The Central Bank of Nigeria (CBN) has officially issued a new directive, limiting the usage of mobile banking apps to just one smartphone device.
Under the latest guidelines contained in a circular to all banks and other financial institutions and payment service providers (PSP), financial institutions offering instant payment services are now mandated to enforce “device binding.”
This means that customers can no longer operate a single banking application on multiple devices simultaneously; instead, the CBN has decided that mobile banking apps must be tied to one specific smartphone device.
This also means that moving an account to a new device will now trigger automatic deactivation on the old one and require a fresh round of Multi-Factor Authentication (MFA).
For the first 24 hours after a CBN mobile banking app restrictions protocol is triggered by a new activation, transaction limits are capped.
According to the CBN, both inflows and outflows are restricted to a maximum of ₦20,000 during this window to allow for potential fraud detection.
The circular signed by the CBN’s Director of Payments System Policy Department, Musa Jimoh, read: “The Central CBN in line with its mandate of promoting financial system stability hereby issues additional guidance for the operations of Instant Payments in Nigeria:
“All Financial Institutions (FIs) offering Instant Payment (IP) shall provide the following additional functionalities: Mandatory device binding: Mobile financial services applications (apps) shall only be enabled on one device at a time, and customers cannot operate the apps concurrently on multiple devices.
“Migration to another device shall trigger automatic re-activation and authentication.
“Customers shall have the option to opt out of the opt-in to IP service at any time and for any given period. This process shall be subject to Multi-Factor Authentication (MFA) control. The default setting shall be Opt-in upon onboarding a new customer.
“In the opt-out mode, a customer shall not be able to carry out online instant transfer of funds (intra or inter) from his/her account to another customer.
“However, customers can physically visit the financial institution to effect a transfer during this period.
“Voluntary Transaction Limit: Subject to the existing maximum limits of N25 million for individuals and N250 million for corporates, customers shall have the option to adjust the limits as needed.
“Any such adjustment shall be subject to enhanced due diligence and appropriate risk assessment by the financial institution.
“The new transaction limit shall take effect immediately upon successful completion of multi-factor authentication (customer consent).
“Enterprise Fraud Monitoring functionality: All FIs shall implement and activate Enterprise Fraud Monitoring for both inflows and outflows to facilitate fraud detection and restriction of suspicious transactions.
“Liveliness Checks for online account opening/account reactivation: Accounts opened online shall be subjected to liveliness check; All online account opening / online reactivation, shall be validated real-time with the BVN/NIN database; and Enhanced authentication mechanisms (such as MFA, biometric authentication, soft token, hard token, liveliness check etc.) shall be adopted for online account reactivation.
“For new accounts, transaction limits (inflow and outflow) shall be imposed on a newly activated mobile financial services app in the first 24-hours of activation.
“The limit shall be as determined by the financial institution, subject to a maximum transaction limit of N20,000.00.
“For existing accounts, transaction limits (outflow) shall be imposed on a newly activated mobile financial services app in the first 24-hours of activation.
“The limit shall be as determined by the financial institution, subject to a maximum transaction limit of N20,000.00.
“For internet banking access, first-time login on a new device shall require additional MFA.
“The above are the minimum standard requirements for instant payments in Nigeria.
“Implementation of the above provisions shall take effect from July 1, 2026.”
