Regulatory Framework for Open Banking in Nigeria

This framework, issued by the CBN on 17 February 2021, established the foundational principles for open banking in Nigeria, making the country one of the first in Africa to adopt a regulator-led open-banking regime. Open banking is the practice of sharing customer-permissioned financial data and enabling transactions across banks and third-party providers through standardised application programming interfaces (APIs). The framework sets out the governance principles, participant categories, data-access tiers and risk-management expectations that the more detailed Operational Guidelines (2023) later operationalised. It applies to banks, other financial institutions and licensed payment and fintech operators that hold or wish to access customer financial data. The framework defines categories of data and services by sensitivity and risk, for example product/service information, market-insight data, personal and business customer information, and transaction data, and tiers access and consent requirements accordingly. It is built on the principles of customer consent and control over data, security, fair access, and clear allocation of liability between data providers and data consumers. Because it governs the sharing of customer financial data, it has a substantial data-protection dimension and must be read together with the Nigeria Data Protection Act. The framework requires participants to register, to adhere to common API and security standards, to implement strong customer authentication and consent management, and to maintain audit trails. The CBN supervises through registration, standards-setting and the power to sanction. As the umbrella instrument for open banking in Nigeria, it is the parent of the 2023 Operational Guidelines, which provide the detailed registration, API and data-governance rules under which open banking actually runs.

1. 1Establishes regulator-led open banking principles: customer consent and control, security, fair access and clear liability allocation
2. 2Categorises shared data/services by sensitivity (product information, market insight, customer information, transaction data) with tiered access
3. 3Requires standardised APIs, strong customer authentication and consent management
4. 4Substantial data-protection dimension; read with the Nigeria Data Protection Act
5. 5Umbrella framework operationalised by the 2023 Operational Guidelines for Open Banking
6. 6CBN registration, standards-setting and sanctioning powers