CBN AML/CFT Implementation Guide for Nigerian Fintechs

CBN AML/CFT compliance is usually approached as a documentation exercise and fails as one. This guide treats it as an engineering problem: what controls must actually run, what evidence they must produce, and how to reach a defensible state without a nine-month programme. It is written for the CTO and compliance lead who have to make it real, not for a policy binder.

Scope: what CBN AML/CFT actually requires

At its core, the regime requires a risk-based programme with five operating capabilities: customer due diligence (CDD/KYC), ongoing monitoring, suspicious-transaction detection and reporting (STR), currency-transaction reporting (CTR) where applicable, and a governance layer (a compliance officer, board oversight, training, and record-keeping). Each of these can be documented — or engineered so it runs and proves itself. This guide takes the second path.

The control set, as engineering

The findings we see most often

• KYC that is enforced at signup but not re-verified on risk triggers.
• Monitoring rules that exist but produce no retained evidence of having run.
• STR processes that depend on a single person noticing, with no detection threshold.
• Record-keeping scattered across tools, impossible to produce for a specific customer under time pressure.

A phased implementation path

1. Baseline (week 1–2): map current controls to the requirement set; identify which are documented vs. enforced. Use the CBN AML checklist.
2. Engineer the gaps (week 3–5): convert the highest-risk administrative controls into enforced ones — starting with monitoring and STR detection.
3. Wire evidence (week 4–6): route control outputs into a mapped, tamper-evident store so proof accumulates automatically.
4. Operationalise (ongoing): move toward continuous compliance so readiness is maintained, not rebuilt.

Keeping evidence continuous

The failure mode after go-live is drift: rules change, a data source moves, and evidence quietly stops. An evidence-native design prevents this by capturing at the source and detecting freshness gaps. For a worked example of this path end to end, see the NovaPay case study, where a PSP moved from 23/100 to CBN-compliant in six weeks. The commercial version of this work is CBN AML Compliance Readiness.