CBN Tightens BVN Rules to Curb Fraud and Strengthen Financial Security

The Central Bank of Nigeria (CBN) has rolled out significant amendments to the BVN Rules framework, signaling a renewed push to safeguard Nigeria’s banking ecosystem against rising fraud. Issued in mid-March 2026 as an addendum to the Revised Regulatory Framework for Bank Verification Number (BVN) Operations and Watch-List for the Nigerian Banking Industry 2021, the new rules take effect on May 1, 2026. These changes target vulnerabilities in identity verification, particularly in an era of instant payments and digital banking where mobile numbers serve as primary authentication tools.

The BVN, introduced in 2014 as a unique identifier for customers across the banking industry, remains central to Know Your Customer (KYC) compliance and fraud prevention. By linking biometric data to personal details, it has helped reduce multiple account fraud and improved the integrity of the payments system. However, evolving threats—such as SIM swapping, identity theft, and sophisticated digital scams—have prompted the CBN to tighten controls. The latest circular, directed at banks, other financial institutions, and payment service providers, introduces stricter enrolment criteria, limits on data modifications, enhanced monitoring mechanisms, and restricted database access. These measures are designed to promote a more stable, secure, and efficient financial system while minimising risks to customers and the broader economy.

One of the most notable changes is the introduction of a strict age restriction on BVN enrolment. Effective May 1, 2026, enrolment for BVN is limited exclusively to individuals who have attained the age of 18 years and above. This policy aligns BVN issuance with adult financial responsibility and reduces the risk of proxy or underage accounts being used for illicit activities. Parents or guardians of minors will need to explore alternative arrangements, such as joint accounts linked to an adult’s BVN, for younger family members.

Another critical update addresses phone number linkages—the cornerstone of many two-factor authentication processes in Nigerian banking. Under the new rules, customers will be permitted to amend the phone number associated with their BVN record only once in their lifetime. Previously, multiple changes were possible, creating opportunities for fraudsters to hijack accounts through SIM swaps or number porting scams. This one-time limit aims to lock in a stable contact point for each BVN, making it far harder for unauthorised parties to reset access or intercept verification codes. Existing customers whose details are already linked should review their records immediately to ensure accuracy before the policy takes full effect.

To combat suspected fraud in real time, the CBN has mandated financial institutions to establish and maintain a temporary watchlist for BVNs implicated in suspicious transactions. Any flagged BVN may remain on this watchlist for a maximum of 24 hours. During this period, the account owner must be contacted to provide clarification on the transaction(s) in question. This temporary measure strikes a balance between swift fraud detection and customer protection, preventing premature account freezes while allowing banks to investigate potential threats. Institutions are required to report and monitor such cases diligently, with the CBN reserving oversight to ensure compliance.

Additionally, access to the BVN database has been restricted exclusively to CBN-licensed financial institutions. In extenuating circumstances, the apex bank may approve limited access in line with extant laws, but unauthorised third parties or non-licensed entities will no longer be able to query the system. This provision further shields sensitive biometric and personal data from misuse.

The implications of these changes are far-reaching. For ordinary Nigerians, the rules could initially cause minor inconveniences—particularly for those under 18 or planning a phone number switch—but they ultimately enhance account security. Customers are advised to verify their BVN details, update contact information where necessary before the deadline, and respond promptly to any bank outreach regarding flagged transactions. Banks, on their part, face increased compliance burdens, including system upgrades for watchlist management and staff training on the new protocols. Non-compliance could attract regulatory sanctions.

Economically, the tightened BVN framework supports the CBN’s broader goal of building confidence in digital financial services. Fraud losses in the payments sector have strained the system and eroded public trust; these measures are expected to reduce such incidents, lower operational risks for lenders, and encourage greater adoption of formal banking channels. In a country where instant payments via platforms like NIBSS Instant Payments (NIP) now dominate daily transactions, robust identity controls are no longer optional—they are essential for sustained growth.

As May 1 approaches, stakeholders across the financial value chain must prepare. Banks should communicate proactively with customers through SMS, emails, and app notifications. The public, meanwhile, is encouraged to visit their banks or use official BVN validation portals to confirm details and understand the updates. The CBN has emphasised that these changes are not punitive but protective, forming part of a comprehensive strategy to foster a resilient financial system amid Nigeria’s digital transformation.

The New BVN Rules effective May 1, 2026

1. Minimum Age Requirement for BVN Enrolment BVN registration is now strictly restricted to individuals who have attained the age of 18 years and above. Minors can no longer obtain an independent BVN; parents/guardians must use joint accounts linked to an adult’s BVN.
2. One-Time Phone Number Amendment Limit Customers are permitted to change or amend the phone number linked to their BVN record only once in their lifetime. This significantly reduces risks associated with SIM swapping and unauthorised account takeovers.
3. Establishment of Temporary Watch-List by Financial Institutions Banks and other financial institutions must create and maintain their own temporary watch-list for BVNs suspected of involvement in fraudulent or suspicious transactions (in addition to the existing NIBSS watch-list).
4. 24-Hour Maximum Duration on Temporary Watch-List A flagged BVN may remain on the temporary watch-list for a maximum of 24 hours. During this period, the account holder must be contacted for clarification on the suspicious activity.
5. Mandatory Customer Notification and Clarification Institutions are required to promptly contact the BVN owner during the watch-list period to seek explanation or verification of the flagged transaction(s), balancing fraud prevention with customer rights.
6. Restricted Access to the BVN Database Access to the BVN database is now limited exclusively to CBN-licensed financial institutions. In exceptional cases, the CBN may grant limited access to other parties in line with existing laws; unauthorised entities are barred.
7. Mandatory Liveness Verification for New Account Openings and Reactivations All new account openings, reactivations, or significant BVN-linked activities must include real-time liveness checks, validated against the BVN or NIN databases to prevent spoofing or fake identities.
8. Single-Device Binding for Mobile Banking Apps Mobile banking and app-based access linked to a BVN must be restricted to one primary device per user, reducing risks from device cloning or unauthorised multi-device logins.
9. Transaction Limits on Newly Activated or Reactivated Accounts Newly enrolled or reactivated BVN-linked accounts will be subject to initial transaction caps (value and volume limits) until full verification and monitoring periods are completed.
10. Enhanced Compliance and Reporting Obligations Banks, payment service providers, and other institutions must upgrade their systems, train staff, and report watch-list activities and compliance status to the CBN. Non-compliance attracts regulatory sanctions.

In conclusion, the latest BVN regulations underscore the CBN’s commitment to innovation paired with prudence. By addressing specific loopholes in enrolment, data updates, and fraud monitoring, the apex bank is reinforcing the foundations of trust upon which Nigeria’s banking sector rests. While adaptation may require short-term adjustments, the long-term benefits—safer accounts, fewer scams, and a more secure payments ecosystem—will serve both individuals and the national economy. Nigerians are urged to stay informed and engage promptly with their financial institutions to ensure seamless compliance.