The Central Bank of Nigeria (CBN) has introduced new regulations requiring individuals to be at least 18 years old before they can register for the Bank Verification Number (BVN), as part of broader measures to strengthen electronic payment security and oversight in the banking sector.
The directives were contained in three separate circulars issued by the apex bank on March 12, 2026, and sent to banks, financial institutions and payment service providers across Nigeria.
New Instant Payment Security Measures
In one of the circulars, the CBN announced new operational standards for instant payment services aimed at reducing electronic fraud and enhancing customer protection.
Under the new rules, customers must be allowed to voluntarily opt out of instant payment services whenever they choose. When this feature is activated, account holders will temporarily be unable to send money through instant electronic transfers.
However, such customers will still be able to conduct transfers by visiting bank branches physically during the restriction period.
The regulator added that the opt-in and opt-out process must be secured with multi-factor authentication to ensure that only the account owner can activate the feature.
Customers will also be automatically enrolled for instant payment services when opening new bank accounts but will retain the right to adjust their preferences later.
The CBN further directed banks to allow customers set their own transaction limits for instant transfers. While the regulatory caps remain ₦25 million for individuals and ₦250 million for corporate accounts, customers may choose to lower their limits for added security.
Financial institutions must also implement enterprise fraud monitoring systems capable of tracking incoming and outgoing transactions in real time to detect suspicious activity quickly.
Stronger Identity Verification
The apex bank introduced stricter identity verification procedures for online banking activities, including account opening and reactivation.
All accounts opened online must undergo a “liveliness check,” while customer information must be validated instantly against national identity databases and the BVN system.
Banks are also required to adopt stronger authentication tools such as biometric verification, soft tokens, hard tokens and other security measures before reactivating accounts online.
In addition, mobile banking applications will now be restricted to a single device at a time. Customers who change devices will need to complete a fresh authentication process before using the banking app again.
The new operational standards for instant payment services are scheduled to take effect on July 1, 2026.
BVN Watchlist and Phone Number Restrictions
In another circular, the CBN introduced amendments to the regulatory framework guiding the BVN system used across Nigeria’s banking industry.
One of the major changes allows financial institutions to place suspicious BVNs on a temporary watchlist for up to 24 hours if they are linked to suspected fraudulent transactions.
During this period, the financial institution will contact the account holder for clarification regarding the transaction.
The regulator also placed restrictions on the modification of phone numbers linked to BVN records, stating that customers will only be allowed to change the registered phone number once.
Access to the BVN database will also be restricted strictly to financial institutions licensed by the CBN, although the bank noted that access could be granted in exceptional circumstances in line with existing laws.
The new BVN regulations are expected to take effect from May 1, 2026.
New Rules for Dormant Accounts and Unclaimed Funds
In a third circular, the CBN introduced new guidelines for managing dormant bank accounts and unclaimed balances held by financial institutions.
Under the revised rules, banks may now accept requests to reactivate dormant accounts through alternative channels instead of requiring customers to visit branches physically.
Financial institutions must, however, ensure that strong identity verification and risk management procedures are in place before reactivating such accounts.
The regulator also removed the requirement for customers to present an affidavit when reactivating dormant accounts that have not yet been transferred to the Unclaimed Balances Trust Fund (UBTF) Pool Account.
However, affidavits will still be required when customers attempt to reclaim funds that have already been transferred to the UBTF.
Banks have also been directed to publish details of dormant accounts and unclaimed balances on their official websites and annually in at least two national newspapers. Institutions without websites must publish the information through their industry associations.
The CBN explained that this disclosure does not violate the Nigeria Data Protection Act 2023 because personal data may be processed when required to meet legal obligations or protect the interests of account holders.
The circular on dormant accounts takes immediate effect and replaces an earlier directive issued on February 17, 2025.
