Answer at least 70 of 90 questions to view your tier classification.
CBN Readiness Scorecard
BSD/DIR/PUB/LAB/019/002
CBN Readiness Scorecard
BSD/DIR/PUB/LAB/019/002
A 90-minute self-assessment for Nigerian fintechs, MFBs, and banks against the Baseline Standards for Automated AML/CFT/CPF Solutions issued by the Central Bank of Nigeria on 10 March 2026. Read the source circular.
This scorecard is a structured reading of CBN Circular BSD/DIR/PUB/LAB/019/002. It does not replace a formal gap analysis, but it is the assessment your team should run before commissioning one. Built for honest internal use by risk, compliance, and engineering leadership.
The CBN circular is read most often as a technology mandate. It is not. It is a personal-liability instrument backed by a real fraud-loss landscape and an enforcement posture that has visibly tightened since March. Read in that order before you read the standards themselves.
Under the Money Laundering (Prevention and Prohibition) Act 2022, named officers face fines and custodial sentences for failures of diligence. Under the Banks and Other Financial Institutions Act 2020, the CBN may revoke an institution's licence for material non-compliance and sanction directors and officers in their individual capacity.
The March circular extends both regimes to the AML/CFT/CPF technology stack. Where a monitoring system fails to detect a flagged pattern that a reasonably-implemented automated solution would have caught, the institution and its named officers — not just the vendor — are exposed.
"Consequences may affect both the institution and accountable individuals." Senior management and compliance officers carry personal regulatory exposure.
Per NIBSS public reporting, electronic-fraud volume in Nigerian banking has risen sharply year-on-year, with social-engineering and account-takeover the fastest-growing categories. Insider-related fraud and glitches accounted for more than ₦22 billion of losses across Nigerian banks in the eight months leading into 2026.[2]
The Arup deepfake video-call fraud (Hong Kong, January 2024, US$25.6M) is the template arriving in West African banking now. AI-generated synthetic identities are passing real-time KYC checks at major fintechs. Detection-based AML, used in isolation, can no longer keep pace with attacks generated at machine speed.
The CBN Compliance Department tracks roadmap submissions. The 18-month and 24-month full-compliance windows are deadlines after which enforcement action is expected, not extension dates. Annual fitness-and-propriety assessments now include AML/CFT/CPF compliance as a named criterion. Licence renewals for PSPs and MFBs are being delayed where compliance gaps are identified during quarterly reviews.
The CBN also rolled out a Cybersecurity Self-Assessment Tool (CSAT) in April 2026, requiring institutions to report cybersecurity posture in real time. The Nigeria Data Protection Commission opened formal investigations into named institutions in the same window. The combined signal is unambiguous: enforcement has moved from awareness to action.
Six numbers that frame why the CBN issued the Baseline Standards. Every figure links to a publisher; verify before quoting in board papers.
| № | Figure | Reality | Source |
|---|---|---|---|
| 01 | 4,000+ | Coordinated cyberattacks per week across Nigeria. The NDPC alone records over 1,500 attempts per week on its own networks.[1] | NDPC, May 2026 |
| 02 | ₦22B+ | Lost to insider-related glitches and fraud at Nigerian banks in the eight months leading into 2026. Insider risk is now the most-cited concern by Nigerian CCOs.[2] | Dojah, 2026 |
| 03 | +71.5% | Year-on-year increase in dormant ("sleeper") accounts in Nigeria — accounts opened, left inactive for months, then activated by coordinated fraud rings.[2] | Dojah, 2026 |
| 04 | ~70% | Projected intensification in AI-driven phishing and impersonation campaigns in 2026. Generative AI now produces deepfake voice clones and bank-mimicking emails at scale.[3] | Techpoint Africa, 2026 |
| 05 | 900,000* | Customer records (BVN, NUBAN, transaction history) alleged to have been exposed in the March 2026 Sterling Bank breach claim. NDPC investigation ongoing.[4] | BusinessDay, April 2026 |
| 06 | ₦18.78T | Q1 2026 PoS transaction volume in Nigeria — the attack surface CBN is asking you to monitor in real time, with explainable decisions and immutable logs.[5] | NIBSS, 2026 |
Figures reflect public reporting as of May 2026. Verify the latest figure with the publisher before citing in board papers.
If you score Tier 3 or Tier 4 on this assessment, you are in the cohort the CBN is actively watching. The 90 minutes you are about to spend here is the cheapest hour of risk-reduction work your institution will do this year.
Your work email — your bank, fintech, MFB, or PSP domain. We send your scored result and a free Autogon Playground access link to that address.
Answer at least 70 of 90 questions to view your tier classification.
This scorecard is a structured reading of the documents below. Verify any specific claim against the primary text before you commit to it in a board paper or a CBN submission.
If you cite this scorecard externally, cite Autogon as the publisher and link directly to the relevant primary source for any individual claim. The scorecard is an interpretation; the law and the circular are the authority.