CBN orders banks to limit mobile banking apps to one device per customer

The Central Bank of Nigeria (CBN) has directed banks and other financial institutions to restrict mobile banking applications to one device per customer at a time as part of new measures aimed at strengthening security within Nigeria’s instant payment system.

The directive was contained in a circular issued to banks, financial institutions and payment service providers outlining additional operational guidelines for Instant Payments in the country.

According to the circular signed by Musa I. Jimoh, mobile financial service applications must now be enabled on only one device at any given time, preventing customers from using the same banking app simultaneously on multiple devices.

Mandatory device binding for mobile banking apps

Under the new guideline, banks are required to introduce mandatory device binding, meaning each customer’s mobile banking application will be linked to a single device.

If a customer attempts to migrate the banking app to another device, the system must automatically trigger re-activation and authentication procedures before access can be restored.

The CBN said the requirement forms part of broader efforts to reduce fraud risks and improve digital payment security across Nigeria’s rapidly growing financial services sector.

Opt-in and opt-out options for instant payments

The circular also introduces a flexible opt-in and opt-out mechanism for instant payment services.

Customers will have the option to temporarily disable instant transfer functionality on their accounts if they wish.

However, activating or deactivating this feature must go through multi-factor authentication verification to confirm the account holder’s consent.

When the opt-out option is enabled, customers will not be able to carry out instant online transfers either within the same bank or across different financial institutions.

During that period, customers who need to transfer funds will have to visit their bank branches to complete the transactions.

Customer-controlled transaction limits introduced

The CBN has also introduced a voluntary transaction limit feature that allows customers to adjust their transfer limits within existing regulatory thresholds.

Current limits remain capped at:

• ₦25 million for individual accounts

• ₦250 million for corporate accounts

Customers may increase or reduce their limits depending on their needs, but such changes will require enhanced due diligence and risk assessment by the financial institution, alongside customer authentication.

Once multi-factor authentication and customer consent are completed, the updated limit will take effect immediately.

Stronger fraud monitoring requirements

To further improve transaction security, the regulator directed financial institutions to deploy Enterprise Fraud Monitoring systems.

These systems must actively monitor both incoming and outgoing transactions, allowing banks to detect suspicious activities and block potentially fraudulent transfers in real time.

New identity verification rules for digital banking

The new guidelines also introduce stricter identity verification procedures for digital banking services, particularly during online account opening and account reactivation.

Under the new rules, online account openings must undergo liveliness checks to confirm that a real person is carrying out the verification process. Newly opened accounts must also be validated in real time using the Bank Verification Number and National Identification Number databases.

Financial institutions are further required to adopt stronger authentication systems, including biometrics, soft tokens, hard tokens and multi-factor authentication.

Temporary transaction limits for new devices

To reduce fraud risks when mobile banking apps are activated on new devices, the CBN has introduced temporary transaction limits.

For both new and existing accounts, a newly activated mobile banking application will have a maximum transaction limit of ₦20,000 within the first 24 hours.

Banks may impose lower limits during this period based on their internal risk assessment policies.

Similarly, first-time logins to internet banking from a new device must undergo additional multi-factor authentication before access is granted.

Implementation from July 2026

The central bank said the new guidelines represent minimum security standards for instant payment services in Nigeria.

Financial institutions have been directed to begin implementing the provisions from 1 July 2026.

The policy forms part of the CBN’s broader effort to strengthen the security, resilience and integrity of Nigeria’s digital financial ecosystem as mobile banking and instant payment transactions continue to expand across the country.