterparties, relevant documents and the explanation available.
- Escalation: unresolved concerns are sent to the authorised compliance officer or designated decision-maker.
- Decision: the reporting entity determines whether the legal basis for reporting is met and records the reasoning.
- Submission: where required, the STR is submitted through the correct reporting channel within the applicable legal timeframe.
- Confidentiality: staff restrict access to the report and related information and avoid tipping off the customer where prohibited.
- Follow-up: the business preserves the investigation trail and responds to lawful requests from competent authorities.
What an STR narrative should explain
A useful report should communicate the facts clearly. It should identify the parties and accounts involved, explain the relevant dates and transaction pattern, describe why the activity is unusual in the context of the customer relationship, state what checks were carried out and explain the basis for suspicion.
Avoid unsupported conclusions. The reporting entity does not need to prove the underlying crime before making a report where the legal suspicion threshold is met. It should, however, distinguish facts it has verified from information supplied by another party or assumptions that remain unconfirmed.
STR does not automatically mean account freezing
Filing an STR is not a finding that the customer is guilty. It does not, by itself, create an automatic account-freezing order. Any restriction, restraint or freezing action must have an applicable legal or regulatory basis and follow the proper process.
A fintech should therefore maintain separate procedures for suspicious-activity reporting, fraud prevention, sanctions screening, court orders and lawful instructions from competent authorities. Combining them into one informal “block suspicious accounts” rule can create legal and customer-harm risks.
goAML and RapidAML are not interchangeable labels
The NFIU identifies goAML as a reporting system used by financial institutions for STR reporting. Its current RapidAML portal describes itself as a simplified portal that complements goAML and replaces the Nil Reports Portal, with reporting functions for specified categories such as DNFBPs, BDCs and NPOs.
The NFIU's current RapidAML information identifies different reporting uses for different regulated groups. For example, it lists CBN-regulated entities other than BDCs for nil and PEP reports, BDCs for STRs, CTRs, nil and PEP reports, and SEC-regulated entities for nil reports. These portal descriptions should not be interpreted as a complete legal statement of every reporting duty. A fintech must confirm the reporting route assigned to its actual entity category.
Check the live NFIU RapidAML portal and goAML registration page. Do not create a reporting account under the wrong organisation category.
9. What GIABA's Nigeria assessments mean for fintech operators
GIABA's role is often misunderstood. A GIABA report is not a new licence condition addressed directly to every fintech. It is an assessment of how the country's AML/CFT framework meets international standards and how effectively the system is being implemented.
GIABA's Nigeria 2024 Third Enhanced Follow-Up Report explains that it examines progress on technical compliance requirements that were considered for re-rating. The report follows Nigeria's 2021 mutual evaluation. The report is available from GIABA's Nigeria 2024 assessment page.
The Financial Action Task Force's summary of the 2024 follow-up report states that four recommendations—24, 25, 28 and 32—were re-rated from partially compliant to largely compliant. It also states that Nigeria remained in enhanced follow-up at the time of that report. These are country-level technical-compliance findings, not a rating of an individual fintech's AML programme.
Why a fintech should pay attention
National assessment findings can influence regulatory priorities, legislative reform, supervisory attention and the expectations placed on reporting entities. A fintech should therefore monitor official changes rather than waiting until a regulator or partner requests a policy update.
GIABA's regional work also highlights the importance of understanding evolving risks, including the use of new technologies and virtual assets. The appropriate response is not to treat every new technology as suspicious. It is to assess how the product changes customer access, transaction speed, anonymity, cross-border exposure and the ability to identify the people controlling value.
10. A practical transaction scenario: when a normal-looking account pattern changes
The following is an illustrative scenario created to explain a compliance decision. It is not a report of an actual Nigerian fintech customer or a real investigation.
The situation
A small-business customer opens a merchant account and tells the fintech that it receives payments for household goods. During the first month, the account receives a pattern of payments consistent with that description. Later, the account begins receiving repeated transfers from unrelated personal accounts, followed by rapid outward transfers to several beneficiaries. The customer profile has not changed and the business has not supplied an explanation for the new pattern.
What the monitoring system should identify
- The source and number of incoming payments have changed.
- The account is receiving funds from parties who may not fit the merchant's expected customer base.
- Funds are leaving the account quickly after receipt.
- The new pattern differs from the activity expected when the account was opened.
- The available business information may not explain the volume or direction of the transfers.
What the compliance team should not do
It should not immediately label the customer a money launderer. It should not treat the alert as proof of a crime, and it should not automatically file an STR merely because the monitoring system generated a warning.
What the team should do
- Confirm that the activity is not caused by a data-mapping or system error.
- Compare the transactions with the customer's declared business and expected account activity.
- Review the relevant counterparties, timing, transaction sequence and available supporting records.
- Seek an explanation through an approved process where doing so is appropriate and does not create a tipping-off risk.
- Record the facts, gaps, review steps and decision.
- Escalate unresolved concerns to the authorised compliance officer.
- Determine whether the applicable legal threshold for an STR has been met.
- Use the correct reporting route and timeframe if reporting is required.
The important lesson is that the alert is the beginning of a decision process, not the final decision. A good AML programme preserves the difference between unusual activity, a reasonable explanation, unresolved suspicion and a legally required report.
11. Building an AML programme in stages
A smaller fintech may not have the resources of a large bank, but it still needs a programme that matches its legal obligations and risk. The answer is not to buy the most expensive monitoring platform first. It is to establish what the company must control and then choose people, processes and technology that can deliver those controls.
Stage 1: Map the business and its regulatory status
Document the legal entity, licence, regulated activities, products, customer types, money flows, partners and reporting responsibilities. Obtain legal review where the classification is uncertain. Keep the evidence supporting the conclusion.
Stage 2: Complete a business-wide risk assessment
Assess the risks created by customers, products, delivery channels, locations, transaction types, counterparties and ownership structures. Record why each risk is considered low, medium or high and what controls reduce it.
Stage 3: Design customer onboarding and due diligence
Define what information is required for each customer category, how identity is verified, when beneficial ownership must be established, how PEP and sanctions screening is handled, and what happens when information is incomplete or inconsistent.
Stage 4: Build monitoring around actual products
Translate the risk assessment into monitoring rules. Test whether the rules detect relevant patterns without generating an unmanageable volume of false positives. Document rule ownership, thresholds, review dates and change approvals.
Stage 5: Establish escalation and reporting procedures
Give staff a clear route for raising concerns. Identify who investigates, who makes reporting decisions, who has access to reporting portals and how statutory deadlines are monitored. The procedure should cover absence or conflict of the normal decision-maker.
Stage 6: Train staff by role
Customer-support staff need to recognise and escalate warning signs. Operations staff need to understand exceptions and record handling. Engineers need to understand monitoring logic, audit trails and access controls. Senior management needs to understand risk appetite, reporting and accountability.
Stage 7: Test the programme and correct weaknesses
Review sample onboarding files, monitoring alerts, investigation notes, reporting decisions, access permissions and record retrieval. Track findings to completion. An AML policy that has never been tested may look complete while failing in actual operations.
What to measure internally
Management reporting should focus on whether the programme works, not simply how many alerts the system produces. Useful indicators may include:
- Customer files missing required information.
- High-risk relationships awaiting review.
- Alerts awaiting triage or investigation.
- Age of unresolved alerts and reasons for delay.
- STR decisions completed within the applicable legal timeframe.
- Monitoring rules producing excessive false positives.
- Staff training completion and assessment results.
- Audit findings overdue for correction.
- Material changes to products, partners or transaction flows not yet reflected in the risk assessment.
These are management indicators, not statutory thresholds. A company should choose measures that reflect its own risk and obligations.
12. Compliance mistakes that create avoidable exposure
Using BVN or NIN collection as the whole programme
Identity information is important, but it does not replace customer-risk assessment, beneficial ownership checks where required, monitoring, investigation and reporting. The business must understand the relationship, not simply collect identifiers.
Assuming a partner carries every obligation
A bank or licensed payment partner may perform agreed checks, but the fintech should examine the contract, legal allocation of duties and actual operating model. Outsourcing a process does not automatically remove the regulated entity's accountability.
Using one transaction limit as the only monitoring rule
Threshold-only monitoring can miss linked transactions, unusual frequency, rapid movement of funds and activity that conflicts with a customer's known profile. Rules should reflect patterns and risk, not only individual transaction size.
Automatically reporting every system alert
Alerts need triage and investigation. An STR is a legal report based on the applicable suspicion standard, not a synonym for every unusual transaction. Poor-quality reporting can weaken the usefulness of the process.
Delaying escalation because the team is waiting for proof
A reporting entity should not confuse suspicion with proof beyond reasonable doubt. The legal reporting threshold and timeline must guide the decision. Internal procedures should not create delays that cause a reporting failure.
Using the wrong NFIU portal or reporting category
The NFIU identifies different reporting channels and functions for different categories of reporting entities. Confirm the correct route for the entity's regulatory category rather than relying on a colleague's login or another company's process.
Failing to document decisions
If the business cannot explain why an alert was closed, why enhanced due diligence was applied or why an STR decision was made, it may struggle to demonstrate that its controls are operating effectively.
Treating a GIABA report as an individual compliance certificate
GIABA evaluates national systems. A fintech still needs to meet its own licence conditions, reporting duties and internal-control obligations.
13. Management review checklist
A founder, board member or compliance lead can use the following questions to identify gaps before the next internal review or regulatory engagement.
- Have we documented the legal entity and every regulated activity we perform?
- Can we identify the regulator responsible for each activity?
- Do our contracts and actual customer-money flows match our regulatory classification?
- Have we completed and approved a business-wide AML/CFT/CPF risk assessment?
- Do onboarding checks reflect customer type and risk?
- Can we identify beneficial owners where the applicable rules require it?
- Do we understand the purpose and expected activity of each relevant customer relationship?
- Are PEP and sanctions screening processes documented and reviewed?
- Do transaction-monitoring rules reflect the products we actually operate?
- Can staff escalate concerns to an authorised person?
- Do we know which NFIU reporting portal and category apply to our entity?
- Have we documented the applicable STR timing requirements using current law and guidance?
- Can we retrieve the records needed to explain a customer or transaction decision?
- Are employees trained according to their responsibilities?
- Does senior management receive useful AML risk and control reporting?
- Are audit findings assigned to named owners and tracked to completion?
- Are changes to products, partners and transaction flows reflected in our risk assessment?
A “yes” answer should be supported by evidence. A policy document alone does not prove that the procedure is followed. Useful evidence may include approved assessments, sample files, training records, monitoring logs, investigation notes, reporting confirmations and audit results.
14. Frequently asked questions
1. What is AML compliance in Nigeria?
Anti-money laundering compliance refers to the policies, procedures and controls that regulated businesses use to prevent, identify and report suspected money laundering and related financial crime. In Nigeria, the framework includes applicable laws, regulatory requirements, customer due diligence, transaction monitoring, record keeping, internal controls and suspicious transaction reporting.
2. What does the NFIU do in Nigeria's AML system?
The Nigerian Financial Intelligence Unit receives, analyses and disseminates financial intelligence relating to suspected money laundering, terrorist financing and other financial crimes. It receives reports from reporting entities and may share relevant intelligence with competent authorities. It is not a substitute for the supervisory responsibilities of regulators such as the CBN and SEC.
3. What is the difference between the NFIU and the CBN?
The NFIU is Nigeria's financial intelligence unit, responsible for receiving and analysing financial intelligence and disseminating relevant findings. The Central Bank of Nigeria supervises institutions within its regulatory jurisdiction and issues applicable prudential and AML-related requirements. A fintech may therefore have obligations to its regulator as well as reporting obligations involving the NFIU.
4. Does every Nigerian fintech need AML compliance controls?
A fintech's obligations depend on its legal status, licence, activities and the laws or regulatory rules applicable to it. Businesses carrying out regulated financial activities should identify the AML requirements attached to their authorisation and operating model. A technology company that does not itself provide regulated financial services should not assume that every financial-institution obligation applies to it.
5. Which Nigerian laws govern anti-money laundering compliance?
Nigeria's AML framework includes the Money Laundering (Prevention and Prohibition) Act 2022, the Terrorism (Prevention and Prohibition) Act 2022 and the Nigerian Financial Intelligence Unit Act 2018, alongside applicable regulations, supervisory rules and sector-specific requirements. Businesses should identify the provisions that apply to their licence and activities rather than relying on a general checklist.
6. What is customer due diligence in fintech?
Customer due diligence is the process of identifying and verifying customers, understanding the purpose and intended nature of a business relationship, assessing relevant risks and conducting appropriate ongoing monitoring. Depending on the customer and risk level, a fintech may also need to establish beneficial ownership, understand source of funds and apply enhanced checks where required by law or regulation.
7. What is enhanced due diligence?
Enhanced due diligence means applying additional scrutiny to customers, relationships or transactions that present higher money-laundering or terrorist-financing risks. The measures depend on the risk and applicable rules and may include obtaining additional information, establishing source of funds or wealth, increasing monitoring and securing appropriate senior-management approval. It is not a blanket substitute for risk assessment.
8. What is a suspicious transaction report?
A suspicious transaction report is a report made to the appropriate financial intelligence authority when a reporting entity has the suspicion or reasonable grounds for suspicion required by applicable law. Suspicion is not the same as proof of criminal conduct. Staff should document the facts and reasoning, follow internal escalation procedures and comply with the statutory reporting requirements and timelines.
9. Does a suspicious transaction report automatically freeze a customer's account?
No. Filing a suspicious transaction report does not, by itself, establish that a customer has committed an offence or automatically mean that an account must be frozen. Any restriction, restraint or freezing action must have an applicable legal or regulatory basis and follow the relevant process. A reporting entity should not treat an STR as a finding of guilt.
10. What is the difference between an STR and a CTR?
A suspicious transaction report is based on suspicion or reasonable grounds for suspicion under the applicable legal framework. A currency transaction report is generally triggered by specified transaction thresholds and reporting rules, whether or not the transaction appears suspicious. The reporting entity must apply the correct legal threshold, reporting channel and timeline for its particular circumstances.
11. What is GIABA and why does it matter to Nigerian fintechs?
The Inter-Governmental Action Group against Money Laundering in West Africa, known as GIABA, is the regional body responsible for supporting and assessing anti-money laundering and counter-terrorist financing efforts in West Africa. Its mutual evaluations and follow-up assessments examine how countries implement international standards. Its findings can influence national reforms and the wider compliance environment in which Nigerian fintechs operate.
12. Does GIABA directly regulate Nigerian fintech companies?
GIABA is not the ordinary licensing or supervisory regulator for an individual Nigerian fintech. Its role is regional: it assesses member countries' AML and counter-terrorist financing frameworks and supports improvements. Nigerian fintechs generally deal with the Nigerian authorities and regulators that have jurisdiction over their activities, while GIABA findings may inform wider national policy and regulatory reforms.
13. What AML records should a Nigerian fintech keep?
A fintech should maintain the customer identification, verification, beneficial ownership, transaction, monitoring, investigation, reporting, training and governance records required by the laws and rules applicable to its business. Records should be accurate, retrievable, protected against unauthorised access and retained for the legally required period. The business should document its retention policy and responsibilities.
14. Can a fintech outsource AML compliance?
A fintech may be able to outsource particular operational tasks, such as technology support, screening or monitoring services, where its legal and regulatory framework permits. Outsourcing does not automatically transfer the regulated entity's accountability. The fintech should assess the provider, define responsibilities contractually, protect customer information, monitor service performance and retain appropriate oversight of its AML programme.
15. How can a Nigerian fintech build an effective AML compliance programme?
A fintech should begin by identifying its licence, activities and applicable legal obligations, then conduct a documented risk assessment. It should establish customer due diligence, beneficial ownership checks, risk-based transaction monitoring, escalation and reporting procedures, record keeping, staff training, independent testing and senior-management oversight. Controls should be reviewed as products, customer risks and regulatory requirements change.
15. The practical conclusion for Nigerian fintech operators
AML compliance is not a document that a fintech prepares once and stores away. It is a continuing control system that must keep pace with the company's products, customers, partners, transaction patterns and regulatory obligations.
The starting point is to identify the legal entity and regulated activity. From there, the business can determine which CBN, SEC and other sector rules apply, what must be reported to the NFIU, and how its controls should work in practice. GIABA's assessments provide important national and regional context, but they do not replace the direct obligations imposed on a regulated business.
A fintech should be able to answer five questions clearly: who is the customer, what is the purpose of the relationship, what activity is expected, what has changed, and what must the business do when the explanation is not satisfactory?
If management cannot obtain clear answers from its records and operating procedures, the next step should be a documented compliance review—not another generic policy template.
About the author
I am Samson Ese, Founder, Publisher and Editor-in-Chief of Daily Reality NG. I publish researched guides and explainers on Nigerian financial systems, fintech, business tools, technology, consumer issues and the rules that affect everyday decisions. My aim is to explain important systems in clear language, connect official information to Nigerian realities and help readers understand what they should check before acting.
Editorial and information notice: This article is for general information. It is not legal, regulatory, financial or compliance advice for a particular business. Laws, regulations, guidance and reporting arrangements may change. A fintech should verify the current requirements with the relevant regulator and obtain qualified professional advice where necessary.
Daily Reality NG aims to distinguish official requirements from practical interpretation and illustrative examples. The transaction scenario in this article is hypothetical and does not describe an actual customer or investigation.
Corrections: If you identify a material factual error or an outdated regulatory reference, contact dailyrealityng@gmail.com with the article URL and the supporting evidence.
Comments
Post a Comment