CBN's 2026 BVN framework changes: what onboarding teams should note

The Central Bank of Nigeria (CBN) amended its framework for Bank Verification Number (BVN) operations in a circular dated 12 March 2026, with the new rules taking effect on 1 May 2026. According to the CBN's own summary, four changes stand out for onboarding teams: only people aged 18 and over may now enrol for a BVN, the phone number linked to a BVN may be changed only once, banks must keep a BVN linked to suspicious transactions on a temporary watchlist for up to 24 hours while they contact the customer, and access to the BVN database is restricted to licensed financial institutions.

For most onboarding flows, the practical effects are three. Under-18 customers need a verification route that does not depend on a BVN. A mismatch between the phone an applicant gives you and the phone on their BVN record becomes more meaningful, but still not conclusive. And any firm that checks BVNs should confirm how its access, direct or through a provider, fits the licensing restriction.

This article is based on the CBN's published summary of the circular. It is general information, not legal advice. Read the circular itself before changing policy.

What exactly did the CBN change?

The CBN's Reforms and Initiatives page (opens in a new tab) describes an amendment to the Revised Regulatory Framework for Bank Verification Number and Watch-List for the Nigerian Banking Industry 2021, signed by the Director of the Payments System Policy Department. The circulars index (opens in a new tab) lists it as an "Addendum to the Revised Regulatory Framework for Bank Verification Number Operations and Watchlist for the Nigerian Banking Industry", reference PSP/DIR/PUB/CIR/001/002, dated 13 March 2026 in the index. The framework it amends is listed there with a date of 12 October 2021.

The summary does not say how the rules apply to BVNs issued before 1 May 2026, for example to people who enrolled as minors or who have already changed their phone number. Those details, if the circular covers them, are in the circular.

What does the age limit mean for onboarding?

From 1 May 2026, a person under 18 cannot enrol for a BVN. For products that serve teenagers (a savings wallet, a school-fees account, a youth debit card), a flow that insists on a BVN will turn away new applicants in that age group who have none.

Plan an alternative route before it is needed:

• Use the National Identification Number (NIN) where your product rules allow it. The CBN's circulars index describes a 1 December 2023 circular on the mandatory use of BVN or NIN for Tier 1 wallets and accounts, which shows NIN already sits beside BVN as an accepted identifier in that tier.

• Decide how guardians are involved. Whether an account for a minor needs a parent or guardian's verification is a product and legal decision. Record it, and make the flow enforce it.

• Enforce age consistently. If your product is adults-only, check age from the date of birth the verification establishes, not the one the applicant types.

A worked example: a wallet provider onboarding a 16-year-old student in Enugu offers BVN and NIN. The student has a NIN but no BVN. If the flow only accepts BVN, the student cannot complete. If it offers NIN, the student verifies with NIN, and the provider applies whatever guardian and limit rules its policy sets for minors.

Why does the one-change phone rule matter?

The phone number on a BVN record is often compared with the phone an applicant uses for a one-time passcode. A mismatch has always been common, because people change phones and SIMs and do not update their BVN record.

Limiting BVN phone changes to one means the number on record should become more stable over time. It also means some customers will stop updating it after their one change. Two consequences:

• A mismatch is still not proof of fraud. A legitimate customer may simply be using a new line. Route a mismatch to a further check, such as a selfie match against the government record photo, rather than declining.

• A recent change is worth noting. If your provider or the customer's bank signals that a BVN phone number changed shortly before an account opening or a large transfer, treat it as a risk signal, as you would a recent SIM swap.

How should teams read the 24-hour temporary watchlist?

The summary places this duty on banks: a BVN linked to suspicious transactions is held on a temporary watchlist for up to 24 hours while the bank contacts the customer for clarification.

For other firms in a payment chain, the practical effect is that a customer may briefly find transactions at their bank restricted. Two things help:

• Make sure customer support knows the rule exists, so a complaint about a sudden restriction is not handled as a bug.

• Keep your own suspicious-activity process separate. A temporary watchlist at a bank is not a substitute for your own obligations, including reporting to the NFIU. The NFIU's goAML lookup list also includes report codes for BVN complete and partial name change requests, a reminder that BVN record changes also appear in FIU reporting.

What does restricted database access mean for fintechs?

The CBN summary says access to the BVN database "is restricted to licensed financial institutions". Many fintechs verify BVNs through a third party rather than directly. The summary does not explain how the restriction applies to those arrangements.

If you have not already, ask:

1. Is your organisation a licensed financial institution under the circular's definition?

2. If not, through whom do you access BVN data, and under what licence and agreement?

3. Does your provider's access rely on a licensed institution, and can they show it?

4. What is your fallback if BVN checks become unavailable to your organisation or product?

These are legal questions, and the answers differ by licence type.

Where does Myaza Trust fit?

Myaza Identity Verification checks BVN, NIN and vNIN against the government record in Nigeria, alongside document IDs such as the international passport, driver's licence and voter's card. Three features relate to the changes above:

• More than one ID route. A workflow can offer BVN and NIN side by side, or require two or three IDs in one run with a pass policy, so a customer without a BVN is not stuck.

• Age limits from the verified date of birth. Workflows can apply per-country age restrictions using the date of birth the check established, and fail closed when none is established.

• Selfie comparison against the record photo. Where the government record returns a photo, the selfie is compared with it, which gives a stronger answer than a phone-number match alone.

The supported ID types and coverage pages list what each market supports. How the amended framework applies to your own BVN access is a question for your legal and compliance teams.

A checklist for Nigerian onboarding flows

• Read the circular and note any transition rules for existing BVNs.

• Offer a non-BVN route, such as NIN, for applicants under 18 where your product allows them.

• Check age from the verified date of birth, not the typed one.

• Treat BVN phone mismatches as a reason for a further check, not an automatic decline.

• Brief support teams on the 24-hour temporary watchlist.

• Confirm, in writing, how your BVN access is licensed.