The Central Bank of Nigeria published draft guidelines setting minimum requirements for all CBN-licensed financial institutions to prevent, detect, report and resolve Authorised Push Payment (APP) fraud across electronic payment channels, including a structured investigation process and customer reimbursement rules. The draft framework places board-level responsibility for APP fraud governance, requires an APP fraud policy reviewed at least every two years, and assigns implementation to the Head of Compliance. Institutions would be required to implement and periodically test an Early Warning System (EWS) with account red-flagging, enhanced monitoring or restriction pending investigation, and a fraud data analytics capability. For complaints, institutions must provide 24/7 reporting channels, acknowledge reports within 24 hours with a case reference and indicative timelines, initiate investigations immediately, and conclude investigations within 14 working days, with the CBN able to direct NIBSS or other settlement entities to withhold settlement for suspected fraudulent transactions. Eligible customers would be reimbursed within 48 hours after a documented investigation concludes, while multi-institution cases trigger a 30-minute notification requirement, joint investigation and reimbursement within 16 working days, with cost allocation rules and escalation to the CBN Consumer Protection and Financial Inclusion Department if resolution is not reached within the stipulated timeframe. The draft also sets eligibility and exclusion criteria, requires quarterly regulatory returns and quarterly customer awareness campaigns, and provides for sanctions for non-compliance and for submitting false or incomplete information.
Central Bank of Nigeria 2025-11-01
Central Bank of Nigeria publishes draft guidelines on prevention, complaint handling and reimbursement for authorised push payment fraud
The Central Bank of Nigeria issued draft guidelines for CBN-licensed financial institutions to combat Authorised Push Payment fraud, requiring board-level governance, a biennial APP fraud policy review, and compliance-led implementation. Institutions must establish an Early Warning System, provide 24/7 reporting channels, and ensure customer reimbursement within 48 hours post-investigation. The guidelines also include joint investigation protocols for multi-institution cases, quarterly regulatory returns, and sanctions for non-compliance.