CBN Open Banking Guidelines (nigeria) 2026: Compliance Checklist for Banks & Fintechs

Open banking guidelines Nigeria operators have been anticipating for years are now at their operational inflection point, and 2026 is the year in which banks, payment service providers and fintechs must move from reading policy to demonstrating compliance. The Central Bank of Nigeria (CBN) has set the framework that governs how customer financial data is shared, with consent, between account-holding institutions and authorised third parties through standardised application programming interfaces (APIs). For compliance officers, general counsel and heads of product, the pressing question is no longer whether open banking is coming, but how to build an operationally ready, defensible compliance programme before supervisory scrutiny intensifies.

This article translates the open banking guidelines Nigeria institutions must observe into a granular, practitioner-led checklist, an implementation roadmap and a clear allocation of roles and liabilities.

Quick summary, What the CBN open banking guidelines mean for your organisation

At its core, open banking in Nigeria is a regulated framework that allows customers to authorise licensed third parties to access their financial data and, in some cases, initiate transactions on their behalf. The Central Bank of Nigeria sits at the centre of this regime as the primary regulator, setting the standards for data sharing, consent, API design and participant eligibility. The immediate compliance trigger for most institutions is the need to establish governance, consent and API infrastructure that can withstand supervisory review.

For banks, the guidelines mean exposing customer data securely and only on verified consent. For fintechs and third-party providers, the guidelines mean demonstrating eligibility, security maturity and contractual discipline before they can consume that data. The open banking guidelines Nigeria institutions must apply therefore touch legal, compliance, ICT and product functions simultaneously, which is why a coordinated, checklist-driven approach is essential rather than optional in 2026.

Regulatory status and applicability, Are the CBN open banking guidelines mandatory?

The open banking guidelines Nigeria regulators have issued are framed as regulatory guidance published by the Central Bank of Nigeria under its statutory supervisory authority over banks and other financial institutions. While practitioners sometimes debate the distinction between a guideline, a rule and a directive, the practical reality is that CBN guidance issued to licensed and regulated entities carries supervisory force: non-compliance exposes an institution to regulatory engagement, remedial directions and potential administrative sanction. For any entity that is licensed, supervised or seeking to participate in the open banking ecosystem, treating the guidelines as mandatory is the only prudent posture.

The first action for any board or executive committee is to commission a formal legal opinion on scope and applicability, followed by a gap analysis against current operations. Early, documented engagement with the CBN, through regulator liaison, is also advisable, both to clarify interpretive questions and to evidence good faith if issues later arise. Institutions that wait for enforcement before acting will find the compliance burden compressed into an unworkable window.

Who is in scope, banks, mobile money operators, PSPs and third-party providers

The regime is designed to capture the full participant chain. In scope are commercial banks, payment service banks, mobile money operators, licensed payment service providers (PSPs) and third-party providers (TPPs) that consume or provide data and services across the open banking network. Each participant category carries a different risk profile and a different set of obligations, a data-holding bank faces different exposure from a fintech consuming that data, but all must satisfy the Central Bank of Nigeria that they meet the eligibility, security and governance thresholds for their role.

Interaction with other laws, data protection and payments law

Open banking does not operate in a legal vacuum. Because the framework involves processing personal and financial data, compliance intersects directly with Nigeria’s data protection regime, principally the Nigeria Data Protection Act 2023, which is administered by the Nigeria Data Protection Commission (NDPC), including the obligations around lawful processing, consent and data subject rights. The underlying banking and payments activities also sit within the statutory architecture enacted by the National Assembly, including the Banks and Other Financial Institutions Act 2020 and the Central Bank of Nigeria Act 2007. Practitioners must therefore read the open banking guidelines Nigeria framework alongside data protection law and payments legislation, and map each obligation to the relevant source to avoid conflicting controls.

Key compliance requirements, granular checklist for 2026 operationalisation

The following checklist converts the open banking guidelines Nigeria institutions must meet into discrete, auditable tasks. Each item identifies the artefacts an organisation should be able to produce on request and the function that typically owns delivery. Treat this as a living document: completion of each item should be evidenced, dated and version-controlled so that it can be surfaced during a supervisory review.

Governance and policy documents

Establish a documented open banking policy, a data-sharing policy and a third-party onboarding policy, each approved at board or executive-committee level. These documents should define scope, decision rights, escalation routes and review cadence. Owner: Legal/Compliance, with sign-off from the governing body. Artefacts: approved policy suite, board minutes evidencing approval, policy review schedule.

Consent frameworks and consent records

Build a consent management capability that captures explicit, informed and specific customer consent, allows straightforward revocation, and retains auditable consent records. Consent capture, scope, duration and withdrawal must align with the data protection obligations supervised by the NDPC. Owner: Product and Compliance jointly. Artefacts: consent capture screens and logs, revocation workflow, consent retention policy, data subject request procedure.

API management and documentation

Produce and maintain API specifications, a developer portal, a sandbox environment, clear versioning policy and service-level agreements (SLAs). Documentation must be current, accessible to authorised consumers and consistent with the technical standards the regime expects. Owner: ICT/Engineering with Product. Artefacts: published API specification, sandbox access protocol, versioning policy, SLA schedule, developer onboarding guide.

Security and cyber resilience

Implement strong authentication and transport security, encryption in transit and at rest, OAuth2 and OpenID Connect for authorisation, a hardened API gateway, and a defined penetration-testing cadence. Security controls should be independently validated. Owner: ICT/Information Security. Artefacts: security architecture document, penetration-test reports, encryption standards, access-control matrix.

Data minimisation and purpose limitation

Ensure that only the data necessary for the consented purpose is shared, that retention is time-bounded, and that anonymisation or pseudonymisation is applied where feasible. These controls flow directly from the data protection obligations administered by the NDPC. Owner: Data Protection/Compliance. Artefacts: data inventory, retention schedule, purpose-mapping register.

Data-sharing agreements and contracts

Execute robust third-party agreements with every participant you share data with or receive data from. These contracts should address scope of access, liability allocation, indemnities, data protection warranties, audit rights and termination. Owner: Legal. Artefacts: executed data-sharing agreements, template clause library, liability and indemnity schedule.

Customer authentication and fraud detection

Deploy multi-factor authentication (MFA), transaction monitoring and a clear dispute-handling process to detect and respond to fraud. Authentication design should account for connectivity realities in Nigeria, including the reliability of SMS one-time passwords, which depends on telecommunications infrastructure regulated by the Nigerian Communications Commission (NCC). Owner: ICT and Operations. Artefacts: authentication policy, fraud-monitoring rules, dispute workflow.

Reporting and audit trails

Maintain complete audit trails of data access and transactions, and establish the processes for supervisory reporting and incident reporting to the Central Bank of Nigeria. Logs must be tamper-evident and retained for the required period. Owner: Compliance and ICT. Artefacts: audit log architecture, supervisory reporting calendar, incident reporting procedure.

Third-party due diligence and onboarding

Before granting any third party access, complete due diligence covering anti-money-laundering and know-your-customer (AML/KYC) checks, security-posture assessment and relevant certifications. Onboarding decisions should be documented and periodically re-reviewed. Owner: Compliance and ICT. Artefacts: due-diligence questionnaire, onboarding decision records, periodic re-review schedule.

Consumer redress, complaint handling and dispute resolution

Operate a transparent complaint-handling and redress mechanism so customers can escalate problems arising from data sharing or transactions. Clear responsibility allocation between participants is essential to avoid customers being passed between institutions. Owner: Operations and Compliance. Artefacts: complaints policy, resolution SLAs, escalation matrix.

Checklist ownership matrix, who does what

Implementation roadmap, 90/180/365-day plan for banks and fintechs

A compliance programme is only as good as its sequencing. The following roadmap breaks operational readiness into three horizons, with milestones, deliverables and owners. Institutions should triage tasks by effort and risk: high-risk, low-effort items (such as appointing a steering committee and commissioning a gap analysis) belong in the first sprint, while higher-effort items (such as full production API rollout) follow once governance and security foundations are in place.

Immediate (0–90 days): foundations

The first horizon is about establishing control and visibility. Priorities include:

• Commission a legal opinion and a gap analysis against the open banking guidelines Nigeria framework. Owner: Legal/Compliance.
• Appoint an Open Banking Steering Committee and a Technical Working Group with clear mandates. Owner: ExCo.
• Draft and approve the governance, consent and third-party onboarding policy suite. Owner: Legal/Compliance.
• Build consent capture and revocation templates aligned to data protection obligations. Owner: Product.
• Secure sandbox access and begin API specification review. Owner: ICT.
• Open a regulator liaison channel with the Central Bank of Nigeria. Owner: Compliance.

Short-term (90–180 days): build and pilot

With foundations set, the focus shifts to building and testing. Deliverables include:

• Develop and publish API documentation and the developer portal. Owner: ICT/Product.
• Complete security hardening, OAuth2, OpenID Connect, API gateway and encryption, and run an initial penetration test. Owner: Information Security.
• Execute data-sharing agreements with initial third parties and run due diligence on each. Owner: Legal/Compliance.
• Onboard a small cohort of pilot customers to validate consent and authentication flows. Owner: Product/Operations.
• Stand up transaction monitoring and dispute-handling processes. Owner: Operations.

Medium-term (180–365 days): production and supervision

The final horizon moves the programme into full production and steady-state supervision. Milestones include:

• Transition APIs from sandbox to full production with versioning and SLA governance. Owner: ICT.
• Operationalise supervisory reporting and incident reporting to the Central Bank of Nigeria on the required cadence. Owner: Compliance.
• Conduct a post-deployment audit and remediate findings. Owner: Internal Audit/Compliance.
• Expand third-party onboarding under the proven due-diligence framework. Owner: Compliance.
• Embed periodic penetration testing and policy review into business-as-usual. Owner: Information Security/Compliance.

Institutions following this roadmap should, by the end of the 365-day horizon, be able to evidence not just technical readiness but a documented, governed and auditable compliance programme, precisely what supervisory engagement under the open banking guidelines Nigeria regime will test.

Roles and responsibilities, banks vs fintechs vs third parties

One of the most common sources of compliance failure in open banking is ambiguity over who is responsible for what. Banks, as account-holding institutions, bear primary responsibility for securely exposing data on verified consent and for the integrity of their APIs. Fintechs and third-party providers bear responsibility for lawful consumption, for the security of the data once received, and for demonstrating eligibility to participate. Several obligations, customer consent integrity, incident response and consumer redress, are shared, and the contractual framework must say so explicitly.

Contractual allocation of liability

Data-sharing agreements should contain clear indemnities, liability caps calibrated to the risk each party controls, data protection warranties and audit rights. Where a breach originates with a third party that received data, the contract should allocate the consequences to that party, while preserving the bank’s residual obligations to affected customers. Well-drafted liability clauses are the single most important commercial protection in the open banking relationship.

Governance bodies, Open Banking Steering Committee and Technical Working Group

Each participant should operate a governance structure proportionate to its role. An Open Banking Steering Committee owns strategy, risk appetite and regulator engagement, while a Technical Working Group owns API design, security standards and sandbox-to-production transitions. These bodies should meet on a defined cadence, keep minutes, and report to the board so that accountability is documented and traceable.

API, technical and security standards, practical guidance for engineering teams

The technical layer is where the open banking guidelines Nigeria framework becomes real for engineering teams. Recommended practice centres on widely adopted, interoperable standards: OAuth2 and OpenID Connect for authorisation and identity, TLS 1.2 or 1.3 for transport security, JSON Schema for payload validation, RESTful design conventions, API rate limiting and comprehensive monitoring. Consistency with these standards reduces integration friction and supports the interoperability and consumer-protection outcomes that are central to well-functioning open banking regimes.

A developer portal and sandbox are not optional niceties, they are the mechanism by which third parties test integrations safely before touching production data. Versioning and backwards-compatibility policies protect existing integrations when APIs evolve, and clear SLAs set expectations for availability and support. Engineering teams should also account for Nigeria’s connectivity environment, since API performance and SMS-based authentication depend on telecommunications infrastructure regulated by the Nigerian Communications Commission.

Security controls and penetration-testing cadence

Security controls must be layered: a hardened API gateway, strong authentication, encryption, anomaly detection and least-privilege access. Penetration testing should run on a defined cadence, at minimum before production launch and periodically thereafter, with findings tracked to closure. Independent validation of security posture also strengthens the evidence base for both regulator engagement and third-party onboarding.

Sandbox and certification for production-ready APIs

Before any API moves to production, it should pass through sandbox testing and a certification step that confirms it meets functional, security and documentation requirements. A short developer onboarding checklist helps standardise this gate:

• Register the application and obtain sandbox credentials.
• Confirm OAuth2/OpenID Connect integration and scope handling.
• Validate payloads against the published JSON Schema.
• Test consent capture, revocation and error handling end to end.
• Complete security and rate-limit testing.
• Obtain certification sign-off before production access is granted.

Enforcement, supervisory reporting and penalties, what to expect from the CBN

Enforcement under the open banking guidelines Nigeria regime will most likely follow the Central Bank of Nigeria’s established supervisory model: periodic reporting, examination, remedial directions and, where warranted, administrative penalties. Institutions should expect to maintain audit trails, submit supervisory reports on the required cadence and report material incidents promptly. The most effective defensive posture is proactive regulator liaison coupled with documented remedial plans, so that any gap is addressed before it becomes an enforcement matter.

Incident reporting checklist

When a reportable incident occurs, speed and completeness matter. A disciplined incident report should capture the who, when and what:

• Who: affected customers, systems and third parties involved.
• When: detection time, incident timeline and containment milestones.
• What: nature of the incident, data or transactions affected, root cause and remediation steps.
• Notification: report to the Central Bank of Nigeria within the required timeframe, and to the NDPC where personal data is implicated and a notifiable breach has occurred.

Comparison table, Bank obligations vs Fintech/TPP obligations

The table below summarises how core operational obligations differ between data-holding banks and the fintechs or third-party providers that consume data and services across the open banking network.

Practical next steps and conclusion

The open banking guidelines Nigeria regulators have put in place reward institutions that act early and methodically. The immediate priorities are clear: commission a gap analysis against the current framework, appoint an Open Banking Steering Committee, open a liaison channel with the Central Bank of Nigeria, finalise data-sharing and consent contracts, and test APIs in the sandbox before production. Institutions that treat compliance as a governed, evidenced programme, rather than a one-off project, will be best placed to meet supervisory expectations and to capture the commercial upside of the open banking ecosystem in 2026 and beyond.

This article is for general guidance only and does not constitute legal advice. Organisations should obtain tailored advice on the open banking guidelines Nigeria framework as it applies to their specific licensing, products and risk profile. For advisory support and a tailored compliance programme, contact a corporate lawyer via the Nigeria, Corporate practice area or the GLE lawyer directory, Nigeria, Corporate.

Sources

1. Central Bank of Nigeria (CBN)
2. Nigeria Data Protection Commission (NDPC)
3. Nigerian Communications Commission (NCC)
4. Securities and Exchange Commission (Nigeria)
5. National Assembly of Nigeria