Pack contents: Nigeria

In short

Two packs follow Nigeria’s rules, in naira. A workspace whose jurisdiction is Nigeria (ng) sees them first in the rule library, marked Recommended for its kind of institution:

• ng-psp 1.2.0 (9 rules): payment service providers, mobile money operators, payment service banks and agent networks.
• ng-bank 1.2.0 (8 rules): commercial, merchant and microfinance banks.

Two rules, ng.ctr_cash (NG1) and ng.unverified_bvn_payout (NG2), are in both, so there are 15 different rules. All are post-event except ng.sim_swap_payout, which runs in a real-time decision. Every rule arrives switched off.

Several rules reuse a core, Ghana or other rule by reference: they run exactly the same logic with Nigerian amounts. The pages for those base rules explain how they work.

Every value here is to be confirmed

The thresholds and caps come from SpeculaPro’s research of the Money Laundering (Prevention and Prohibition) Act 2022 and CBN circulars, not from an official confirmation. Each pack below lists the values to confirm. Confirm every one with the CBN and the NFIU, and with your MLRO, before relying on a rule.

Rule names in French

From version 1.1.0 every Nigerian rule has a French name and description, shown in a workspace using French. See Languages.

ng.unverified_bvn_payout needs to know whether each customer’s Bank Verification Number has been checked: send bvn_verified: true in the customer’s attributes once it is validated with NIBSS. Customers without the attribute are treated as unverified. See Sending customers.

All rules at a glance

Key	Library	Name	Pack	Mode · action	Alert about	Severity · score
ng.ctr_cash	NG1	Cash transaction above the NFIU CTR threshold	ng-psp	post-event · alert	customer	low · 20
ng.agent_customer_cash_out	NG3	Customer cash-out at agents above the CBN cap	ng-psp	post-event · alert	customer	medium · 45
ng.agent_daily_cash_out	NG4	Agent paying out more cash than the CBN daily cap	ng-psp	post-event · alert	agent (the counterparty)	medium · 50
ng.kyc_tier_single_limit	NG5	Transaction above the CBN KYC tier limit	ng-psp	post-event · alert	customer	medium · 45
ng.kyc_tier_daily_limit	NG6	Daily outflow above the CBN mobile money tier limit	ng-psp	post-event · alert	customer	medium · 45
ng.sim_swap_payout	NG7	Payout soon after a SIM swap	ng-psp	real-time · block	customer	critical · 85
ng.split_cash_in_agents	NG8	Cash-in split across many agents	ng-psp	post-event · alert	customer	high · 70
ng.structuring_below_ctr	NG9	Repeated cash-ins just below the CTR threshold	ng-psp	post-event · alert	customer	high · 70
ng.unverified_bvn_payout	NG2	Large payout by a customer without a verified BVN	ng-psp	post-event · alert	customer	medium · 45
ng.ctr_cash	NG1	Cash transaction above the NFIU CTR threshold	ng-bank	post-event · alert	customer	low · 20
ng.fx_transfer_report	NG10	Transfer abroad above USD 10,000	ng-bank	post-event · alert	customer	low · 25
ngb.deposit_structuring	NGB1	Cash deposits just below the CTR threshold	ng-bank	post-event · alert	customer	high · 70
ngb.weekly_cash_withdrawal	NGB2	Cash withdrawals above the CBN weekly limit	ng-bank	post-event · alert	customer	medium · 40
ngb.pep_large	NGB3	PEP transaction above NGN 5 million	ng-bank	post-event · alert	customer	high · 70
ngb.nip_new_payee_large	NGB4	Large NIP transfer to a new payee	ng-bank	post-event · alert	customer	medium · 50
ngb.dormant_reactivation	NGB5	Dormant account suddenly active	ng-bank	post-event · alert	customer	medium · 45
ng.unverified_bvn_payout	NG2	Large payout by a customer without a verified BVN	ng-bank	post-event · alert	customer	medium · 45

The ng-psp pack (9 rules)

Nigeria PSP, mobile money and agents (in French: Nigeria : PSP, mobile money et agents), version 1.2.0.

Typologies for Nigerian payment service providers, mobile money operators (MMOs), payment service banks (PSBs) and agent networks, in naira: the NFIU CTR threshold, CBN agent cash-out caps, CBN tiered KYC limits, unverified BVNs, SIM-swap payouts and smurfing through agents. Several rules reuse core and Ghana rules by reference with Nigerian parameters. Values come from SpeculaPro’s research of the MLPPA 2022 and CBN circulars, not from an official confirmation: confirm each with the CBN and NFIU before go-live.

Values to confirm with the regulator

These come from SpeculaPro’s research, not an official confirmation. Confirm each with the FIU or regulator before relying on it:

• NFIU CTR thresholds NGN 5,000,000 (individual) and NGN 10,000,000 (business), per single transaction
• Agent cash-out caps: NGN 100,000 per customer per day and NGN 500,000 per week; NGN 1,200,000 per agent per day
• Tiered KYC limits: Tier 1 NGN 50,000 per transaction, Tier 2 NGN 100,000; mobile money daily Tier 1 NGN 50,000, Tier 2 NGN 200,000 (unverified), Tier 3 NGN 5,000,000

Sources the pack cites:

• Money Laundering (Prevention and Prohibition) Act, 2022
• CBN circular on agent banking cash-out limits (17 December 2024) and the 2025 agent banking framework
• CBN three-tiered KYC framework (circular FPR/DIR/CIR/GEN/06/002)
• CBN review of mobile money limits (2021)

ng.ctr_cash

Cash transaction above the NFIU CTR threshold · library NG1 · Cash reporting threshold (CTR) · alert about the customer · severity low, score 20

In French: Opération en espèces au-dessus du seuil de déclaration NFIU.

Cash deposits, withdrawals, cash-ins and cash-outs above NGN 5,000,000 for an individual or NGN 10,000,000 for a business: a currency transaction report (CTR) to the NFIU is due within 7 days (Money Laundering (Prevention and Prohibition) Act 2022, s.11; the same amounts cap cash payments outside financial institutions under s.2). The Act says “above”, per single transaction. Confirm the thresholds and their application with the NFIU.

Parameter	Meaning	Default
threshold_individual	Individuals: above (base currency)	5,000,000
threshold_business	Businesses: above (base currency)	10,000,000
comparison	Report when the amount is: what Settings → Reporting says for CTRs (workspace), above the threshold (gt), or at or above it (gte)	workspace

comparison defaults to workspace (since version 1.2.0): the rule reads the workspace’s CTR setting (Settings → Reporting, Report when the day’s cash is) through the variable workspace.ctr_comparison. In a Nigerian workspace that setting starts at above only, where the Act says “above”, so out of the box the rule and the drafted CTRs agree: a cash transaction of exactly NGN 5,000,000 triggers neither, and changing the setting changes both. Set the parameter to gt or gte only if you want the alert to differ from the drafts. See At or above, or above only.

Explanation shown to analysts: Cash {{txn.type}} of {{txn.base_currency}} {{txn.amount}} by {{= customer.type == ‘business’ ? ‘a business’ : ‘an individual’ }} is {{= (params.comparison == ‘workspace’ ? workspace.ctr_comparison : params.comparison) == ‘gte’ ? ‘at or above’ : ‘above’ }} the NFIU CTR threshold. Confirm with current NFIU guidance.

Expression

txn.type in ['cash_in', 'cash_out', 'deposit', 'withdrawal'] && txn.channel in ['cash', 'agent', 'branch', 'atm'] && ((params.comparison == 'workspace' ? workspace.ctr_comparison : params.comparison) == 'gte' ? txn.amount >= (customer.type == 'business' ? params.threshold_business : params.threshold_individual) : txn.amount > (customer.type == 'business' ? params.threshold_business : params.threshold_individual))

ng.agent_customer_cash_out

Customer cash-out at agents above the CBN cap · library NG3 · Agent cash-out cap breach · alert about the customer · severity medium, score 45

A customer’s cash-outs at agents above NGN 100,000 in a day or NGN 500,000 in a week: above the CBN’s agent banking caps (circular of 17 December 2024). Either the agent isn’t enforcing the cap or the customer is splitting cash-outs across agents.

Parameter	Meaning	Default
daily_limit	Daily cap per customer (base currency)	100,000
weekly_limit	Weekly cap per customer (base currency)	500,000

Explanation shown to analysts: {{txn.base_currency}} {{features.agent_cash_out_24h}} cashed out at agents in 24 hours and {{txn.base_currency}} {{features.agent_cash_out_7d}} in 7 days (caps {{txn.base_currency}} {{params.daily_limit}} and {{txn.base_currency}} {{params.weekly_limit}}).

Expression

txn.type == 'cash_out' && txn.channel == 'agent' && (features.agent_cash_out_24h > params.daily_limit || features.agent_cash_out_7d > params.weekly_limit)

ng.agent_daily_cash_out

Agent paying out more cash than the CBN daily cap · library NG4 · Agent misuse / cash placement · alert about the agent (the counterparty of the cash-out) · severity medium, score 50

An agent’s total cash-outs to all customers above NGN 1,200,000 in a day, the CBN cap per agent (circular of 17 December 2024, restated in the 2025 agent banking framework). The agent is the counterparty of the cash-out.

One alert, on the agent

The alert is about the agent: the counterparty of the cash-outs. However many customers cash out at an agent that is over the cap, their cash-outs add hits to the agent’s one open alert; no alert is raised on the customers. Open the agent from the alert to review its cash-outs together.

Parameter	Meaning	Default
agent_daily_limit	Daily cash-out cap per agent (base currency)	1,200,000

Explanation shown to analysts: This agent paid out {{txn.base_currency}} {{features.agent_total_24h}} in cash in 24 hours, above the {{txn.base_currency}} {{params.agent_daily_limit}} daily cap.

Expression

txn.type == 'cash_out' && txn.channel == 'agent' && txn.has_counterparty && features.agent_total_24h > params.agent_daily_limit

ng.kyc_tier_single_limit

Transaction above the CBN KYC tier limit · library NG5 · Tier limit breach · alert about the customer · severity medium, score 45

A transaction above the single-transaction limit of the customer’s CBN KYC tier (Tier 1 NGN 50,000, Tier 2 NGN 100,000; Tier 3 has no cap). Reuses the Ghana tier-limit rule with Nigerian limits.

Reuses the logic of gh.kyc_tier_single_limit (from gh-psp) with the parameters below; only the values differ.

Parameter	Meaning	Default
limits	Single-transaction limit by KYC tier (base currency)	{"1": 50000, "2": 100000}

Explanation shown to analysts: {{txn.base_currency}} {{txn.amount}} exceeds the single-transaction limit for this customer’s KYC tier.

ng.kyc_tier_daily_limit

Daily outflow above the CBN mobile money tier limit · library NG6 · Tier limit breach · alert about the customer · severity medium, score 45

Outflows in 24 hours above the daily cumulative limit of the customer’s mobile money tier (CBN: Tier 1 NGN 50,000, Tier 2 NGN 200,000, Tier 3 NGN 5,000,000). The Tier 2 figure is commonly cited but unverified. Reuses the Ghana rule with Nigerian limits.

Reuses the logic of gh.kyc_tier_daily_limit (from gh-psp) with the parameters below; only the values differ.

Parameter	Meaning	Default
limits	24h outflow limit by KYC tier (base currency)	{"1": 50000, "2": 200000, "3": 5000000}

Explanation shown to analysts: Outflows of {{txn.base_currency}} {{features.out_24h}} in 24h exceed the daily limit for this customer’s KYC tier.

ng.sim_swap_payout

Payout soon after a SIM swap · library NG7 · SIM swap · real-time, answers block · about the customer · severity critical, score 85

SIM-swap fraud: the fraudster ports the customer’s number, receives the OTPs and empties the wallet or account (NCC and CBN have flagged it repeatedly). Reuses the Ghana rule with a naira threshold.

Reuses the logic of gh.sim_swap_payout (from gh-psp) with the parameters below; only the values differ.

Parameter	Meaning	Default
sim_change_hours	Hours since the SIM swap	48
threshold	Payout at or above (base currency)	100,000

Explanation shown to analysts: SIM swapped {{customer.hours_since.sim_swap}} hours before this payout of {{txn.base_currency}} {{txn.amount}} (rule window: {{params.sim_change_hours}} hours).

ng.split_cash_in_agents

Cash-in split across many agents · library NG8 · Smurfing through agents · alert about the customer · severity high, score 70

Cash-ins through several agents in a day adding up to a large sum: smurfing through the agent network. Reuses the Ghana rule with a naira threshold.

Reuses the logic of gh.split_cash_in_agents (from gh-psp) with the parameters below; only the values differ.

Parameter	Meaning	Default
min_agents	Distinct agents in 24h	4
min_total	Total cash-in in 24h (base currency)	1,000,000

Explanation shown to analysts: Cash-ins via {{features.agents_24h}} different agents totalling {{txn.base_currency}} {{features.cash_in_24h}} in 24h.

ng.structuring_below_ctr

Repeated cash-ins just below the CTR threshold · library NG9 · Structuring / smurfing · alert about the customer · severity high, score 70

Cash-ins just below NGN 5,000,000 repeated within 48 hours: structuring to avoid an NFIU CTR, an offence under MLPPA 2022 s.2(2). Reuses the core structuring rule.

Reuses the logic of core.structuring (from core) with the parameters below; only the values differ.

Parameter	Meaning	Default
threshold	Threshold being avoided	5,000,000
margin	Margin below threshold (0.10 = 10%)	0.1
min_count	Minimum cash-ins in 48h	3

Explanation shown to analysts: {{features.cash_in_count_48h}} cash-ins totalling {{txn.base_currency}} {{features.cash_in_sum_48h}} in 48h; this one ({{txn.base_currency}} {{txn.amount}}) is just below the {{txn.base_currency}} {{params.threshold}} NFIU CTR threshold.

ng.unverified_bvn_payout

Large payout by a customer without a verified BVN · library NG2 · Weak identification (BVN/NIN) · alert about the customer · severity medium, score 45

An individual sending at or above the amount without a verified Bank Verification Number. The CBN’s tiered KYC framework requires a BVN (or NIN) for accounts and wallets above Tier 1, and CBN circulars since 2023 require BVN/NIN on every wallet. Send customer.attributes.bvn_verified = true once the BVN is validated with NIBSS; customers without the attribute are treated as unverified.

Parameter	Meaning	Default
threshold	Payout at or above (base currency)	50,000

Explanation shown to analysts: {{txn.base_currency}} {{txn.amount}} sent by a customer without a verified BVN (threshold {{txn.base_currency}} {{params.threshold}}).

Expression

txn.direction == 'out' && txn.amount >= params.threshold && customer.type == 'individual' && !customer.is_stub && !('bvn_verified' in customer.attributes && customer.attributes.bvn_verified == true)

The ng-bank pack (8 rules)

Nigeria banks (in French: Nigeria : banques), version 1.2.0.

Typologies for Nigerian commercial, merchant and microfinance banks, in naira: the NFIU CTR threshold, foreign transfers above USD 10,000 (FTR), structuring below the CTR threshold, cash withdrawals above the CBN weekly limits, PEP activity, large NIP transfers to new payees, dormant accounts and unverified BVNs. Several rules reuse core and Ghana rules by reference. Values come from SpeculaPro’s research of the MLPPA 2022 and CBN circulars: confirm each with the CBN and NFIU before go-live.

Values to confirm with the regulator

These come from SpeculaPro’s research, not an official confirmation. Confirm each with the FIU or regulator before relying on it:

• NFIU CTR thresholds NGN 5,000,000 (individual) and NGN 10,000,000 (business), per single transaction
• Foreign transfer threshold USD 10,000 and its naira equivalent (threshold_base)
• CBN weekly cash withdrawal limits from 1 January 2026: NGN 500,000 (individual), NGN 5,000,000 (corporate)

Sources the pack cites:

• Money Laundering (Prevention and Prohibition) Act, 2022
• CBN AML/CFT/CPF Regulations, 2022
• CBN cash policy from 1 January 2026 (weekly withdrawal limits)

ng.fx_transfer_report

Transfer abroad above USD 10,000 · library NG10 · Foreign transfer reporting (FTR) · alert about the customer · severity low, score 25

A transfer to or from abroad above USD 10,000 (or its equivalent): the MLPPA 2022 s.3 requires a report to the NFIU, CBN and SEC within one day (the NFIU’s foreign transaction report, FTR). Matches USD transfers on their own amount, and others when their naira value is above threshold_base (keep it in line with the exchange rate).

Parameter	Meaning	Default
home_country	Home country (ISO code)	"NG"
fx_currency	Threshold currency	"USD"
fx_threshold	Above, in that currency	10,000
threshold_base	Or above this in the base currency (0: off)	15,000,000

Explanation shown to analysts: {{txn.currency}} {{txn.amount_original}} ({{txn.base_currency}} {{txn.amount}}) to/from {{txn.counterparty_country}}: above the {{params.fx_currency}} {{params.fx_threshold}} foreign transfer reporting threshold.

Expression

txn.counterparty_country != '' && txn.counterparty_country != params.home_country && ((txn.currency == params.fx_currency && txn.amount_original > params.fx_threshold) || (params.threshold_base > 0.0 && txn.amount > params.threshold_base))

ngb.deposit_structuring

Cash deposits just below the CTR threshold · library NGB1 · Structuring / smurfing · alert about the customer · severity high, score 70

Cash deposits at the counter just below the CTR threshold, repeated within 48 hours and together above it: structuring to avoid a currency transaction report (MLPPA 2022 s.2(2) makes it an offence in Nigeria).

Parameter	Meaning	Default
threshold	Threshold being avoided (base currency)	5,000,000
margin	Just below = within (0.1 = 10%)	0.1
min_count	Deposits in 48 hours, at least	3

Explanation shown to analysts: {{features.deposits_48h}} cash deposits totalling {{txn.base_currency}} {{features.deposit_sum_48h}} in 48 hours; this one ({{txn.base_currency}} {{txn.amount}}) is just below the {{txn.base_currency}} {{params.threshold}} threshold.

Expression

txn.type == 'deposit' && txn.channel in ['cash', 'branch', 'agent'] && txn.amount >= params.threshold * (1.0 - params.margin) && txn.amount < params.threshold && features.deposits_48h >= double(params.min_count) && features.deposit_sum_48h >= params.threshold

ngb.weekly_cash_withdrawal

Cash withdrawals above the CBN weekly limit · library NGB2 · Unusual cash demand · alert about the customer · severity medium, score 40

Cash withdrawals over seven days above the CBN’s weekly limit across channels (from 1 January 2026: NGN 500,000 for individuals, NGN 5,000,000 for corporates; above it, a processing fee applies). Unusual cash demand in an economy pushed to electronic payments is a placement and cash-courier indicator.

Parameter	Meaning	Default
weekly_individual	Individuals: weekly limit (base currency)	500,000
weekly_business	Businesses: weekly limit (base currency)	5,000,000

Explanation shown to analysts: {{txn.base_currency}} {{features.withdrawn_7d}} withdrawn in cash in 7 days, above the {{txn.base_currency}} {{= customer.type == ‘business’ ? params.weekly_business : params.weekly_individual }} weekly limit.

Expression

txn.type == 'withdrawal' && txn.channel in ['cash', 'branch', 'atm', 'agent'] && features.withdrawn_7d > (customer.type == 'business' ? params.weekly_business : params.weekly_individual)

ngb.pep_large

PEP transaction above NGN 5 million · library NGB3 · Politically exposed person · alert about the customer · severity high, score 70

A politically exposed person’s transaction at or above the threshold: CBN AML/CFT/CPF Regulations 2022 require enhanced due diligence and senior management approval for PEPs. Reuses the core PEP rule with a naira threshold.

Reuses the logic of core.pep_threshold (from core) with the parameters below; only the values differ.

Parameter	Meaning	Default
threshold	Threshold (base currency)	5,000,000

Explanation shown to analysts: Customer is a PEP; transaction of {{txn.base_currency}} {{txn.amount}} is at or above {{txn.base_currency}} {{params.threshold}}.

ngb.nip_new_payee_large

Large NIP transfer to a new payee · library NGB4 · Authorised push-payment fraud · alert about the customer · severity medium, score 50

A large NIBSS Instant Payment (NIP) transfer to a payee the customer has never paid: authorised push payment fraud and account takeover. Reuses the Ghana GIP rule with a naira threshold.

Reuses the logic of ghb.gip_new_payee_large (from gh-bank) with the parameters below; only the values differ.

Parameter	Meaning	Default
threshold	Amount at or above (base currency)	5,000,000

Explanation shown to analysts: First instant transfer to this beneficiary: {{txn.base_currency}} {{txn.amount}}.

ngb.dormant_reactivation

Dormant account suddenly active · library NGB5 · Dormant account reactivation · alert about the customer · severity medium, score 45

A dormant account (CBN: no customer-initiated activity for a long period; unclaimed balances go to the CBN) suddenly moving money: takeover or reuse as a mule. Reuses the core rule with a naira threshold.

Reuses the logic of core.dormant_reactivation (from core) with the parameters below; only the values differ.

Parameter	Meaning	Default
dormant_days	Minimum account age (days); the quiet period is fixed at 90 days	90
min_amount	Minimum amount (base currency)	1,000,000

Explanation shown to analysts: No activity in the 90 days before today on an account {{account.age_days}} days old, then {{txn.base_currency}} {{txn.amount}}.

Also in this pack, described above:

Key	Library	Name
ng.ctr_cash	NG1	Cash transaction above the NFIU CTR threshold
ng.unverified_bvn_payout	NG2	Large payout by a customer without a verified BVN

Related

• Pack contents
• Jurisdictions
• Pack contents: FATF baseline
• Installing a pack