The guidelines, which take effect on July 1, is contained in a circular dated March 12, signed by Musa Jimoh, director, payments system policy department at the CBN.
In the circular to all banks and payment service providers, CBN said the measures are aimed at reducing fraud and giving customers greater control over how they transact digitally.
Under the new framework, all financial institutions offering instant payments must provide customers the option to opt-in or opt-out of the service at any time, with default enrollment set to opt-in for new customers.
“Customers shall have the option to opt-out of/opt-in to IP service at any time and for any given period. This process shall be subject to Multi-Factor Authentication (MFA) control. Default setting shall be Opt-in upon on-boarding a new customer,” the CBN said.
“In the opt-out mode, a customer shall not be able to carry out online instant transfer of funds (intra or inter) from his/her account to another customer. However, customer can physically visit the financial institution to effect transfer during this period.”
The CBN also said customers are to be allowed to adjust transaction limits within the existing caps of N25 million for individuals and N250 million for corporate accounts, provided financial institutions conduct enhanced due diligence before approving changes.
“Any such adjustment shall be subject to enhanced due diligence and appropriate risk assessment by the financial institution,” the circular added.
“The new transaction limit shall take effect immediately upon successful completion of multi-factor authentication (customer consent).”
The CBN also directed banks and payment providers to implement enterprise fraud monitoring systems to track inflows and outflows, ensuring suspicious transactions are flagged and restricted.
In addition, the financial regulator said online account openings and reactivations must now include “liveness checks” against the bank verification number and national identification number (BVN/NIN) database, while enhanced authentication measures such as multi-factor authentication and biometric verification must be applied to validate account access.
Liveness checks is a type of authentication which mandate the user to interact with the device, either by blinking, smiling, turning their head, or speaking to prove they are physically present.
For mobile financial services, the CBN mandated device binding, restricting app usage to a single device at a time.
“Binding Mobile financial services applications (apps) shall only be enabled on one device at a time, and customers cannot operate the apps concurrently on multiple devices,” the apex bank said.
“Migration to another device shall trigger automatic re-activation and authentication. For new accounts, transaction limits (inflow and outflow) shall be imposed on a newly activated mobile financial services app in the first 24-hours of activation.
“The limit shall be as determined by the financial institution, subject to a maximum transaction limit of N20,000.00.
“For existing accounts, transaction limits (outflow) shall be imposed on a newly activated mobile financial services app in the first 24-hours of activation. The limit shall be as determined by the financial institution, subject to a maximum transaction limit of N20,000.00.
“For internet banking access, first-time log on a new device shall require additional MFA.”
