The Central Bank of Nigeria (CBN) has issued a new draft guideline that is introducing strict requirements for how banks and other financial institutions must share customer information during investigations into Authorised Push Payment (APP) fraud.
The directive, contained in the “Draft Guidelines for Handling Authorised Push Payment Fraud,” was released to the public on November 26, 2025.
Under the proposed framework, financial institutions are required to exchange relevant customer and transaction data immediately once a fraud complaint is filed, eliminating delays that have long slowed down APP fraud investigations. The guideline mandates that institutions “shall clearly communicate the outcome of the APP fraud investigations to the customer stating if reimbursement is approved or denied.”
The cooperative process extends to the provision of account statements, transaction trails, beneficiary details and any supporting records needed to trace fund movement. The CBN stresses that such exchanges must happen swiftly and transparently, noting that a joint investigation should establish “the lapses, amount lost or unrecoverable, modalities for joint reimbursement and measures for mitigating future occurrence and losses.”
Under the proposed framework, financial institutions are required to exchange relevant customer and transaction data immediately once a fraud complaint is filed, eliminating delays that have long slowed down APP fraud investigations. The guideline mandates that institutions “shall clearly communicate the outcome of the APP fraud investigations to the customer stating if reimbursement is approved or denied.”
However, the push for faster information flow is being matched with strong privacy safeguards. The CBN emphasises that “in the course of the investigation and data sharing, all exchange of customer information shall comply with the Nigeria Data Protection Act, 2023.”
This requirement is compelling banks to upgrade their data-handling processes to ensure that any shared information is transmitted securely, logged accurately and protected from unauthorised access. Industry analysts say the mandate is expected to force many institutions, particularly those relying on manual procedures or unsecured communication channels, to redesign their internal fraud-response workflows.
The rules also place significant responsibility on the initiating institution, the bank where the victim maintains an account. According to the draft, once a customer files a complaint, the originating institution must “ensure that a formal investigation into the alleged APP fraud is initiated immediately.”
If more than one institution is involved, the originating bank must notify the receiving institution within 30 minutes of receiving the complaint; a timeline signalling the CBN’s intention to push interbank communication toward near-real-time responsiveness.
The new requirements stem from rising concerns over the growing volume of APP fraud, a scheme in which customers are deceived into authorising transfers to fraudsters. The CBN notes that increasing use of mobile banking, USSD, online transfers and instant-payment channels is making such fraud harder to detect or reverse once funds leave the victim’s account.
By mandating faster and more structured data sharing, the CBN aims to strengthen fraud detection, reduce losses and speed up reimbursement decisions. The draft guideline states that full investigations “shall be concluded within fourteen (14) working days,” after which a clear decision must be communicated to the customer.
Institutions that fail to comply or delay without reasonable justification risk sanctions. According to the document, unnecessary delays “may constitute a breach of consumer protection obligations and attract appropriate regulatory sanctions.”
If adopted, the framework will require banks, fintechs and mobile money operators to overhaul how they coordinate fraud investigations, automate interbank information-sharing channels and reinforce data-protection controls to meet regulatory expectations.
The CBN is currently accepting public comments before issuing a final version of the guideline.
Home
