Nigeria’s Central Bank is introducing a stricter fraud-protection regime that forces banks and fintechs to refund victims of Authorised Push Payment (APP) fraud within 16 working days.
The draft guideline, dated November 26, 2025, comes as fraud losses in the financial system continue to rise sharply.
Fraud losses surged 603% to ₦3.29 billion in Q1 2025, according to the Financial Institutions Training Centre, while reported cases climbed to 12,347 during the same period.
These alarming numbers pushed the CBN to tighten timelines, improve accountability, and protect customers from increasingly sophisticated fraud schemes.
New Refund Timeline and Reporting Rules
Under the new framework, customers must report fraudulent transactions within 72 hours, providing transaction dates, amounts, recipient details, and supporting documents. Banks must acknowledge reports within 24 hours and open an investigation immediately.
Investigations must be completed within 14 working days, and reimbursements issued within 48 hours after investigations conclude. Cases that remain unresolved can be escalated to the CBN’s Consumer Protection and Financial Inclusion Department.
How the 16-Day Refund Cycle Works
The 16-working-day rule applies when more than one financial institution is involved in the fraudulent transaction. The originating bank must begin an investigation and notify all other affected institutions within 30 minutes of receiving a report.
All involved institutions must then jointly conclude investigations and issue reimbursements no later than 16 working days from the date the fraud was first reported.
CBN May Freeze Transactions During Investigations
To prevent stolen funds from being moved or laundered, the CBN may direct the Nigeria Inter-Bank Settlement System (NIBSS) or any settlement entity to withhold the value of transactions identified as fraudulent.
“This may extend to second-level or other subsequent beneficiary institutions along the transaction chain,” the guideline said, signaling a more aggressive approach to tracing and blocking fraud proceeds.
What Counts as APP Fraud
APP fraud occurs when a victim is deceived into authorising a payment, often through WhatsApp, SMS, email, or impersonation.
The CBN says causes include “facilitation, negligence, or non-compliance by financial institutions,” such as weak KYC systems, poor fraud controls, delayed responses, staff collusion, or failure to act on red flags.
Who Qualifies for a Refund, and Who Doesn’t
Victims are eligible for reimbursements if they:
- Report the fraud within 72 hours
- Cooperate fully with investigators
- Show no negligence, collusion, or criminal intent
- Were misled under false pretences
- Were affected by weak or absent fraud-control systems
Refunds will not be provided if customers:
- Acted negligently
- Participated in fraud
- Report the incident after 72 hours without valid reasons
- Were involved in transactions that occurred before the guideline’s effective date
Exceptions to the 72-hour rule apply in cases of illness, force majeure, unavailable reporting channels, or incidents caused by bank staff negligence.
Stricter Liability Rules for Banks
Banks will bear the full cost of refunds if they fail to freeze flagged transactions or their systems do not detect fraud due to weak controls.
Where no financial institution or customer is at fault, all involved banks must share refund responsibilities equally.
Mandatory Controls for Banks and Fintechs
To support smooth implementation, the CBN now requires all financial institutions to:
- Operate 24/7 fraud-reporting channels
- Deploy Early Warning Systems to detect red flags
- Monitor and profile suspicious accounts
- Document and track fraud indicators
- Report APP incidents regularly to the CBN
- Conduct financial-literacy campaigns for customers
The guideline is open to industry and public comments for three weeks before final adoption.
CBN Tightens a Decade-Long Fraud War
This framework builds on more than a decade of anti-fraud efforts. The CBN launched the Nigeria Electronic Fraud Forum (NeFF) in 2011 to promote knowledge-sharing on fraud control. In 2015, it required banks to set up dedicated fraud desks.
In 2023, stricter KYC rules were introduced, compelling customers to provide BVN or NIN for account creation. By 2024, the CBN authorised NIBSS to debit the accounts of banks that received fraud proceeds.
Regulatory Sanctions for Delays and False Reporting
Banks that fail to conclude investigations within the stated timelines will face regulatory sanctions. Customers who provide false, incomplete, or misleading information will also be penalised, along with the financial institutions involved.
With fraud cases escalating, the CBN’s new APP framework aims to restore trust, speed up reimbursements, and reduce loopholes exploited by criminals, marking one of the most decisive steps yet in Nigeria’s financial-fraud crackdown.
