Nigerian fintech founders spent most of 2025 treating compliance as a line item to revisit later. That runway just ran out. Between January and June 2026, the Central Bank of Nigeria issued a dense stack of directives touching onboarding, transaction monitoring, cash handling, fraud liability, and market structure — and unlike previous years, nearly all of it now carries hard deadlines rather than vague guidance.
Why 2026 Is Different From Every Compliance Year Before It
For most of the last decade, Nigerian fintech ran on a simple, if unofficial, playbook: build fast, chase scale, and treat regulation as a problem for later. That playbook is now closed. Nearly 11 billion NIBSS Instant Payment transactions moved through Nigeria’s rails in 2024 alone, and the CBN has made clear it no longer intends to supervise that volume with manual spot checks.
The clearest signal is the March 10, 2026 circular establishing Baseline Standards for Automated AML/CFT/CPF Solutions, published on the CBN’s own reforms page. It requires every deposit money bank, payment service provider, mobile money operator, and international money transfer operator to deploy automated systems capable of real-time transaction monitoring, customer risk profiling, and sanctions screening. Banks have 18 months to fully deploy; every other regulated institution has 24 months. The catch is the shorter clock inside the long one — every affected institution had to submit an implementation roadmap to the CBN within 90 days of the circular, putting the first real checkpoint around June 10, 2026. A follow-up guidance note issued March 31 clarified that compliance will be assessed at the institutional level, closing off the excuse that a vendor’s software, rather than the fintech’s own controls, was responsible for a gap.
This is not an isolated tightening. It sits alongside a Nigeria Data Protection Act enforcement regime that has already produced fines running into the hundreds of millions of naira, a new requirement that regulated institutions disclose their Ultimate Beneficial Owners, and a data localisation directive ordering payment transaction data generated in Nigeria to sit on local servers by January 1, 2027. Layered together, these rules describe a regulator moving from periodic inspection toward continuous, provable compliance — a shift TechMoonshot has tracked since the CBN first pushed 4 million PoS terminals through a GPS geo-tagging mandate in 2025.
The Licence Question: What You Actually Need
Nigeria’s fintech licensing framework is built around function, not branding. A startup that routes, clears, or settles transactions between senders and receivers needs a Switching and Processing licence, which carries a ₦2 billion capital requirement and a non-refundable ₦100,000 application fee. Mobile Money Operator status, International Money Transfer Operator licences, and Payment Solution Service Provider registrations each carry their own capital floors and review timelines, and picking the wrong category — or assuming your product is exempt because it “just” moves data — is one of the fastest ways to draw supervisory attention.
Open Banking complicates that picture further. Nigeria became the first African country to formalise an open banking framework back in 2021, but implementation has been a five-year crawl through operational guidelines, a delayed 2025 launch, and a phased 2026 rollout now confirmed in the CBN’s FinTech Report. Only CBN-licensed entities can register as API providers or consumers through the Nigeria Inter-Bank Settlement System’s Open Banking Registry, and access to the most sensitive personal and transaction data — the categories the framework calls PIFT and PAST — is reserved for participants with the risk maturity to sit at Tier 2 or Tier 3. A startup betting its entire product on account-linking data it does not yet have a licensed right to touch is building on borrowed time.
APP Fraud Just Became a Balance Sheet Problem
The single change most likely to hit a startup’s unit economics is the CBN’s draft framework on Authorised Push Payment fraud. Under the old defence, a bank or fintech could deny liability once it proved the customer had authorised the transaction — even if the customer had been manipulated into approving it. The new guidelines dismantle that defence outright. Reimbursement can now be required even when the customer initiated and approved the transfer, provided they were not grossly negligent, and where fault is unclear between sending and receiving institutions, the loss is split between them. Any institution that failed to flag a suspicious account in the fraud chain risks bearing the full loss alone.
That single change reorders incentives across the industry. Fintechs built on frictionless onboarding and instant transfers now have a direct financial reason to slow both down. Expect longer verification steps for first-time transfers, cooling-off periods before large payments to new beneficiaries clear, and heavier real-time monitoring — the opposite of the seamless experience that helped platforms like Moniepoint scale past unicorn status in the first place. The tension between fraud liability and product velocity is not going away; it is becoming the defining design constraint for Nigerian consumer fintech in 2026.
Cash, Consumer Protection, and the Rules Nobody Is Watching Closely Enough
While AML automation and APP fraud dominate industry conversation, a quieter set of consumer-facing rules is reshaping how money physically moves through Nigeria. Revised cash-handling policies effective January 1, 2026 scrapped the cumulative deposit limits that once penalised agents for taking in large volumes of cash, but tightened withdrawals sharply: individuals are capped at ₦500,000 a week across all channels, corporates at ₦5 million, and ATM withdrawals sit at ₦100,000 a day with a ₦500,000 weekly ceiling. Excess withdrawals attract a 3 percent fee for individuals and 5 percent for corporates, split between the CBN and the institution.
For agency banking networks that function as informal ATMs for millions of Nigerians, this is a mixed outcome. Depositing is now frictionless. Cashing out is not — and for platforms whose margins depend on high-frequency float and transaction volume, tighter withdrawal ceilings could dent the very cash-in, cash-out economics that made agent banking profitable. Meanwhile, revised PoS geo-fencing rules extended the permitted radius from 10 metres to 70 metres following industry pushback, but pushed enforcement to August 1, 2026, meaning operators still need to document compliance before that date rather than treating the extension as indefinite breathing room.
Device binding for digital financial services is the least discussed of the H1 2026 directives but arguably the most consumer-facing. It requires institutions to strengthen the link between a customer, their registered device, and their account before certain transactions can complete — a direct response to the SIM-swap and social-engineering fraud vectors that APP fraud rules are also trying to close. Startups building onboarding flows around speed alone will need to budget engineering time for additional device verification, particularly for users switching phones, a routine event in a market where secondhand device turnover is high.
The Compliance Stack You Actually Need to Build
Reading the circulars is one exercise. Translating them into a working compliance function is another, and it is where most Nigerian fintechs are currently behind. Start with onboarding: does your KYC flow actually verify BVN and NIN against a live database at account creation, or does it simply collect and store the documents? Dojah’s breakdown of the 2026 KYC requirements notes that the March 2026 Baseline Standards expect integration, not just capture. From there, real-time transaction monitoring needs to flag suspicious activity automatically, generate an audit trail, and route Suspicious Transaction Reports to the Nigerian Financial Intelligence Unit without manual intervention at every step. KYC records need retention for at least five years after a customer relationship ends, stored in a way that survives a CBN audit request made with no notice.
None of this happens without budget and headcount that many seed-stage teams have historically deferred. That is precisely the trade-off the CBN’s 2026 enforcement wave is forcing into the open, and it is part of the same broader consolidation pressure TechMoonshot has previously mapped in Africa’s coming wave of fintech super-conglomerates, where scale increasingly buys the compliance infrastructure that smaller, thinly capitalised competitors cannot afford to build from scratch.
Who Enforces What, and Where the Overlaps Bite
Nigerian fintechs answer to more than one master, and the overlaps are not always clean. The CBN governs licensing, payments infrastructure, AML, and monetary policy compliance. The Federal Competition and Consumer Protection Commission handles consumer protection, with particular focus on digital lenders. The Nigeria Data Protection Commission enforces the Nigeria Data Protection Act, and has already shown it will act — its August 2025 compliance notices went out to more than 1,300 organisations, and its fines against Fidelity Bank and MultiChoice Nigeria in 2024 and 2025 respectively signalled the NDPC intends to be taken seriously, not treated as a paper tiger. A startup that satisfies the CBN’s onboarding and AML expectations but ignores NDPA registration requirements has solved only part of the problem.
That regulatory density is not unique to fintech, but the industry sits closer to the centre of it than most sectors. Even startups that raised licences through channels seen as more straightforward — the way Fincra secured its IMTO licence to expand cross-border payments — now operate inside a supervisory environment that has grown considerably more demanding since. What counted as sufficient compliance in 2024 is unlikely to satisfy an examiner in 2026.
What Comes Next
The CBN’s direction of travel is unambiguous: continuous, provable compliance over periodic box-ticking, and fraud prevention over fraud response. What remains genuinely uncertain is whether Nigeria’s fintech sector — a market of more than 430 companies as of early 2025, most of them thinly capitalised relative to the compliance infrastructure now expected of them — can absorb this cost without triggering the exact consolidation wave regulators and larger incumbents are already positioning for. Founders who treat the June 2026 AML roadmap deadline, the August 2026 PoS geo-fencing enforcement date, and the 2027 data localisation cutoff as a single connected timeline, rather than three separate compliance chores, will be the ones still standing when the enforcement window fully closes.
