CBN Tiered KYC Requirements: What Banks and Fintechs Must Verify at Each Tier

The CBN tiered KYC requirements place every individual account in Nigeria into one of three tiers, where the depth of identity verification decides the transaction and balance limits that apply. Tier 1 takes the lightest verification and the tightest limits. Tier 3 takes full customer due diligence and lifts the balance ceiling entirely.

The framework has changed since it was introduced. Tier 1 once accepted self-declared details alone. Today every tier requires a verified national identifier, which makes tiered KYC a verification and monitoring obligation rather than a documentation exercise.

What Are the CBN Tiered KYC Requirements?

The CBN tiered KYC requirements set three levels of account, each with its own verification standard and its own transaction ceiling. The framework was introduced to widen financial inclusion by letting customers with limited documentation open an account, while capping what those accounts can do until verification deepens. It sits alongside the other types of KYC a Nigerian institution runs.

Regulation 16 of the CBN Customer Due Diligence Regulations 2023 requires financial institutions to comply with tiered KYC as set out in the CBN circular introducing three-tiered KYC requirements and in the AML/CFT/CPF Regulations. Tiered KYC applies to individual customers only. Corporate customers and other legal arrangements go through full customer due diligence regardless of transaction size.

The principle is risk-based access. What the institution has verified decides what the customer is allowed to do, and the limits exist to contain the risk the thinner verification leaves behind.

What Are the Tier 1, Tier 2 and Tier 3 Bank Account Limits?

Limits rise across the three tiers, with Tier 1 the most restricted and Tier 3 carrying no maximum balance. The figures below are the thresholds commonly applied across Nigerian banks and wallets.

Two qualifications matter for institutions. Limits differ between bank accounts, mobile money wallets and payment service bank products, so check the circular that governs your licence rather than assuming one set applies everywhere. And institutions may apply tighter internal limits within a tier for risk reasons, but never higher ones.

Tier 1 and Tier 2 accounts are also restricted in function, not only in value. They are savings products, international transfers are not permitted, and withdrawals are limited to the account holder.

What Must Institutions Verify at Each KYC Tier?

The CBN KYC requirements build across the tiers, with each level adding a verification step: Tier 1 requires a national identifier, Tier 2 adds the second identifier and a document check, and Tier 3 adds address verification and full due diligence. The direction of travel has been consistent, with every revision tightening the entry level.

Tier 1: A Verified Identifier, Not a Self-Declaration

Collect the customer's photograph, name, date of birth, gender, address and phone number, and link the account to a BVN or NIN. The self-declared Tier 1 account that needed no identifier no longer exists. Any onboarding flow still built on that assumption is out of date and will fail examination.

Tier 2: Both Identifiers, Verified Against Source

Tier 2 requires both BVN and NIN, verified against the NIBSS and NIMC databases rather than accepted as typed values, together with a valid identification document. This is where verification quality starts to matter, because a mismatch between what the customer declares and what the database holds must be resolved before the upgrade proceeds.

Tier 3: Full Due Diligence and a Verified Address

Tier 3 requires everything in Tier 2 plus a verified residential address and full customer due diligence, including screening and risk assessment. Since the balance ceiling disappears at this tier, the verification standard is what stands between the institution and unlimited exposure on a single relationship.

Does Tiered KYC Apply to Fintechs and Mobile Money Wallets?

Yes. Tiered KYC applies to every CBN-licensed institution that opens individual accounts or wallets, including fintechs, mobile money operators, payment service banks and microfinance banks. The tier structure follows the customer, not the product category.

Wallet providers face it most acutely. A wallet opened in two minutes on a phone still has to sit in a tier, enforce that tier's limits and support an upgrade path, which means verification has to run inside the signup flow rather than as a later compliance step.

The obligations alongside it are the same as a bank's. Our guide to the CBN AML requirements for fintechs covers what else applies to payment providers before the March 2028 deadline.

How Did BVN and NIN Rules Change Tiered KYC?

Three changes reshaped tiered KYC: a national identifier became mandatory at Tier 1, both BVN and NIN became mandatory above Tier 1 from December 2023, and BVN enrolment was restricted to adults aged 18 and above in 2026.

The first two closed the gap the original framework left open. Tier 1 was designed for customers with no documentation, and that de

sign assumption no longer holds, because the identifier is now the entry requirement rather than the reward for upgrading.

The age restriction creates a newer problem. Products aimed at under-18 customers, including student accounts and guardian-linked wallets, can no longer rely on a BVN for the account holder and need a different identity route. The wider set of changes is covered in our breakdown of the CBN BVN regulations update.

When Must a Customer Be Upgraded to a Higher Tier?

A customer must be upgraded when their activity or needs exceed what their tier allows, and the upgrade requires the verification standard of the destination tier. An account cannot simply be granted higher limits because the customer asked, or because they have banked with you for years.

Two operational points follow. Moving from Tier 1 to Tier 2 or above requires both BVN and NIN linked and verified, so an account opened against one identifier needs the second added at upgrade. And the upgrade is a verification event that should be logged like any other, with the evidence retained. What you do with that evidence after a failed or abandoned application is a separate duty, covered in our guide to how long to keep customer data in Nigeria.

Tier assignment is therefore a live attribute of the customer record, not a label set at onboarding. Customers whose behaviour has outgrown their tier are the population most worth reviewing, because they are either being blocked unnecessarily or transacting beyond what their verification supports.

What Happens If Tiered KYC Limits Are Breached?

Two problems arise when limits are breached: a supervisory finding against the institution, and a money laundering risk the framework was built to contain. Both come back to the same control, which is enforcement inside the system rather than policy on paper.

The laundering risk is structuring across tiers. A customer capped at ₦50,000 can open accounts at several institutions and move far more in aggregate, with every individual transaction sitting inside the limit. No single institution sees the pattern from its own data, which is why tier limits have to work alongside transaction monitoring rather than instead of it.

Breaches also tend to surface in examination as system failures rather than one-off errors. An account transacting above its tier means the limit was never enforced in production, and that is the finding, not the individual transaction.

How Does Tiered KYC Fit Into the CBN Baseline Standards?

Tiered KYC sits inside the identification and risk profiling capabilities the CBN Baseline Standards for Automated AML Solutions require. Banks must comply fully by 10 September 2027 and other financial institutions by 10 March 2028.

Three expectations apply directly to tiering. Verification must run against authoritative databases rather than submitted documents. Risk profiles must update as customer behaviour changes, which includes tier movement. And every verification decision must leave an audit trail that can be produced on request.

Read together, tier is not just an account setting. It is a risk attribute the monitoring system should read, so that activity is judged against what the institution has actually verified. The wider framework is mapped in our guide to AML regulations in Nigeria, and the related verification duties sit in our overview of customer due diligence in Nigeria.

How Should Banks and Fintechs Operate the CBN Tiered KYC Requirements?

Five practices make tiered KYC defensible: enforce limits in the system, treat tier as a live attribute, build a clean upgrade path, review customers who have outgrown their tier, and keep the evidence behind every tier decision.

1. System Enforcement: Make the Limit a Hard Control

Limits that exist in policy but not in code are the most common source of findings. Enforce the ceiling at transaction level and alert when an attempt is blocked, since repeated attempts are themselves a risk signal.

2. Live Tier Attribute: Feed It Into Monitoring

Pass the customer's tier into the monitoring engine so alerts are judged against the verification behind the account. A Tier 1 customer moving at the ceiling daily is a different proposition from a Tier 3 customer doing the same.

3. Upgrade Path: Verify at the Destination Standard

Build the upgrade as a verification journey, not a form. Capture the second identifier, verify against source, resolve mismatches before granting higher limits, and record who approved the change.

4. Outgrown Accounts: Review the Customers Pressing the Ceiling

Run a regular report of customers consistently transacting at their tier limit. Some need upgrading and are being underserved. Others are deliberately operating under a threshold, which is a monitoring case.

5. Evidence: Log the Tier Decision and Its Basis

Record what was verified, against which source, when, and who approved the tier. Supervisors assess whether the control worked in practice, and the log is how that is shown years later.

Meeting the CBN Tiered KYC Requirements With Youverify

Meeting the CBN tiered KYC requirements means verifying identity against source at onboarding, enforcing the right limits afterwards, and proving both when an examiner asks. Youverify handles all three for Nigerian banks, fintechs, wallets and microfinance institutions.

Customer Onboarding runs document, anti-deepfake liveness and government-source checks in one journey, scored to a risk tier, which is exactly the verification each tier demands, including BVN and NIN checks against NIBSS and NIMC rather than typed values. Upgrades run through the same flow, so moving a customer from Tier 1 to Tier 3 is a verified event with a record attached.

Transaction Monitoring applies rules and models on live flows, with typologies tuned to multi-currency, mobile money and cross-border corridors, so behaviour that presses against a tier ceiling or spreads across accounts is visible rather than inferred. When something needs investigating, Case Management holds the queues, SLAs, the entity graph, evidence and a decision trail you can hand to an examiner.

Your tier policy and approval thresholds stay with your compliance team. Youverify supplies the verification behind each tier and the record that survives the audit. Book a walkthrough with our onboarding team to see tier assignment and upgrade run end to end.