An Overview Of The New CBN Guidelines On Authorised Push Payments Fraud

Contributor: Okosa Chinwendu Marycynthia

Introduction

Nigeria’s digital payment space has witnessed significant advancements over the past decade,^[1] transitioning from manual, over-the-counter transactions to the widespread use of online applications. This evolution has been driven by the adoption of mechanisms such as electronic transfers, internet banking, and USSD, which have accelerated payment processes and enhanced access to digital financial services.^[2] While these developments have improved efficiency and enabled remote transactions, they have also been accompanied by a rise in Authorised Push Payment (APP) fraud.^[3]

APP fraud occurs when customers are deceived into voluntarily transferring funds to fraudsters impersonating legitimate entities.^[4] Historically, liability for such fraud has largely been placed on consumers who use financial services. Against this backdrop, the Central Bank of Nigeria (CBN) issued draft guidelines on APP fraud in the last quarter of 2025, imposing additional obligations on financial institutions and establishing minimum requirements for the detection, prevention, and reporting of such fraud in Nigeria.^[5] This article examines the provisions of the Guidelines, identifies their limitations, and offers recommendations to address gaps that may undermine their effective implementation.

Analysis of the Guidelines

According to the CBN, the objectives of these Guidelines include:

1. To set minimum requirements and expectations for the prevention, detection, reporting, and resolution of APP fraud across digital payment channels.^[6]
2. To safeguard the integrity of the payment system and protect the interests of all stakeholders.^[7]
3. To ensure that the benefits of digital innovation are realised without compromising public confidence.^[8]

In relation to these objectives, the Guidelines define APP fraud broadly to include coercing or deceiving a user into authorising a payment through channels such as WhatsApp, SMS, email, or any other communication platform to a third party’s account or wallet.^[9] In relation to financial institutions, it also includes acts of facilitation, negligence, or non-compliance with the Guidelines, such as failure to act on red flags, weak KYC or fraud controls, staff collusion, delayed resolution, and the use of accounts for fraudulent purposes.^[10]

• Governance

The Guidelines vest the boards of financial institutions regulated by the CBN with responsibility for governance as it relates to APP fraud.^[11] In particular, the boards are required to design internal control policies and processes for detecting, preventing, and investigating APP fraud.^[12] The boards are also responsible for designating acts that constitute APP fraud beyond the minimum description provided in the Guidelines.^[13] In addition, matters relating to reimbursement and the resolution of complaints arising from APP fraud fall within their competence and must be addressed in the internal policies developed by the boards.^[14]

• Risk Management

To manage APP fraud risks effectively, financial institutions must implement early warning systems to support timely detection and prevention. Such measures may include flagging accounts suspected of being used for APP fraud or that have received repeated complaints about receiving funds from customers, among others. ^[15]

• Complaint Resolution

Customers are required to report any APP fraud through designated channels, including customer hotlines that must operate 24 hours a day, 7 days a week.^[16] Customers affected by APP fraud are expected to report incidents within 24 hours of the incident, failing which an additional 48-hour timeline may apply.^[17] Upon receipt of such reports, the financial institutions involved must acknowledge receipt within 24 hours and issue a unique case reference number to the customer, including a summary of the investigative process.^[18] The affected financial institutions are also required to conclude investigations within 14 days of acknowledging receipt of the report.^[19] Where a decision is reached, it must state whether the customer is entitled to reimbursement. Where reimbursement is denied, the decision must provide reasons for such denial.^[20]

• Reimbursement

The Guidelines make provision for the reimbursement of funds in cases of exposure to APP fraud.^[21] However, this entitlement is not available to all customers. Customers who act fraudulently or negligently, or who fail to report APP fraud within 72 hours of occurrence, are not entitled to reimbursement.^[22] Conversely, where a customer reports within 72 hours of exposure, and it is established that a third party fraudulently induced the customer, the customer is entitled to reimbursement.^[23] In such circumstances, reimbursement must be made within 48 hours after the conclusion of the investigation.^[24] Notably, where two financial institutions are involved, reimbursement must be effected within 16 working days from the date the report was first made.^[25] Where the fraud occurs without fault on the part of either the customer or the financial institutions, liability is to be shared by the financial institutions.^[26]

• Compliance

To ensure compliance with the Guidelines, financial institutions are required to file returns on incidents of APP fraud affecting their customers, their internal policies for identifying and mitigating APP fraud, and details of reimbursements made, where applicable.^[27] The returns must also include measures undertaken to educate customers on the increasing incidence of APP fraud. The Guidelines further provide that failure to file returns, or the submission of misleading returns, attracts penalties as prescribed by the CBN.^[28]

Lapses in the Guidelines

• Concentration of Power on Governing Boards:

Although the Guidelines provide a broad, non-exhaustive definition of APP fraud, they confer significant discretion on the governing boards of financial institutions to designate acts that constitute APP fraud and to determine the processes for investigation and resolution. This creates the potential for inconsistency across institutions, such that conduct regarded as APP fraud in one institution may be considered too insignificant in another. This lack of uniformity may hinder legitimate claims for reimbursement when customers suffer financial losses, yet the institution declines to classify the incident as fraud.

• No Provision on Division of Liability:

The Guidelines provide that where more than one financial institution is involved in a customer’s financial loss, both institutions are liable for reimbursement.^[29] However, they do not prescribe any framework for apportioning such liability between the institutions. In the absence of clear criteria, such as equal allocation or causation-based allocation, disputes may arise between institutions. This uncertainty may delay or frustrate reimbursement, particularly where neither institution is solely responsible for the loss.

• Ambiguity in the Standard of Customer Negligence

The Guidelines identify negligence as an obstacle to a customer’s entitlement to reimbursement.^[30] While this principle is generally justified, the Guidelines fail to clarify the standard or scope of negligence that would preclude reimbursement, particularly where the customer did not act fraudulently. It remains unclear whether negligence includes failure to report within the 72-hour timeline, especially when the complexity of the fraud delays the customer’s awareness of the incident. In such cases, strict reliance on the reporting timeline may be unfair to the customer. Accordingly, the Guidelines ought to specify the degree or nature of negligence that would bar a claim, rather than relying on a general and undefined standard.

• Over-Concentration of Powers on Financial Institutions

Although the Guidelines seek to shift greater responsibility to financial institutions, they confer extensive powers on these institutions, including the receipt of complaints, investigation of claims, determination of entitlement to reimbursement, and execution of payments. The only recourse the Guidelines have made available to customers who are dissatisfied with the decisions of financial institutions regarding their claims for reimbursement is the Customer Protection and Financial Inclusion Department. This structure raises concerns regarding impartiality and accountability. There is a need for an independent, specialised body to oversee investigations into APP fraud and adjudicate reimbursement claims, thereby ensuring fairness and enhancing public confidence in the effectiveness of the Guidelines.

Conclusion

The Guidelines on APP fraud represent a significant development as an initial step toward regulating APP transactions and mitigating associated fraud.^[31] While the CBN is commended for this initiative, it is imperative that the identified lapses be addressed, particularly at this early stage of implementation, to ensure the Guidelines are effective in practice.

Reference:

1. Chukwunye ojieh, ‘Digital Innovation and Technological Advancements in Nigeria: Any Role of Copyright in the Wake of Artificial intelligence’ (2025) 8 (1) African Journal of Ethics Law and Education<https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=https://ajleejournal.com/index.php/ajlee/article/view/232&ved=2ahUKEwjv7cbe56STAxU-V0EAHe4DGw0QFnoECBwQAQ&usg=AOvVaw0_uwCALxAqykEJNbH9Dt7X> accessed 16 March 2026. ↑
2. Chinagorom Judith Agunam, ‘Internet Banking and Performance of Deposit Money Banks in Nigeria’ (2024) 17 (1) African Banking and Finance Review Journal < https://www.abfrjournal.com/index.php/abfr/article/view/258> accessed 15 March 2026. ↑
3. Daily Post, ‘CBN Limits Mobile Banking Apps to one Device, Introduces Instant Payment Rules’ (Abuja, 13 March 2026) <https://dailypost.ng/2026/03/13/cbn-limits-mobile-banking-apps-to-one-device-introduces-new-instant-payment-rules/> accessed 16 March 2026. ↑
4. Central Bank of Nigeria, ‘Exposure Guidelines on Authorized Push Payments (APP) Fraud 2025’ <https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=https://www.cbn.gov.ng/PaymentsSystem/&ved=2ahUKEwi_k9nC6qSTAxWrWEEAHTeUIrY4ChAWegQIOBAB&usg=AOvVaw3hAOP9dmoDTcM5FLfNger1> accessed 16 March 2026. ↑
5. Ibid. ↑
6. Paragraph 2.0, CBN Guidelines on Authorized Push Payments Fraud 2025. ↑
7. Ibid. ↑
8. Ibid. ↑
9. Paragraph 4.0, CBN Guidelines on Authorized Push Payments Fraud 2025. ↑
10. Ibid. ↑
11. Paragraph 5.0, CBN Guidelines on Authorized Push Payments Frauds 2025. ↑
12. Ibid. ↑
13. Ibid. ↑
14. Ibid. ↑
15. Paragraph 6.0, CBN Guidelines on Authorized Push Payments Frauds 2025. ↑
16. Paragraph 7.0, CBN Guidelines on Authorized Push Payments Frauds 2025. ↑
17. Ibid. ↑
18. Ibid. ↑
19. Ibid. ↑
20. Ibid. ↑
21. Paragraph 8.0, CBN Guidelines on Authorized Push Payments Frauds 2025. ↑
22. Paragraph 8.2, CBN Guidelines on Authorized Push Payments Frauds 2025. ↑
23. Ibid n21. ↑
24. Ibid n21. ↑
25. Ibid. ↑
26. Ibid. ↑
27. Paragraph 12.0, CBN Guidelines on Authorized Push Payments Frauds 2025. ↑
28. Paragraph 13.0, CBN Guidelines on Authorized Push Payments Frauds 2025. ↑
29. Paragraph 8.0, CBN Guidelines on Authorized Push Payments Fraud 2025. ↑
30. Ibid. ↑
31. Technology Times, ‘ CBN Issues Draft Rules to Speed up APP Fraud Probes’ (Lagos, 2025) <https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=https://technologytimes.ng/cbn-draft-rules-to-speed-up-app-fraud-probes/&ved=2ahUKEwiCuOSE8KSTAxWrZkEAHTJ8D4c4FBAWegQIMBAB&usg=AOvVaw3mmaptsQ4GKDhqss9ELqNW> accessed 16 March 2026. ↑