The Central Bank of Nigeria regulates AI agents in banks mainly through rules banks already follow: board-level governance, IT and cybersecurity risk management, consumer protection, AML/CFT duties and approval of outsourcing. A bank must show each still works when an agent opens accounts, answers customers, screens transactions or moves money, with the Nigeria Data Protection Act 2023 alongside.
What does the CBN expect, in plain words?
The CBN supervises deposit money banks, microfinance banks, payment service providers and other financial institutions in Nigeria. Its expectations for AI come through its existing frameworks rather than a single AI rulebook, so check for any new circulars before relying on this summary. In substance, five sets of expectations apply.
Governance. The board is responsible for the bank's risk management and for the technology it relies on. Material technology decisions should be understood and approved at the right level.
IT and cybersecurity risk. Banks must manage technology risk, protect systems and data, control access and report significant incidents to the CBN.
Consumer protection. Customers must be treated fairly, given clear information, have their data protected, and have complaints handled properly.
AML/CFT. Banks must know their customers, monitor transactions and report suspicious activity, in line with the FATF Recommendations that Nigerian law reflects.
Outsourcing. Material outsourcing, including to technology providers, needs proper due diligence, contracts and, in many cases, CBN awareness or approval.
For the full set of Nigerian rules, including SEC Nigeria and NAICOM, see which Nigerian rules apply to AI agents in financial services.
Who does it apply to?
Every institution the CBN licenses: commercial, merchant and non-interest banks, microfinance banks, payment service banks and payment service providers, among others. Smaller institutions face proportionate expectations but not exemption. A microfinance bank using an agent for loan collections is still accountable for how that agent treats borrowers.
What changes when an agent acts in a Nigerian bank?
Three features of the Nigerian market make agent design more demanding.
Identity and onboarding. Account opening relies on national identity data and tiered KYC. An agent that collects and checks documents must be bounded so it cannot move a customer to a higher KYC tier, with higher limits, on declared or external information alone. Tier upgrades should rest on verified identity data.
Transfer fraud and social engineering. Fast transfers mean an agent that can initiate or approve payments is a target. A customer's instruction that arrives by chat, together with new beneficiary details from an email or screenshot, is exactly the kind of external claim that should never authorise a payment.
Complaint volumes. Failed transfers and reversals generate large volumes of complaints. An agent can triage and draft responses, but promising a reversal or refund is a commitment that should be held for a person, and actually reversing a settled transfer is a high-risk action.
A bank that keeps agents at reading and drafting for these tasks, and lets them execute only routine work within tight limits, will find it far easier to answer CBN questions. The general pattern is covered in how banks use AI agents safely.
How does a bank meet CBN expectations for agents?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Board accountability | Board or risk committee approves the agent programme and limits on agent authority | Board minutes and approved limits |
| IT and cyber risk | Agent identities with least-privilege access; credentials protected; prompt injection tested | Access reviews and security test reports |
| Incident reporting | Agent failures assessed under the bank's incident process and reported where required | Incident records and reports to the CBN |
| Fair treatment and clear information | Customers told they are dealing with an AI agent; commitments held for a person | Disclosure records and held-action records |
| Complaint handling | Agent triages and drafts; resolution decisions stay with staff | Complaint log with agent and staff actions |
| KYC | Tier changes require verified identity data, not declared or external claims | Verdict records naming the source class used |
| Transaction monitoring and reporting | Agent prepares alerts and drafts; suspicious activity decisions stay with compliance | Alert reviews and filing decisions |
| Outsourcing | Platform and model providers assessed, contracted and notified where required | Due diligence and approval records |
| Data protection | Processing mapped and assessed under the Nigeria Data Protection Act 2023 | Records of processing and impact assessments |
What will CBN examiners ask?
- Which customer-facing processes use an agent, and what can it do on its own?
- Can an agent change a customer's KYC tier or transfer limits?
- Show us how the agent handled a customer who reported a failed transfer.
- Where are your agents' model providers located, and where does customer data go?
- Who approved this outsourcing arrangement, and was the CBN informed?
- How do you stop an agent being tricked into initiating a transfer?
What does the CBN framework not cover?
It does not prescribe how to build or test an agent. It does not regulate the agent vendor directly. Data protection oversight sits with the Nigeria Data Protection Commission, not the CBN. Capital markets activity sits with SEC Nigeria and insurance with NAICOM. Banks with international groups will meet other supervisors' views as well, such as those set out in RBI and AI agents in Indian banks and OCC expectations for AI agents in national banks. For the cross-border map, see AI agent regulation mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Does the CBN require approval to use AI agents?
There is no general approval for using AI. But material outsourcing and significant changes to customer-facing services may need CBN engagement, so assess each agent deployment against those requirements.
Can an agent onboard customers on its own?
It can collect and check information. Decisions that raise a customer's KYC tier or limits should rest on verified identity data and, where risk is higher, a person's approval.
Who handles data protection questions about agents in Nigeria?
The Nigeria Data Protection Commission, under the Nigeria Data Protection Act 2023. CBN consumer protection expectations on customer data apply as well.