Inside CBN guidelines on ATM operations in Nigeria

The Central Bank of Nigeria (CBN) has issued a guideline spelling out operation of ATM by banks and all ATM deployers and acquirers in the country.

This is contained in the CBN ‘Guidelines On Operations Of Electronic Payment Channels In Nigeria’, made available by the CBN early this month.

All concerned  stakeholders are expected to comply with these guideline which according to CBN “supersede the previous Standards and Guidelines on ATM Operations in Nigeria and Guidelines on PoS Card Acceptance Services, issued by the CBN.”

GUIDELINES ON AUTOMATED TELLER MACHINE (ATM) OPERATIONS

1.1 The Standards

1.1.1 Standards on ATM Technology and Specification:

1. All ATM deployers/acquirers shall comply with Payment Card Industry Data Security Standards (PCI DSS)
2. All ATMs shall be able to dispense all denominations of Naira.
3. For deposit taking ATMs, acceptable denominations shall be displayed by the deployer.[quote font=”georgia” font_size=”22″ font_style=”italic” align=”right” arrow=”yes”]Card readers shall be identified by a symbol that: (i) Represents the card; (ii) Identifies the direction for which the card should be inserted into the reader (iii) All new ATMs shall accept card horizontally with the chip upwards and to the right g. 2% of ATMs deployed by each acquirer shall have tactile graphic symbol for the use of visually impaired customers. Locations of such ATMs are to be visibly publicized on their corporate website at the minimum. This should be complied with within five years from the release of these standards.[/quote]
4. All terminals shall be levels 1 & 2 EMV compliant at a minimum, and shall be upgraded from time to time, to comply with the latest version, within twelve months of release of the version.
5. All ATM systems shall have audit trail and logs capabilities, comprehensive enough to facilitate investigations, reconciliation and dispute resolution.
6. Card readers shall be identified by a symbol that: (i) Represents the card; (ii) Identifies the direction for which the card should be inserted into the reader (iii) All new ATMs shall accept card horizontally with the chip upwards and to the right g. 2% of ATMs deployed by each acquirer shall have tactile graphic symbol for the use of visually impaired customers. Locations of such ATMs are to be visibly publicized on their corporate website at the minimum. This should be complied with within five years from the release of these standards.

1.2 The Guidelines

ATM deployments

1. All Banks or independent ATM deployers may own ATMs; however such institutions must enter into an agreement with a card scheme or a scheme operator or their designated settlement agent for acceptance and settlement of all the transactions at the ATM.
2. All ATM transactions in Nigeria shall be processed by a Nigerian company operating in Nigeria as acquirer-processor.
3. No card or payment scheme shall compel any issuer or acquirer to send any transaction outside Nigeria for the purpose of processing, authorization or switching, if the transaction is at an ATM or at any acceptance device in Nigeria and the issuer is a Nigerian bank or any other issuer licensed by the CBN.
4. All transactions at an ATM in Nigeria shall, where the issuer is a Nigerian bank or any other issuer licensed by the CBN be settled under a domestic settlement arrangement operated by a Nigerian Company. All collaterals for such transactions shall be in Nigerian National Currency and deposited in Nigeria.
5. No card scheme shall discriminate against any ATM owner or acquirer. Every card-scheme must publish for the benefit of every ATM owner or 3 acquirer and the Central Bank of Nigeria, the requirements for acquiring ATM transactions under the card scheme.
6. No ATM owner or acquirer shall discriminate against any card scheme or issuer.
7. Stand-alone or closed ATMs are not allowed.
8. ATMs should be situated in such a manner as to permit access at reasonable times. Access to these ATMs should be controlled and secured so that customers can safely use them.
9. Lighting should be adequate for safe access and good visibility. It should provide a consistent distribution and level of illumination, particularly in the absence of natural light.
10. ATMs should be sited in such a way that direct or reflected sunlight or other bright lighting is prevented from striking the ATM display, for example, through the use of overhead sun shelter
11. Privacy shall be provided by the design and installation features of the ATM so that in normal use the cardholder does not have to conspicuously take any protective action.
12. All ATMs shall accept all cards issued in Nigeria under CBN regulations for any card-based value added service made available on the machine.

1.3 ATM Operations:

A bank or independent organization that deploys an ATM for the use of the public shall ensure that:

1. The ATM downtime (due to technical fault) is not more than seventy-two (72) hours consecutively, where this is not practicable, customers shall be duly informed by the deployer;
2. The helpdesk contacts are adequately displayed at the ATM terminals. At the minimum, a telephone line should be dedicated for fault reporting and 4 such telephone line shall be functional and manned at all times that the ATM is operational.
3. All ATM charges are fully disclosed to customers.
4. The ATMs issue receipts, where requested by a customer, for all transactions, except for balance enquiry, stating at a minimum, the amount withdrawn, the terminal identity, date and time of the transaction.
5. Receipt prints and screen display are legible. The dispensing deposit and recycling component of the machine is in proper working condition.[quote font=”georgia” font_size=”22″ font_style=”italic” align=”left” arrow=”yes”]The ATMs issue receipts, where requested by a customer, for all transactions, except for balance enquiry, stating at a minimum, the amount withdrawn, the terminal identity, date and time of the transaction. [/quote]
6. Cash retraction shall be disabled on all ATMs.
7. There is appropriate monitoring mechanism to determine failure to dispense cash.
8. There is online monitoring mechanism to determine ATM vault cash levels.
9. ATM vault replenishment is carried out as often as necessary to avoid cash-out.
10. ATMs are not stocked with unfit notes.
11. Cash is available in the ATMs at all time. The funding and operations of the ATM deployed by non-bank institutions should be the sole responsibility of the bank or institutions that entered into agreement with them for cash provisioning. In this regard, the Service Level Agreement (SLA) should specify the responsibilities of each of the parties.
12. Change of PIN is provided to customers, free of charge. 5
13. Acquirers monitor suspicious transactions and report same to CBN, based on the agreed format and timeframe.
14. Back-up power (inverter) is made available at all ATM locations, in such a way that the machine would not cease operation while in the middle of a transaction.
15. Paper disposal basket is provided at all ATM locations
16. A register of all their ATMs in Nigeria with location, identification, serial number of the machines, etc is maintained.
17. Provision is made for extending the time needed to perform a specific step by presenting a question, such as, “Do you need more time?”
18. Information sufficient to construct a usable card is not displayed on the screen or printed on a transaction record. This will guard against the possibility that such information may become accessible to another person should the cardholder leave the ATM while a transaction is displayed, or abandon a printed transaction record.
19. Precautions are taken to minimise the possibility of a card being left, by a message or voice, alerting the customer to take his card.
20. Cash out first before card is out of the ATM is adopted, to minimise the possibility of customers leaving cash uncollected at ATM.
21. ATM acquirers shall disable cash-retract and display such notice at the ATM or on the screen.
22. Acquirers shall reconcile and refund all funds in their possession, belonging to customers as a result of ATM’s non-dispense and partial dispense errors.
23. Acquirers shall also install appropriate mechanism to immediately initiate refunds without the prompting of the issuing bank or the customer.

1.4 ATM Maintenance

A bank or independent organization that deploys an ATM for the use of the public shall ensure that:

1. Notice is displayed at the ATM for planned maintenance period and disruption to service, due to maintenance for public.
2. An ATM maintenance register or log is kept properly.
3. All ATMs and cash in the machines are insured.
4. They physically inspect their ATMs, at least fortnightly.

1.5 ATM Security

1. Every ATM shall have cameras, which shall view and record all persons using the machines and every activity at the ATM, including but not limited to: card insertion, transaction selection, cash withdrawal, card taking, etc. However, such cameras should not be able to record the key strokes of customers using the ATM.

   

2. Where a surveillance camera is used, it should be kept secret to avoid illegal removal or damage or compromise.
3. Networks used for the transmission of ATM transactions must be demonstrated to have data confidentiality and integrity
4. All ATMs must be located in a manner that guarantees safety and security of users and confidentiality of their transactions.
5. ATMs should not be placed outside buildings, unless such ATM is bolted to the floor and surrounded by structures, to prevent removal.
6. Additional precaution must be taken to ensure that any network connectivity from the ATM to the bank or switch is protected, to prevent the connection of other devices to the network point.
7. Where the user of an ATM blocks his image for camera capture, the ATM shall be capable of aborting the transaction.
8. ATM key management processes must ensure that keys are changed regularly (every year) and the same keys must not be used at multiple ATMs.
9. ATMs shall be installed with Anti-Skimming devices that would ensure effective mitigation against fraud incidents.[quote font=”georgia” font_size=”22″ font_style=”italic” align=”left” arrow=”yes”]Every ATM shall have cameras, which shall view and record all persons using the machines and every activity at the ATM, including but not limited to: card insertion, transaction selection, cash withdrawal, card taking, etc. However, such cameras should not be able to record the key strokes of customers using the ATM.[/quote]

1.6 Dispute Resolution

In the event of irregularities in the account of an ATM customer, arising from the use of card on ATM, the following shall apply:

1. All cardholders’ complaints should be treated within T + 3 from the date of receipt of the complaints; Acquirer must respond to Issuer’s request within 2 days.
2. Where records are falsified by any party, appropriate sanctions shall apply.

1.7 Regulatory Monitoring

1. Any institution which operates an automated teller machine shall file an updated list of such ATMs, including the detail location of their addresses with the Director, Banking & Payments System Department of the Central Bank of Nigeria for compliance monitoring.
2. The CBN shall conduct onsite checks of ATMs with a view to ensuring compliance with cash and service availability.
3. Acquirers shall report volume and value of transactions on monthly basis to the Director, Banking & Payments System Department, CBN.

1.8 Penalties

Sanctions, in the form of monetary penalties/or suspension of the acquiring/processing service (s) or both, would be imposed on erring institutions for failure to comply with any of the provisions of this Guidelines, or any other relevant Guidelines, issued by the CBN from time to time.

The CBN Guidelines On Operations Of Electronic Payment Channels In Nigeria also contains the Guidelines on Point Of Sale (Pos) Card Acceptance Services, Guidelines on Mobile Point Of Sale (Mpos) Acceptance Services, Guidelines on Web Acceptance Services, as made available by CBN.