Operational Guidelines for Open Banking in Nigeria

Issued by the CBN on 7 March 2023, these Operational Guidelines give detailed effect to the 2021 Regulatory Framework for Open Banking and made Nigeria the first African country with operational open-banking rules. They govern how banks, other financial institutions and approved fintech participants share customer-permissioned financial data and initiate transactions through standardised APIs, and they set out the registration, governance, technical and consumer-protection requirements for live operation. The guidelines apply to API providers (institutions that expose data and services) and API consumers (institutions that access them), and require all participants to be registered with the CBN and listed in a central Open Banking Registry. They classify participants and data by risk tiers, Tier 0 to Tier 3, calibrating eligibility and consent requirements to the sensitivity of the data and the nature of the institution. The guidelines mandate adherence to common API specifications, security standards and a consent-management framework under which customers must give, and can withdraw, explicit consent before their data is shared. They allocate responsibilities and liability between API providers and consumers, require strong authentication, encryption, audit logging and incident reporting, and impose data-minimisation and purpose-limitation obligations that connect directly to the Nigeria Data Protection Act. Consumer-protection provisions cover transparency, dispute resolution and customer redress. Operational governance is overseen by a designated registry and the CBN, with onboarding controlled through registration and API-key issuance. The CBN enforces compliance through the registry, periodic reporting, inspection and sanctions, including suspension from the open-banking ecosystem. As the working rulebook beneath the 2021 framework, this instrument is the day-to-day reference for open-banking participants in Nigeria and carries a significant data-protection component.

1. 1Operationalises the 2021 Open Banking Framework; all participants must register in a central Open Banking Registry
2. 2Risk-tiered participant/data classification (Tiers 0 - 3) calibrating eligibility and consent
3. 3Common API specifications, security standards and a consent-management framework with explicit, withdrawable customer consent
4. 4Liability allocation between API providers and consumers; strong authentication, encryption, audit logging and incident reporting
5. 5Data-minimisation and purpose-limitation obligations linked to the Nigeria Data Protection Act
6. 6CBN/registry enforcement via reporting, inspection and suspension from the ecosystem