New Central Bank Rules Tighten Digital Banking Security
The Central Bank of Nigeria (CBN) is implementing significant reforms to the Bank Verification Number (BVN) system, effective May 1, 2026. These measures aim to curb rising fraud and secure digital financial channels. Customers must adapt to stricter protocols regarding device usage, identity verification, and account management. The apex bank is prioritising system integrity over the current convenience of multi-device access.
The most notable change involves device management. Banking applications will now support only one active device at a time. Switching to a new phone triggers an automatic logout from the previous one, supplemented by an additional verification step. Furthermore, any device migration imposes a temporary transaction ceiling of N20,000 for the first 24 hours. Users planning a phone upgrade should account for these operational delays.
Fraud monitoring is becoming more aggressive under the new framework. The CBN will place BVNs associated with unusual transaction patterns on a 24-hour watchlist. Banks now hold the authority to freeze or restrict these accounts during the investigation phase. Additionally, the rules limit customers to a single change of their registered phone number. This restriction directly addresses the prevalence of SIM-swap fraud in the banking sector.
Account eligibility requirements are also under review. Future BVN registrations are strictly reserved for individuals aged 18 and older. Minors must now operate bank accounts exclusively under the oversight of a designated guardian. These changes aim to create a more controlled environment for account creation. The regulator is tightening the net on identity verification.
These reforms represent a clear trade-off between user experience and systemic security. While the measures may cause friction for frequent travellers or those who cycle through mobile devices, the bank views them as necessary to combat sophisticated cyber threats. The era of seamless, unchecked access is ending. Customers should verify their contact details and prepare for these protocols before the May deadline.