The Central Bank of Nigeria has set binding minimum standards for every automated AML/CFT/CPF system deployed by a regulated financial institution. They include 12 standards and 100 requirements. Most existing AML systems in Nigeria do not meet these standards.
"AML Solutions without effective linkage to CDD/KYC/KYB information… will not be regarded as compliant."
The Baseline Standards define exactly what technology and governance your institution must have in place, not just in policy, but demonstrably in practice.
Anchored in the MLPPA 2022, TPPA 2022, and CBN AML/CFT Regulations. This is regulation with sanctions attached.
These standards specifically govern your automated AML system, what it must do, how it must integrate with other systems, and how it must be governed.
CBN examiners will use these as their rubric. Institutions must demonstrate each capability with contemporaneous evidence.
The CBN has set a higher bar than most institutions realise. Here are the most common and most critical reasons institutions will fail.
"AML Solutions without effective linkage to CDD/KYC/KYB information and customer risk assessments will not be regarded as compliant."— CBN AML/CFT Baseline Standards, Section 5.2 · Issued March 10, 2026
Your transaction monitoring system flags activity in isolation without connecting to your customers' verified identity, risk profile, or onboarding data.
Examiners will ask: "Show me the alert, who reviewed it, what they decided, and why." If you cannot produce this in real time, you fail Standard 5.9.
Alert reviews done in Excel. STRs filed manually. Case notes stored in email threads. These workflows will not survive a live system demonstration.
A transaction monitoring/fraud detection tool, that receives only raw transaction data, without real-time integration to core banking and KYC is explicitly non-compliant for high-risk institutions.
If you use AI or machine learning in your AML system for risk scoring, alert generation, or name matching, and you cannot show annual independent validation, you fail.
Using one vendor for KYC, another for transaction monitoring/fraud detection, a third for sanctions screening, and a fourth for case management, with no integration between them.
Read this carefully and tick the ones that apply to your institution right now.
All CBN-licensed financial institutions.
Commercial, merchant & non-interest banks
State, national & unit MFBs, with proportionate requirements
PSPs, switching companies, gateways & super-agents
IMTOs and domestic cross-border operators
Mortgage institutions, finance houses & non-bank FIs
CBN-licensed MMOs and payment service banks
Proportionality principle: Implementation depth is calibrated to your institution's size, risk profile, and transaction volumes. A unit MFB and a Tier-1 bank will comply differently, but both must comply. Institutions in high-risk sectors must apply enhanced monitoring regardless of size.
Issued March 10, 2026. The clock is already running.
Every CBN-regulated institution must submit a formal implementation roadmap to the CBN Compliance Department within 3 months of issuance.
95 requirements across 12 standards, plus 5 cross-cutting obligations in Section 6. Here's what each standard covers.
Sets the minimum functional footprint every AML system must cover.
Automated due diligence that stays live — even post-onboarding.
Real-time screening that goes well beyond simple name matching.
Dynamic scoring that reflects how risk actually evolves over time.
The most requirement-dense section — 13 requirements in total.
Applies where your AML system also handles fraud.
Every alert must be tracked, reviewed, and documented.
Automated, structured reporting to regulators and internal stakeholders.
Tamper-proof records that can withstand regulatory scrutiny.
Your AML system cannot be an island — it must connect to everything.
Data security that meets NDPA and CBN cybersecurity requirements.
The system must support the people who use it, not hinder them.
A phased approach is essential. Start with a gap assessment, then build from there.
Critical reminder: The CBN explicitly states that AML Solutions without effective linkage to CDD/KYC/KYB information and customer risk assessments will not be regarded as compliant. Spreadsheet-based monitoring, standalone transaction feeds (for high-risk institutions), and systems that cannot produce contemporaneous evidence per standard will fail examination.
Everything you need to assess your gap, build your plan, and get examination-ready.
Regfyl is built end-to-end around the CBN Baseline Standards. KYC linkage, real-time transaction monitoring, sanctions & PEP screening, automated case management, regulatory reporting, and full audit trails: all 12 standards, one integrated platform, zero fragmentation.
What Nigerian financial institutions ask most about the CBN Baseline Standards.
Book a free 30-minute session with the Regfyl compliance team. We'll walk you through where your institution stands and what to prioritise first.
The CBN Baseline Standards treat AML as a single, connected lifecycle. A customer's risk profile flows from onboarding into every transaction they make. Every suspicious transaction creates a case. Every case produces a report. Every report leaves an audit trail. Institutions that treat these as separate functions — separate tools, separate teams, separate data — will fail examination. The standard requires them to be one integrated system.
Regfyl has already helped financial institutions align with regulatory requirements; including real-time monitoring, STR reporting, and audit-ready workflows.
These are not future promises. They are deployed capabilities, working in 100+ Nigerian financial institutions right now.