CBN’s Automated AML/CFT Standards Tighten Financial Crime Controls, Put Banks On Terror Financing Alert

The Central Bank of Nigeria (CBN) has stepped up its drive to align the country’s financial system with international anti-money laundering and counter-terrorism financing standards, placing greater responsibility on banks and other financial institutions to demonstrate that their controls can effectively identify, monitor, and report illicit financial activities.

The latest move is anchored on the implementation of the Bank’s Baseline Standards for Automated Anti Money Laundering, Combating the Financing of Terrorism and Countering Proliferation Financing (AML/CFT/CPF) Solutions, which the CBN said are aligned with the recommendations of the Financial Action Task Force (FATF) and other relevant international standards.

The development comes as the apex bank has elevated terrorism financing supervision to a current supervisory priority, signalling a more targeted approach to identifying vulnerabilities through which Nigeria’s financial system could be exploited by illicit actors.

In a statement issued on Tuesday, September 8, 2026, the CBN said the enhanced supervisory focus would cover terrorism-financing risk management, transaction monitoring, implementation of targeted financial sanctions, and suspicious-transaction reporting related to terrorism financing.

“The Bank will continue to apply a risk-based supervisory approach, including on-site and off-site engagement, to support effective AML/CFT/CPF controls across the financial sector in line with existing legal and regulatory obligations,” the CBN said.

The latest supervisory emphasis effectively shifts the fight against financial crime from the mere existence of compliance policies to the ability of financial institutions to demonstrate that those policies work in practice.

This is at the heart of the CBN’s new automated AML framework, which requires regulated institutions to deploy systems capable of supporting risk-based customer due diligence, timely detection of suspicious activities and accurate and timely reporting to the CBN, the Nigerian Financial Intelligence Unit (NFIU) and other competent authorities.

The standards expressly state that they are aligned with FATF Recommendations and other international standards and are intended to ensure that technology deployed by financial institutions delivers demonstrable effectiveness rather than merely satisfying feature-based or vendor-driven compliance.

Under the framework, all banks and other financial institutions regulated by the CBN are required to operate automated AML/CFT/CPF solutions. However, the sophistication of the systems is expected to correspond with each institution’s size, business model, transaction volumes, complexity and risk profile.

Institutions operating in areas with elevated risks of money laundering, terrorism financing, or proliferation financing are expected to apply enhanced monitoring capabilities, irrespective of their size.

The CBN’s approach is therefore not simply about forcing every financial institution to acquire the same technology. Rather, it seeks to establish a common minimum standard while allowing institutions to calibrate their controls to the risks they face.

The baseline requirements cover customer identification and verification, customer risk assessment, sanctions and watchlist screening, politically exposed persons and high-risk customer screening, transaction monitoring, case management, regulatory reporting, audit and governance as well as data protection and security.

The framework also requires institutions to integrate their AML systems with relevant banking, payment, onboarding and other systems so that risks can be assessed across products, channels and customer relationships.

Of particular significance is the CBN’s requirement for a consolidated view of customer risk.

The regulator expects AML systems to link customer identification and verification information, risk classification, transaction behaviour, alerts and case history. This means financial institutions will no longer be able to rely solely on individual transactions to determine whether activity is suspicious.

The CBN stated that automated AML systems must assess activity in the context of the customer’s full profile, while systems that lack effective links to customer due diligence, know your customer and know your business information will not be regarded as compliant.

The standards also strengthen the requirements around sanctions and politically exposed persons screening.

Financial institutions are expected to integrate relevant domestic and global sanctions, watchlists and other prescribed lists into their systems, with the ability to update them in real time or near real time.

Systems must also be capable of identifying variations in names, screening beneficial owners and related parties, flagging politically exposed persons and high risk individuals, monitoring adverse media and, where required, automatically placing holds on or blocking transactions involving confirmed sanctions matches.

For the CBN, however, having sophisticated technology is not enough.

In a March 31, 2026 circular clarifying implementation of the standards, the Bank warned financial institutions against interpreting compliance simply in terms of system features, technology providers or vendor claims.

It said compliance would be assessed at the level of the financial institution based on its ability to demonstrate effective, governed and defensible AML/CFT/CPF controls.

The clarification is significant because it places accountability squarely on regulated institutions, even where AML functions are outsourced to technology companies.

The CBN made it clear that it does not approve, certify or endorse particular AML solutions or technology providers. It also stated that vendors’ claims that their systems are “fully compliant” with CBN requirements are not recognised by the regulator.

Instead, institutions must demonstrate three broad qualities: defensibility, governance and effectiveness.

Defensibility requires clear audit trails, explainable decisions and traceability of actions. Governance requires defined ownership and oversight, model validation, change controls and structured investigation processes. Effectiveness requires credible detection capabilities, timely investigation and resolution as well as measurable outcomes, including the management of false positives.

The CBN further clarified that its standards are technology-neutral.

Financial institutions may deploy rules-based systems, machine learning models or hybrid approaches, provided that the systems demonstrably meet regulatory expectations.

The use of artificial intelligence, therefore, does not automatically amount to compliance.

This reflects the Bank’s wider shift towards a risk-based supervisory model in which technology is regarded as an enabler of compliance rather than a substitute for institutional responsibility.

The implementation process itself has also been subjected to regulatory scrutiny. Following the issuance of the baseline standards on March 10, 2026, financial institutions were required to submit implementation roadmaps within 3 months, with full compliance set at 18 months for deposit money banks and 24 months for other financial institutions.

The subsequent guidance required institutions to clearly identify their current state, target state, required actions, timelines, and ownership and governance arrangements.

The CBN said the implementation plans would form the basis for supervisory review and engagement, with the Bank assessing the adequacy of implementation approaches, governance arrangements, effectiveness and integration of proposed solutions.

Incomplete, inconsistent or unsupported submissions, it warned, could attract supervisory action.

The renewed focus on terrorism financing adds another layer to this compliance architecture.

The CBN said its supervisory priority would specifically examine terrorism financing risk management, transaction monitoring, targeted financial sanctions and terrorism financing-related suspicious transaction reporting.

It also reaffirmed that further supervisory engagement would be undertaken as appropriate.

The move is consistent with the Bank’s broader efforts to strengthen financial crime supervision. The CBN’s 2025 supervisory activities included risk-based AML/CFT/CPF examinations across banks, international money transfer operators and payment service providers, while institutions were required to undertake root cause analyses and submit corrective action plans where deficiencies were identified.

The Bank also worked with the NFIU on compliance engagements covering suspicious transaction reporting, beneficial ownership, sanctions screening, asset freezing and board accountability for financial crime risk oversight.

This supervisory architecture is increasingly important as Nigeria seeks to maintain the gains recorded in strengthening its financial integrity framework.

The CBN’s new standards explicitly link domestic compliance requirements to the FATF Recommendations and other international standards, covering customer due diligence, sanctions, politically exposed persons screening, recordkeeping, and reporting.

The objective is ultimately to ensure that Nigeria’s financial system is not only compliant on paper but also capable of preventing, detecting, and reporting on money laundering, terrorism financing, and proliferation financing risks as they evolve.

With the latest terrorism-financing focus, the CBN is therefore signalling that compliance will increasingly be judged by results: how quickly suspicious activity is identified, how effectively alerts are investigated, how sanctions are implemented, and how accurately information reaches the relevant authorities.

For banks and other financial institutions, the message is clear. The era of treating AML/CFT compliance as a largely manual or documentation-based exercise is giving way to a more integrated, technology-enabled, and risk-based supervisory regime in which institutions must be able to demonstrate that their controls work.

For CBN, the objective goes beyond protecting individual institutions; it is about ensuring that Nigeria’s financial system remains aligned with global standards and resilient against increasingly sophisticated methods by which illicit funds can move through the formal financial system.