Which Nigerian rules apply to AI agents in financial services?

Four sources, none AI-specific: the Central Bank of Nigeria, SEC Nigeria and NAICOM for their sectors, and the Nigeria Data Protection Act 2023, enforced by the Nigeria Data Protection Commission. Together they govern any agent a bank, payment firm, investment firm or insurer runs: how it is governed, how it treats customers and what it does with their data.

Who regulates what?

The CBN's approach to agents in banks is set out in CBN and AI agents in Nigerian banks.

What do the rules require, in substance?

Sector regulators expect boards and management to govern technology risk, firms to stay accountable for outsourced services such as an agent platform or model provider, and customers to be treated fairly with complaints resolved properly. Records must be available to the supervisor.

The Nigeria Data Protection Act 2023, in substance, requires a lawful basis for processing, adherence to principles such as purpose limitation, minimisation, accuracy and security, and respect for people's rights, including access, correction, erasure and objection. It gives people a right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects, subject to exceptions with safeguards. Data protection impact assessments are required for high-risk processing. Transfers abroad must meet the Act's conditions, and breaches must be notified. Controllers and processors of major importance have registration duties with the Commission.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

Where does the line fall, and why?

Two features of Nigerian financial services shape the line. Instant interbank transfers settle quickly and are hard to recover, so any agent able to move money must be tightly bound. And digital lending decisions reach large numbers of customers quickly, so solely automated decisions that refuse or cut credit fall directly under the Act's automated decision right.

• Agent may: answer customer queries in English and local languages from approved content, gather KYC documents and check them against verification sources, monitor transactions, reconcile payments, draft complaint responses.
• Agent may, within limits: reverse small charges, process confirmed transfers to verified beneficiaries below the customer's limit, approve small credit within tested policy with a route to review.
• Stays with a person: transfers to new beneficiaries or above limits, credit refusals the customer contests, freezing or closing accounts, decisions on suspected fraud, and suspicious transaction reports.

An illustrative example

Take a Nigerian microfinance bank that uses an agent to handle customer chats on its mobile app. The agent answers balance and fee questions, logs complaints and helps customers repay small loans. A customer writes that a transfer failed but the money left their account.

The agent checks the transaction record, confirms the debit and the failed credit, and opens a reversal case. It does not reverse the funds itself; a reconciliation officer confirms the status with the counterparty bank and approves the reversal. The agent keeps the customer informed and records the case for the bank's complaints reporting. Separately, the bank's data protection review finds the agent stores chat transcripts indefinitely, and sets a retention period in line with its record-keeping obligations.

Which controls meet Nigerian rules?

• Board-approved governance of agents with named owners.
• Outsourcing assessments for platforms and model providers, including data location.
• Holds on new beneficiaries, transfers above limits and adverse credit decisions.
• Reasons and review for automated decisions with significant effects.
• Impact assessments for agents that profile or decide.
• Complaint tracking that includes agent-handled cases.

Resilience rules elsewhere go further than Nigeria's sector rules on ICT risk; see whether DORA applies to AI agents in financial services. For other markets, compare which UAE rules apply to AI agents in financial services. The full map is in AI agent regulation, mapped to controls.