The Central Bank of Nigeria (CBN) has issued fresh directives to banks, financial institutions and payment service providers aimed at strengthening electronic payment security, tightening oversight of the Bank Verification Number (BVN) system and improving the management of dormant bank accounts and unclaimed funds.

The directives were contained in three separate circulars released by the apex bank on March 12, 2026, and sent to banks, other financial institutions and payment service providers operating in the country.

In one of the circulars, the CBN introduced new operational rules for instant payment services in Nigeria as part of efforts to protect customers and reduce cases of electronic fraud.

The apex bank said all financial institutions offering instant payment services must allow customers to voluntarily opt out of the service whenever they wish.

Under the arrangement, customers will be able to switch off the instant transfer feature on their accounts for a chosen period. When this option is activated, customers will not be able to send money electronically through instant transfers to other accounts.

However, the CBN explained that such customers can still visit their bank branches physically to carry out transfers while the restriction is in place.

The regulator said the opt-in and opt-out process must be protected by multi-factor authentication to ensure that only the account owner can make the request.

The circular added that customers will automatically be enrolled for instant payment services when they open a new account, but they can later change their preference if they choose.

The CBN also directed banks to allow customers adjust their personal transaction limits for instant transfers.

While the existing regulatory ceiling of N25 million for individuals and N250 million for corporate accounts remains unchanged, customers can decide to set lower limits on their accounts if they wish.

The apex bank said any change in transaction limits must pass through enhanced verification procedures and risk assessment by the financial institution before it takes effect.

Financial institutions have also been directed to deploy enterprise fraud monitoring systems that can track both incoming and outgoing transactions in real time in order to detect suspicious activities quickly.

According to the circular, stronger identity verification procedures must also be adopted for online account opening and account reactivation.

The regulator said all accounts opened online must undergo a “liveliness check,” while the details of such accounts must be validated instantly against the national identity and BVN databases.

Banks are also required to introduce stronger authentication measures such as biometric verification, soft tokens, hard tokens and other security tools before reactivating accounts online.

The CBN further directed financial institutions to tighten security on mobile banking applications.

Under the new rule, a mobile banking app can only be linked to one device at a time, meaning customers will no longer be able to operate the same banking application on multiple phones simultaneously.

When a customer switches to a new device, the banking app must undergo fresh authentication and reactivation before it can be used.

The circular also introduced temporary transaction limits for newly activated mobile banking applications.

For the first 24 hours after activation, the maximum transaction limit allowed will not exceed N20,000, whether the account Is newly opened or an existing account being activated on a new device.

In addition, customers logging into internet banking on a new device for the first time will be required to complete additional authentication checks.

The CBN said these minimum operational standards for instant payment services will take effect from July 1, 2026.

In another circular, the apex bank introduced amendments to the regulatory framework guiding the operation of the Bank Verification Number system used across the Nigerian banking industry.

One of the changes requires financial institutions to create a temporary watchlist for BVNs that are suspected to be linked to fraudulent transactions.

Under the arrangement, a BVN may be placed on this temporary watchlist for up to 24 hours while the financial institution contacts the account holder to provide an explanation regarding the suspicious transaction.

The CBN said the measure is intended to allow banks respond quickly to potential fraud cases while giving affected customers the opportunity to clarify their transactions.

The regulator also introduced a new age requirement for BVN registration. According to the directive, only individuals who are 18 years and above will be eligible to enrol for a BVN.

The apex bank also placed restrictions on the modification of phone numbers linked to BVN records.

Under the new rule, customers will only be allowed to change the phone number associated with their BVN once.

In addition, the CBN said access to the BVN database will be limited strictly to financial institutions licensed by the regulator.

However, the bank noted that it may grant access in exceptional situations in line with existing laws and regulations. The new BVN rules are scheduled to take effect from May 1, 2026.

In a third circular, the CBN issued further instructions on the management of dormant bank accounts, unclaimed balances and other financial assets held by banks and financial institutions.

The apex bank said the measures are intended to improve transparency, help customers recover forgotten funds and ensure that banks comply fully with existing legal and regulatory requirements.

Under the revised directive, banks will now be allowed to receive requests to reactivate dormant accounts through alternative channels instead of relying only on physical visits to bank branches.

Financial institutions can adopt other secure methods provided they put in place strong identity verification and risk management procedures to confirm that the person making the request is the rightful owner of the account.

The CBN also removed the earlier requirement that customers must present an affidavit when reactivating dormant accounts that have not yet been transferred to the Unclaimed Balances Trust Fund (UBTF) Pool Account.

However, the apex bank said affidavits will still be required when customers are seeking to recover funds that have already been transferred to the UBTF Pool Account.

The circular also directed banks and other financial institutions to publish information about dormant accounts and unclaimed balances.

According to the CBN, banks must display certain details on their official websites, including the name of the account holder, the type of account, the name of the financial institution and the branch where the account is domiciled.

Financial institutions that do not operate websites are required to publish the information on the websites of their industry associations.

Banks must also publish the list of dormant accounts every year in at least two national daily newspapers.

Where the list is too long, the institution may publish a brief notice directing customers to a dedicated section of its website where the full details can be accessed.

The CBN added that state and unit microfinance banks are not required to publish the information in national newspapers but must display it at their business locations.

The regulator also addressed concerns regarding compliance with the Nigeria Data Protection Act 2023.

According to the apex bank, the publication of information about dormant accounts and unclaimed funds does not violate data protection rules because the law allows personal data to be processed when it is required for compliance with legal obligations or for the protection of the interests of the account owner.

The CBN said its powers to issue such directives are also backed by provisions of the Banks and Other Financial Institutions Act 2020, which authorises the regulator to provide guidelines on the administration of unclaimed funds held by banks and financial institutions.

The circular on dormant accounts takes immediate effect and replaces an earlier directive issued on February 17, 2025. (The Nation)