Notifications
Clear all
Topic starter
04/07/2026 10:16 pm
TL;DR: Nigeria’s AML/CFT regime now combines the Money Laundering (Prevention and Prohibition) Act 2022, the CBN Customer Due Diligence Regulations 2023, and the SCUML Regulations 2024, creating a more complex obligation set for firms that operate across multiple regulated categories, according to Sumsub. The practical issue is not just rule volume but how compliance teams translate sector-specific KYC, EDD, screening, monitoring, and reporting duties into a single operating model.
NHIMG editorial — based on content published by Sumsub: Nigeria AML/CFT compliance checklist and obligation mapping
Questions worth separating out
Q: How should compliance teams map AML obligations across multiple Nigerian regulated sectors?
A: They should build a control matrix that ties each customer type, business line, and risk event to the exact Nigerian rule set that applies.
Q: Why do sanctions screening and enhanced due diligence need different workflows?
A: Because they answer different questions.
Q: What breaks when beneficial ownership checks are weak in KYB processes?
A: The organisation loses sight of who actually controls the entity, which undermines risk rating, sanctions exposure assessment, and accountability for onboarding decisions.
Practitioner guidance
- Build sector-specific AML control maps Map each onboarding, screening, monitoring, and reporting requirement to the specific Nigerian regime that governs the activity, then document where controls diverge across financial institutions, SEC registrants, and DNFBPs.
- Separate screening from enhanced due diligence Define distinct escalation triggers for sanctions and PEP screening versus source-of-funds, ownership, and higher-risk review, so analysts do not treat a passed screen as a cleared risk case.
- Align monitoring workflows to filing deadlines Connect alert triage, case ownership, and regulatory filing steps so short reporting windows and threshold-based obligations cannot be missed because of queue delays or unclear handoffs.
What's in the full article
Sumsub's full article covers the operational detail this post intentionally leaves for the source:
- A sector-by-sector checklist for financial institutions, SEC registrants, and SCUML-regulated businesses
- The specific KYC, KYB, EDD, screening, and monitoring obligations mapped to each Nigerian framework
- A product coverage table showing how Sumsub’s capabilities align to each regulatory requirement
- Practical implementation detail for teams that need to translate policy into onboarding and review workflows
👉 Read Sumsub’s AML/CFT checklist for Nigeria’s regulated sectors →
Nigeria AML/CFT reforms: what compliance teams need to map now?
Explore further
04/07/2026 10:19 pm
Multi-regime AML compliance is now an identity governance problem, not just a legal one. The article shows that Nigeria’s obligations span verification, ownership, screening, monitoring, and reporting across several regulated categories. That makes the control issue one of policy orchestration across customer identity, entity identity, and risk handling. Practitioners should treat AML/CFT mapping as governed identity lifecycle design, not as a static checklist.
A few things that frame the scale:
- 68% of organisations do not know how to fully address NHI risks, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which is why unmanaged identity scope creates hidden control gaps.
A question worth separating out:
Q: Who is accountable when transaction monitoring alerts are not filed on time?
A: Accountability should sit with the control owner responsible for both alert triage and regulatory filing, not just the analyst who first sees the alert. If the programme does not assign ownership by sector and deadline, missed filings become structural failures. The issue is governance design, not simply analyst performance.
👉 Read our full editorial: Nigeria AML/CFT compliance shifts raise the bar for regulated firms
