PayKore
All posts

Building a wallet app in Nigeria: the compliance checklist

CBN wallet tiers, BVN/NIN KYC, AML transaction monitoring, NDPR data handling — a practical checklist for Nigerian product teams adding financial features.

This is the checklist we wish existed when we started building. It covers the compliance requirements every Nigerian product team needs to understand before going live with wallet or payment features.

This is not legal advice. Talk to a Nigerian fintech lawyer before going live. But this will tell you what questions to ask.

1. CBN wallet tiers

CBN defines three tiers of wallet accounts, each with different KYC requirements and transaction limits. You must enforce these limits in your product.

| Tier | KYC Required | Daily Transaction Limit | Cumulative Balance Limit | |---|---|---|---| | Tier 1 | Name, phone number, BVN | ₦50,000 | ₦300,000 | | Tier 2 | BVN + utility bill or ID | ₦200,000 | ₦500,000 | | Tier 3 | BVN + NIN + full KYC docs | ₦1,000,000 | No limit |

What this means for you: Your product must track each user's tier and block transactions that would exceed their limits. When a user hits a tier limit, you must offer an upgrade path — prompt them to provide the required documents to move to the next tier.

If you're building on PayKore, tier tracking and limit enforcement happens at the infrastructure level. We reject transactions that exceed tier limits and return a structured error with the reason.

2. BVN and NIN verification

BVN (Bank Verification Number) is the CBN's biometric identifier for Nigerian bank customers. NIN (National Identification Number) is NIMC's identifier. As of 2021, CBN requires NIN linkage for all bank accounts.

For wallet products:

  • Tier 1: BVN required. You validate the BVN exists and matches the name the user provided.
  • Tier 2: BVN + one government-issued ID (NIN slip, driver's licence, voter's card, international passport).
  • Tier 3: BVN + NIN + additional documentation.

BVN and NIN lookups go through NIBSS (for BVN) and NIMC (for NIN). Both require you to be connected through a licensed institution or a verified identity verification provider. You cannot call these APIs directly as an unlicensed entity.

PayKore handles BVN and NIN verification through our MFB partner's NIBSS connection. You call our KYC API and get back a verified/unverified result with the matched name.

3. AML transaction monitoring

CBN AML/CFT regulations require that financial institutions — and their technology partners — monitor transactions for suspicious activity. At minimum your platform needs:

Transaction monitoring rules:

  • Flag transactions above ₦5,000,000 (single transaction) for review
  • Flag cumulative daily transactions above ₦10,000,000 from a single account
  • Flag rapid sequential transfers (e.g. more than 10 transfers in 1 hour)
  • Flag newly created accounts with large immediate inflows

Suspicious Activity Reports (SARs): If a flagged transaction is reviewed and deemed suspicious, it must be reported to the Nigerian Financial Intelligence Unit (NFIU) via your licensed MFB partner. You cannot file SARs directly — they go through the licensed institution.

Record keeping: Transaction records must be kept for a minimum of 5 years. This is non-negotiable and applies even if you terminate the account.

What you need to build: At minimum, a rule engine that flags transactions and routes them to a human review queue. PayKore provides webhook events for all transactions — you can build your monitoring layer on top of these.

4. NDPR data handling

The Nigeria Data Protection Regulation (NDPR) governs how personal data must be handled. For wallet products, this affects:

BVN and NIN storage:

  • Must be encrypted at rest (AES-256 minimum)
  • Must not be logged in plain text in application logs
  • Access must be restricted to the minimum necessary personnel
  • Must not be shared with third parties without explicit consent

Data subject rights: Users have the right to request their data, correct it, and in some cases request deletion. You must have a process to handle these requests.

Privacy policy: You must have a published privacy policy that explains what data you collect, why, how it's stored, and how users can exercise their rights. The policy must be written in plain language.

Data processor agreements: If you use third-party services that handle personal data (including PayKore), you need a data processing agreement (DPA) in place. PayKore provides a standard DPA as part of the partner onboarding process.

5. The pre-launch checklist

Before going live:

  • [ ] Company is CAC-registered in Nigeria
  • [ ] You have a signed partner agreement with a licensed MFB or payment institution
  • [ ] KYC flow implements all three wallet tiers with correct limits
  • [ ] BVN verification is connected through a licensed provider
  • [ ] AML monitoring rules are implemented and reviewed
  • [ ] Transaction records are stored for 5+ years
  • [ ] BVN/NIN data is encrypted at rest
  • [ ] Privacy policy is published and accessible in your app
  • [ ] DPA is signed with all data processors
  • [ ] You have a process for handling data subject requests
  • [ ] You have a process for escalating suspicious activity to your MFB partner

This list is not exhaustive — but it covers the questions a CBN examiner would ask your MFB partner about your platform. If your MFB partner gets examined and your integration fails this checklist, they can terminate your agreement.

Get it right before you launch.

← Back to all postsQuestions? Talk to us →