Nigeria's AML/KYC Legal Framework
Nigeria's primary AML/KYC legislation is the Money Laundering (Prevention and Prohibition) Act 2022 (MLPPA 2022), which repealed and replaced the Money Laundering (Prohibition) Act 2011. The MLPPA 2022 was enacted to address deficiencies identified in Nigeria's 2021 FATF Mutual Evaluation Report and to bring Nigerian law into full alignment with the FATF 40 Recommendations. Nigeria was placed on the FATF grey list in June 2023 and removed in June 2024 following successful implementation of its action plan.
The MLPPA 2022 is supplemented by the Terrorism (Prevention and Prohibition) Act 2022 (TPPA 2022), which covers counter-terrorist financing (CTF) obligations, and by sector-specific regulations issued by the Central Bank of Nigeria (CBN), the Securities and Exchange Commission (SEC), and the National Insurance Commission (NAICOM).
Supervisory Architecture
| Body | Role | Supervised Sectors |
|---|---|---|
| NFIU | Nigeria Financial Intelligence Unit — national FIU, receives STRs/CTRs, issues AML/CFT guidelines | All reporting entities |
| CBN | Central Bank of Nigeria — prudential and AML supervision of banks and fintechs | Banks, MFBs, PSPs, BDCs, fintechs |
| EFCC | Economic and Financial Crimes Commission — criminal investigation and prosecution | All sectors (enforcement) |
| SEC Nigeria | Securities and Exchange Commission — capital markets AML supervision | Brokers, fund managers, exchanges |
| NAICOM | National Insurance Commission — insurance sector AML supervision | Insurers, reinsurers, brokers |
| SCUML | Special Control Unit against Money Laundering — DNFBP supervision | Lawyers, accountants, estate agents, dealers in precious metals |
Designated Reporting Entities
The MLPPA 2022 defines two categories of reporting entities: Financial Institutions (FIs) and Designated Non-Financial Businesses and Professions (DNFBPs). Both categories are subject to the same core KYC obligations, though the supervisory body differs.
| Category | Examples | Supervisor |
|---|---|---|
| Banks | Commercial, merchant, non-interest, microfinance banks | CBN |
| Fintechs / PSPs | Payment service providers, mobile money operators, switching companies | CBN |
| Bureau de Change | Licensed BDC operators | CBN |
| Capital Markets | Stockbrokers, fund managers, investment advisers, exchanges | SEC Nigeria |
| Insurance | Life and non-life insurers, reinsurers, insurance brokers | NAICOM |
| Lawyers | Legal practitioners handling real estate, company formation, or asset management transactions | SCUML |
| Accountants | Audit firms, tax advisers, management consultants | SCUML |
| Estate Agents | Real estate developers and agents involved in property transactions | SCUML |
| Dealers in High-Value Goods | Dealers in precious metals, stones, luxury vehicles, art | SCUML |
| Virtual Asset Service Providers | Crypto exchanges, VASPs licensed by the SEC | SEC Nigeria |
Core KYC Obligations Under MLPPA 2022
| Obligation | MLPPA 2022 Section | Requirement |
|---|---|---|
| Customer Identification | s.3 | Verify identity of customers using government-issued ID (NIN, BVN, passport, driver's licence) before establishing a relationship |
| Beneficial Ownership | s.3(3) | Identify natural persons owning or controlling ≥5% of a legal entity (lower threshold than FATF standard 25%) |
| PEP Screening | s.3(5) | Apply EDD to domestic and foreign PEPs; obtain senior management approval; conduct enhanced ongoing monitoring |
| Suspicious Transaction Reports | s.6 | File STRs with the NFIU within 24 hours of suspicion arising (not 15 days as in South Africa) |
| Currency Transaction Reports | s.10 | Report cash transactions of ₦5 million (individuals) or ₦10 million (entities) to the NFIU |
| Record Keeping | s.11 | Retain CDD records and transaction records for a minimum of 5 years from the end of the relationship |
| Compliance Officer | s.14 | Appoint a designated AML/CFT Compliance Officer at management level; register with the NFIU |
BVN and NIN — Nigeria's Digital Identity Infrastructure
Nigeria has two national digital identity systems that are central to KYC verification. The Bank Verification Number (BVN), introduced by the CBN in 2014, is a unique 11-digit identifier linked to biometric data (fingerprints and facial recognition) and is mandatory for all bank account holders. The National Identification Number (NIN), issued by the National Identity Management Commission (NIMC), is a broader national identity number linked to the National Identity Database (NIDB).
Since December 2020, the CBN has required all bank accounts to be linked to a NIN. For KYC purposes, a BVN or NIN is the primary identity verification document for individual customers. For corporate customers, the primary verification document is the Certificate of Incorporation issued by the Corporate Affairs Commission (CAC), supplemented by the CAC-registered beneficial ownership information (mandatory since 2020 under the Companies and Allied Matters Act 2020).
Penalties for Non-Compliance
| Contravention | Penalty (Individual) | Penalty (Entity) |
|---|---|---|
| Failure to conduct CDD | ₦10 million fine or 2–3 years imprisonment | ₦25 million fine |
| Failure to file STR | ₦10 million fine or 2–3 years imprisonment | ₦25 million fine |
| Tipping off | ₦5 million fine or 2 years imprisonment | ₦10 million fine |
| Money laundering conviction | 7–14 years imprisonment + forfeiture | Fine equal to 5× the value of the laundered funds |
Relevance for African Exporters and the Three Gates Framework
Nigerian exporters — particularly in the textiles, agriculture, and mining sectors — must complete their CAC entity verification and MLPPA 2022 KYC obligations before they can access Gate 2 (CBAM) or Gate 3 (Digital Product Passport) of the Three Gates Framework. The CAC Certificate of Incorporation and the beneficial ownership register are the primary documents required to establish the verified entity node at the DPP Registry.