The Central Bank of Nigeria (CBN) has released new draft guidelines that could require banks and other financial institutions to refund victims of Authorised Push Payment (APP) fraud within 48 hours after investigations are concluded.
According to the new draft guidelines, financial institutions will now be required to complete investigations into reported APP fraud cases within 14 working days and once the investigation is finalised and the customer is deemed eligible, the bank must issue reimbursement within 48 hours.
The CBN proposed that institutions that failed to detect suspicious account activity or freeze fraudulent proceeds will be liable for the full exposure.
The latest customer-protection framework highlighted that APP fraud differed from account compromise because victims are convinced or manipulated into authorising the transfer themselves, and these scams usually rely on impersonation, deception, emotional pressure, or fake investment offers—forms of fraud that have become more difficult to prevent as digital payments grow.
- Advertisement -
The apex bank stated that the draft guidelines were aimed at strengthening trust in Nigeria’s digital-payments ecosystem, where instant transfers dominate retail transactions. Comments on the draft guidelines are expected within three weeks before final rules are issued.
Some of its key features are that the draft document introduces extensive governance requirements for banks, mandating their boards to approve new fraud-risk policies and oversee all aspects of APP-fraud prevention, detection, escalation, investigation, and post-incident review.
The rules require institutions to maintain Early Warning Systems capable of identifying high-risk transactions based on behavioural patterns, unusual inflows and outflows, repeated fraud complaints, previously flagged accounts, and market-intelligence indicators.
In addition, banks will also be required to establish dedicated fraud analytics units to document red-flag triggers, strengthen internal controls, and update detection frameworks regularly.
According to the draft framework, in multi-bank cases, the originating institution must begin investigation immediately and notify other institutions involved within 30 minutes of receiving the complaint.
Similarly, the CBN has strengthened its escalation protocol such that where institutions do not reach a conclusion within the 14-day investigation period, the case will be transferred to the CBN’s Consumer Protection and Financial Inclusion Department, which will issue a binding decision.
The protocol also states that any institution that fails to freeze fraudulent proceeds, or whose weak internal systems enable such funds to pass through, will bear the full financial liability.
The guidelines further mandated the banks to ensure transparency in communicating investigation outcomes to customers, including reasons for denial of reimbursement while detailed records of the investigations and outcomes must also be maintained and submitted to the CBN every quarter, alongside evidence of financial literacy and fraud-awareness campaigns.
On eligibility rules and mandatory 72-hour reporting, the apex bank outlined strict conditions for determining whether a customer qualifies for reimbursement. The rules state that a victim is eligible where they authorised the transaction under false pretences and had no reasonable cause to suspect fraud.
In such a case, the customer must report the incident within 72 hours and cooperate fully with the investigation.
The draft guidelines also require that there must be no evidence of negligence, collusion, or criminal intent by the customer, the guidelines, however, allow flexibility for delayed reporting in cases such as illness, force majeure, security concerns, or demonstrable unavailability of reporting channels.
Under the draft document requirements, banks are required to offer 24/7 reporting platforms, including hotlines, email, mobile apps, USSD channels and in-branch reporting stations.
The draft also clarifies cost-sharing rules. Where neither the sending nor receiving bank is at fault, but the customer qualifies for reimbursement, both institutions must split the reimbursement amount equally. All data handling throughout the investigation must comply with the Nigeria Data Protection Act 2023.
In addition, the apex bank also emphasised the need for consumer awareness as banks will be required to carry out quarterly fraud-education campaigns across multiple languages and platforms, as APP fraud relies heavily on deception rather than system compromise.
Analysts believe that the draft guidelines represent one of the strongest consumer-protection measures introduced by the apex bank in response to rising social-engineering scams and payment-manipulation cases across the financial system.
