The CBN Baseline Standards for Automated AML Solutions: What They Actually Require — and What Financial Institutions Are Getting Wrong

On 10 March 2026, the Central Bank of Nigeria (CBN) issued Circular BSD/DIR/PUB/LAB/019/002, introducing the Baseline Standards for Automated Anti-Money Laundering (AML), Combating the Financing of Terrorism (CFT), and Countering Proliferation Financing (CPF) Solutions for Financial Institutions in Nigeria.

The circular applies to banks, mobile money operators, international money transfer operators, payment service providers and other financial institutions under CBN supervision. It sets minimum requirements for automated systems capable of supporting real-time detection, analysis and reporting of suspicious financial activity.

At first glance, this may look like a technology procurement exercise.

It is not.

The most important clarification came just three weeks later. On 31 March 2026, the CBN issued a Guidance Note after observing industry discussion that was increasingly framing compliance around software features, vendor capabilities and technology choices. The Bank made its position explicit: compliance is assessed at the level of the financial institution, not the technology vendor.

That distinction changes how institutions should approach the entire exercise.

The real question is not "Which AML software should we buy?" It is “Can our institution demonstrate an effective, governed, integrated and defensible AML/CFT/CPF control environment?”

The compliance clock is already running

The Standards were issued on 10 March 2026. The CBN established two full-compliance periods:

The original circular also required institutions to submit implementation roadmaps — including proposed solution architecture, a phased timeline, a governance framework and a resource plan, signed off by both the CEO and Chief Compliance Officer — within three months of issuance. That deadline was 10 June 2026.

So, as of September 2026, the conversation should no longer be about whether institutions have heard about the Standards. The question is whether their implementation programmes are actually progressing. For Deposit Money Banks in particular, the remaining implementation period is already materially shorter than the original 18 months.

What the CBN is actually trying to achieve

The CBN's objective is broader than replacing manual AML processes with software. The Standards are designed to strengthen the effectiveness, governance and integration of AML/CFT/CPF controls across financial institutions. The Guidance Note emphasises three central concepts: defensibility, governance, and effectiveness.

An institution therefore needs to demonstrate more than the existence of an automated system. It needs to demonstrate that the system works within an appropriate control framework — including data integration, ownership, oversight, validation, change management, investigation processes, auditability and measurable outcomes.

Where an institution also uses the same system for fraud monitoring, the CBN requires that function to be clearly segregated and separately governed, so it doesn't dilute AML/CFT detection effectiveness. This is a useful checklist in itself: an institution that has strong transaction monitoring but weak case management, or solid screening but no defensible audit trail, has not met the Standard — regardless of how sophisticated any single module is.

1. Automation does not mean "buy an AML platform"

This is probably the biggest misunderstanding surrounding the Standards. A financial institution can purchase a sophisticated AML platform and still fail to meet the CBN's expectations, because software deployment is only one component of compliance.

Consider two institutions.

Institution A purchases an advanced AML platform with automated transaction monitoring, sanctions screening, machine-learning capabilities, dashboards and case management. But its customer data is fragmented, system configuration is poorly governed, alerts are not properly investigated, changes are undocumented, and management cannot demonstrate whether the system is actually effective.

Institution B has a proportionate technology environment. Its systems are properly integrated. Customer risk information flows into monitoring. Alerts are investigated through structured workflows. Changes are controlled. Decisions are traceable. Performance is measured. Management understands the system and its limitations.

Institution B is much closer to what the CBN actually expects. The Guidance Note makes this principle clear: technically advanced solutions without governance or demonstrable effectiveness will not, by themselves, constitute compliance.

2. There is no "CBN-approved AML vendor"

This point deserves particular attention. The CBN has stated that it does not approve, certify or endorse AML solutions or technology providers for purposes of satisfying the Standards. Claims such as "CBN-approved AML software" or "CBN-certified AML vendor" should be treated with caution — vendor claims of being "fully compliant" or "aligned with CBN requirements" are not recognised as a substitute for institutional compliance.

The responsibility remains with the financial institution. This has a direct procurement implication: vendor selection should begin with the institution's risk and control requirements — not with a vendor's marketing claims.

3. AI is not mandatory

The CBN Standards are technology-neutral. The Guidance Note explicitly states that the Standards do not mandate artificial intelligence or any particular technology. Institutions may use rules-based systems, machine-learning models, or hybrid approaches — provided the solution demonstrably meets the regulatory expectations. The CBN separately notes that institutions may deploy AI, machine learning and predictive analytics to improve detection, but any such technology must be properly governed.

AI ≠ compliance. A poorly governed AI model can still create compliance problems. Likewise, a well-designed rules-based system can be effective when appropriately configured, governed, tested and aligned with the institution's risk profile. The regulatory question is not "does your AML platform use AI?" It is: "does your AML control environment effectively identify, investigate, manage and report relevant financial-crime risks?"

4. The real issue is integration

A transaction becomes much more meaningful when combined with information about the customer: their risk profile, expected activity, account relationships, previous transactions, beneficial ownership, sanctions or PEP exposure, prior alerts, and investigation history. Indeed, the CBN has been explicit that it expects automated AML solutions to assess activity in the context of the full customer profile — not monitor solely on raw transactional data.

This is why fragmented compliance architecture creates problems. If KYC sits in one system, customer risk in another, transactions in a third, sanctions in a fourth, and case investigations in a fifth — and those systems can't communicate — analysts end up manually reconstructing the customer's story every time an alert fires. That creates delay, inconsistency, and makes it harder to demonstrate a genuinely risk-based approach.

5. Transaction monitoring is only one part of AML

"AML system" and "transaction-monitoring system" are often used interchangeably. They shouldn't be. An effective automated financial-crime environment operates across a much broader chain:

Purchasing a transaction-monitoring engine alone can leave significant gaps against the other seven capability domains in Article 8.

6. "More alerts" does not mean better AML

A poorly calibrated system can produce thousands of alerts without being effective. If analysts can't distinguish meaningful risk from noise, institutions end up with overloaded investigators, slow investigations and inconsistent decisions. The Guidance Note identifies measurable outcomes — including false-positive management — as part of demonstrating effectiveness. The goal is better detection, prioritisation and investigation, not simply more alerts.

7. Governance is part of the technology

An AML system doesn't govern itself. Someone has to own it, approve configuration changes, validate models, review performance, approve new monitoring scenarios, investigate significant failures, control access, review audit logs, and be accountable when the system doesn't work as intended. The Guidance Note specifically calls out ownership and oversight, model validation, change control and structured investigation workflows as governance elements. AML technology should sit inside the institution's broader governance framework — not be treated as a standalone IT application.

8. Explainability and auditability matter

When an automated model flags a customer as high risk, the compliance officer should be able to answer: why, on what data, under what rule or model, what happened afterward, who reviewed it, and whether the decision is reproducible later. This is defensibility. The Guidance Note specifically highlights clear audit trails, explainable decisions and traceability of actions. A black box that generates unexplained alerts creates a governance problem even when its underlying technology is sophisticated.

9. Proportionality matters

The CBN isn't demanding identical architectures from every institution — a large commercial bank's risk profile isn't a smaller institution's risk profile. The Guidance Note says sophistication should be proportionate to size, complexity and risk. But proportionate does not mean optional: the CBN is clear that purely manual processes lacking consistency, auditability and timely detection will not satisfy regulatory expectations, regardless of institution size.

10. Third-party outsourcing does not transfer accountability

Using an external AML technology provider is not the same as transferring regulatory responsibility. The CBN is explicit that outsourcing or using a vendor platform does not transfer regulatory responsibility, accountability for effectiveness, or the burden of demonstrating compliance. Vendor contracts should therefore be treated as more than technology procurement documents — they need to support the institution's governance, performance, security, data, change-management and continuity requirements.

The five questions every CRO should be asking now

1. Can we demonstrate that our AML system is effective? Not that it exists, not that the vendor says it works — can we demonstrate effectiveness?
2. Can our AML environment see the complete customer picture? Are identity, risk, transactions, screening and investigation data properly connected?
3. Can we explain important automated decisions? If an examiner asks why a customer was flagged, is there a defensible answer?
4. Can we demonstrate governance? Who owns the system, validates it, approves changes, monitors performance?
5. Can we produce evidence? Do important decisions and controls leave an auditable trail?

A practical CBN readiness framework

Phase 1 — Assess. Map the current AML/CFT/CPF environment: systems, manual processes, data sources, monitoring, screening, case management, reporting, governance. Identify the gaps against Article 8's eight domains.

Phase 2 — Design. Define the target operating model: technology architecture, data flows, governance, investigation workflows, reporting.

Phase 3 — Integrate. Connect the relevant data sources — not simply to move data, but to ensure the right information reaches the right control at the right time.

Phase 4 — Configure. Set monitoring scenarios, risk parameters, screening processes, workflows and reporting to the institution's actual risk profile — not a copy of another institution's setup.

Phase 5 — Test and validate. Test scenarios, data, alerts, investigations, reporting, failure conditions and changes. Model validation should be properly governed.

Phase 6 — Measure. Track alert volumes, false-positive rates, investigation turnaround, escalation rates, scenario performance, system availability, data-quality failures, reporting timeliness and material incidents. Measurement turns "we believe the system works" into something demonstrable.

Phase 7 — Continuously improve. New products, new payment channels, changing customer behaviour and evolving criminal typologies mean AML systems have to evolve with the institution's risk environment.

What this means for Nigerian fintechs

For fintechs, the Standards shouldn't be treated as just another banking requirement. Nigeria's digital financial ecosystem generates enormous volumes of transaction data — that's both a challenge of scale and an opportunity for intelligence. A properly designed financial intelligence environment can connect transaction behaviour, customer risk, identity information and other relevant signals into a more complete view of financial activity. That matters more as digital financial services become more interconnected. The future of AML will increasingly depend on the ability to turn raw transaction data into actionable risk intelligence.

What this means for the broader African financial ecosystem

The significance of the CBN Standards goes beyond Nigeria. African financial markets are becoming more digital and interconnected: cross-border payments are expanding, fintech ecosystems are developing, digital identity infrastructure is improving, and payment channels are multiplying — alongside increasingly complex fraud, money-laundering, terrorist-financing and proliferation-financing risks. This creates a growing need for financial intelligence infrastructure, not isolated compliance tools. The long-term opportunity is building systems that let financial institutions understand not just individual transactions, but patterns, relationships, behaviours and risk across financial ecosystems.

At BenjaFamilyLabs, our focus is on advancing financial intelligence research and building risk infrastructure for Africa. The CBN's new Standards reinforce an important principle: financial institutions need better intelligence, not simply more data. Data tells an institution that a transaction occurred. Intelligence helps the institution understand what that transaction may mean in context.

As African financial systems become more digital, the ability to process transaction information in real time, connect relevant risk signals and support informed decision-making will only become more important. The future financial institution will need to be simultaneously data-driven, risk-aware, technology-enabled and regulatorily defensible.

The bottom line

The CBN's 2026 Baseline Standards should not be reduced to "banks must buy AML software." That interpretation misses the point. The CBN is asking institutions to build effective automated AML/CFT/CPF control environments that are integrated, governed, auditable, risk-based and demonstrably effective. Four things should shape implementation:

• There is no CBN-approved AML vendor.
• AI is not mandatory.
• Vendor claims do not equal regulatory compliance.
• The financial institution remains accountable.

Institutions that treat the Standards as a procurement exercise will focus on acquiring technology. Institutions that treat them as a financial intelligence and risk-management transformation will focus on building capability. That distinction could prove decisive.

Before declaring readiness, management should be able to answer yes to the following:

• Is our AML/CFT/CPF environment appropriately automated?
• Is it proportionate to our size, complexity and risk profile?
• Are relevant customer and transaction data appropriately integrated?
• Are KYC/KYB and customer-risk information available to the relevant controls?
• Are sanctions and PEP screening capabilities appropriately implemented?
• Is transaction monitoring risk-based and properly calibrated?
• Are alerts investigated through structured workflows?
• Can we manage false positives effectively?
• Are important automated decisions explainable?
• Do we maintain appropriate audit trails?
• Are model validation and change management properly governed?
• Can management demonstrate oversight?
• Can we demonstrate measurable effectiveness?
• Can we produce evidence of how the system operates?
• Do our controls evolve as our risks evolve?

If the answer to several of these is "not yet," treat that as an implementation gap to close now — not something to discover during a regulatory examination.

Final thought

The CBN's Standards are ultimately about something bigger than AML software: whether Nigeria's financial institutions can build the technological and institutional capacity to understand financial risk as it happens. For a financial system becoming increasingly digital, that capability is no longer optional. The future of financial crime compliance is not simply automated monitoring — it is intelligent, connected and defensible financial risk infrastructure. That is a conversation Africa's financial sector needs to have now.