Money Laundering Act 2022 in Nigeria: Prevention and Prohibition

The Money Laundering (Prevention and Prohibition) Act 2022 places seven duties on financial institutions: identify customers and beneficial owners (section 4), keep records for five years (section 8), report suspicious transactions within 24 hours (section 7), report large transactions within seven days (section 11), run an internal anti-money laundering (AML) programme (section 10), refuse anonymous accounts and shell banks (section 12), and assess risk before launching new products (section 13).

Signed into law on 17 May 2022, the Act repealed the Money Laundering (Prohibition) Act 2011 and remains the foundation every Nigerian AML obligation sits on. The AML regulations in Nigeria that followed, including the CBN Baseline Standards, build on it: those rules tell institutions what their systems must do, while this Act sets what they are legally required to achieve.

What Is the Money Laundering (Prevention and Prohibition) Act 2022?

The Money Laundering (Prevention and Prohibition) Act 2022 is Nigeria's principal anti-money laundering law, enacted to strengthen the legal framework for preventing, detecting and punishing money laundering. It repealed the Money Laundering (Prohibition) Act 2011 under section 29, and was passed as part of Nigeria's response to Financial Action Task Force (FATF) recommendations.

Three structural changes came with it. Section 17 established SCUML as a department of the EFCC, supervising designated non-financial businesses and professions. Section 18 widened the list of predicate offences that can underpin a money laundering charge. And section 30 widened the definition of a financial institution to include virtual asset service providers, bureaux de change and pension fund managers.

Any internal policy, onboarding script or vendor document still referring to the 2011 Act is out of date. The full text of the Act is publicly available, and section references throughout this guide follow it.

Who Does the Money Laundering Act 2022 Apply To?

The Act applies to two groups: financial institutions and designated non-financial businesses and professions (DNFBPs). The first group reports to the NFIU and is supervised by the CBN, the Securities and Exchange Commission or the National Insurance Commission. The second reports to and is supervised by SCUML.

Two inclusions catch institutions out. Virtual asset service providers are financial institutions under this Act, so a crypto business operating in Nigeria carries the same duties as a bank. Pension fund managers are also named, even though their prudential supervisor is not the CBN.

What Customer Due Diligence Does Section 4 Require?

Section 4 requires five things: identify the customer using prescribed documents, verify that identity against reliable independent sources, identify the beneficial owner, verify anyone acting on the customer's behalf, and conduct ongoing due diligence throughout the relationship. These duties apply to both financial institutions and DNFBPs.

1. Identification and Verification: Documents Plus an Independent Source

Collecting a document is not verification. The Act asks institutions to verify identity using reliable, independent source documents, data or information, which in practice means checking against authoritative databases such as the Bank Verification Number (BVN) and National Identification Number (NIN) records rather than accepting an uploaded ID at face value.

2. Beneficial Ownership: Know the Natural Person Behind the Entity

For corporate customers, the institution must identify the natural person who ultimately owns or controls the customer, or on whose behalf a transaction is conducted. Layered ownership structures are the standard way this duty is defeated, so corporate onboarding needs company registry data and a documented approach to tracing control.

3. Triggers: When Due Diligence Must Be Carried Out

Due diligence is required when establishing a business relationship, when carrying out occasional transactions above the prescribed threshold or linked transactions that together cross it, for wire transfers, whenever money laundering or terrorist financing is suspected regardless of any threshold, and when there is doubt about previously collected data. Casual customers are covered for transactions above US$1,000, and the threshold is disregarded entirely where there is suspicion.

4. Ongoing Diligence: Scrutinise Transactions Against What You Know

Institutions must scrutinise transactions during the relationship to confirm they are consistent with the customer's known business and risk profile, and keep customer data current, particularly for higher-risk customers. Identity data collected at onboarding and never revisited does not meet this test.

5. Risk-Based Measures: Enhanced for Higher Risk, Simplified for Lower

Enhanced measures apply where higher risks are identified, and simplified measures are permitted where risks are lower, though simplified due diligence is never allowed where money laundering or terrorist financing is suspected. Our guide to enhanced due diligence in banking covers the higher-risk path in detail.

Politically Exposed Persons: Senior Approval and Source of Wealth

Institutions must have systems to determine whether a customer or beneficial owner is a politically exposed person. For foreign PEPs, senior management approval is required before establishing or continuing the relationship, alongside reasonable measures to establish source of wealth and source of funds, and enhanced ongoing monitoring. Domestic PEPs attract the same treatment where the relationship is higher risk.

What Must Financial Institutions Report, and How Quickly?

The Act sets four reporting duties with four different deadlines: suspicious transactions immediately with a written report within 24 hours, single large transactions within seven days, international transfers above US$10,000 within one day, and cash movements across the border declared to Customs. Missing any of them carries a daily fine.

Section 7 also gives the authorities teeth after filing. The NFIU may acknowledge a report with a notice deferring the transaction for up to 72 hours, and the NFIU or EFCC may place a stop order of up to 72 hours on an account. If the origin of funds cannot be established in that window, the Federal High Court may order the funds blocked. Staff acting in good faith under these duties are protected from civil and criminal liability.

What Records Must Be Kept, and for How Long?

Section 8 requires institutions to keep transaction records for at least five years after completion, and customer due diligence records, account files, business correspondence and analysis results for at least five years after the relationship ends. Records must be detailed enough to reconstruct individual transactions and must be made available swiftly to competent authorities.

The word "swiftly" carries weight. Under section 24, a competent authority may demand and inspect books and records to confirm compliance. Archived records that take weeks to retrieve fail the test even when they exist.

What Internal AML Programme Does Section 10 Require?

Section 10 requires four elements in every institution's AML programme: compliance officers designated at management level at headquarters and at every branch and local office, regular staff training, centralised collection of information, and an internal audit unit to test that the controls work.

Failure here is priced directly. Supervisors may impose up to ₦1 million on a DNFBP, not less than ₦1 million on capital brokerage and other financial institutions, and ₦5 million on a bank, alongside suspension of licence. The full compliance programme, including how these pieces fit together, is set out in our guide to AML compliance in Nigeria.

What Does the Money Laundering Act 2022 Prohibit Outright?

The Act bans four things outright: cash payments above the thresholds outside a financial institution, structuring transactions to avoid reporting, anonymous or numbered accounts and relationships with shell banks, and tipping off a customer about a report.

Structuring is the prohibition that drives system design. Because the limit applies per transaction, detecting a customer who spreads ₦30 million across many smaller payments requires monitoring that links transactions over time and across channels, rather than testing each one on its own.

How Does the Act Apply to Fintechs and Virtual Asset Providers?

Fintechs and virtual asset service providers carry the same duties as banks, because section 30 defines a financial institution to include virtual asset service providers, finance companies, money service businesses and bureaux de change. Section 13 adds a duty that matters most to product-led businesses.

Under section 13, institutions must identify and assess the money laundering and terrorist financing risks of new products, new business practices, new delivery mechanisms and new technologies, before launch, and take measures to mitigate them. For a fintech shipping features every few weeks, that means a documented risk assessment inside the release process, not an annual policy review.

What Are the Penalties Under the Money Laundering Act 2022?

Penalties under the Act run from daily fines for reporting failures to fourteen years' imprisonment for money laundering itself. Several accrue for each day a breach continues, so a control gap left unresolved grows more expensive the longer it sits.

Liability reaches individuals. Directors and employees can be prosecuted where funds are blocked and there is evidence of conspiracy, offenders can be banned from their profession for five years or indefinitely, and a convicted company can be wound up with its assets forfeited. Banking secrecy is not a defence, and administrative penalties from supervisors take precedence over other sanctions.

How Do Financial Institutions Meet These Duties in Practice?

Financial institutions meet the Act's duties in six ways: verifying identity against authoritative sources, tracing beneficial ownership, running a 24-hour reporting workflow, automating threshold reporting, keeping records retrievable for five years, and assessing product risk before launch.

1. Verification: Check Against the Source, Not the Document

Match customer data against BVN, NIN and company registry records, with liveness checks to confirm the person is present and real. Keep the verification result, not just the document image, since that result is your evidence of meeting section 4.

2. Beneficial Ownership: Trace Control, and Record How You Traced It

For corporate customers, capture the ownership chain and the reasoning behind the conclusion. Where control is unclear, record what you did about it. An examiner reviewing a corporate file looks for the steps, not just the name.

3. Suspicious Reporting: Build the 24-Hour Path From Alert to Filing

The clock starts at the transaction, so the route from alert to investigation to filed report has to run without a queue waiting on one person. Assign ownership, set an internal deadline well inside 24 hours, and keep the reasoning behind every decision to file or not to file.

4. Threshold Reporting: Automate Section 11 Rather Than Chasing It

Transactions above ₦5 million and ₦10 million should be identified and filed automatically within the seven-day window. Manual collation is where these reports get missed, and the penalty accrues daily.

5. Records: Make Five Years Retrievable, Not Just Stored

Test retrieval. Pick a closed relationship from three years ago and see how long it takes to reconstruct the transactions and produce the due diligence file. That exercise usually reveals the gap before a regulator does.

6. New Products: Put a Risk Assessment in the Release Process

Add a documented money laundering and terrorist financing risk assessment as a gate before launching a new product, channel or technology, with sign-off recorded. Section 13 makes that a legal requirement, not a best practice.

Meeting the Money Laundering Act 2022 With Youverify

The Money Laundering Act 2022 asks financial institutions to verify who their customers really are, watch what they do afterwards, report inside tight deadlines, and produce the evidence years later. Youverify supports all four for Nigerian banks, fintechs, virtual asset businesses and other regulated institutions.

Customer Onboarding runs document, anti-deepfake liveness and government-source checks in one journey, scored to a risk tier, which covers section 4 identification, verification and risk-based treatment, including corporate customers and beneficial owners. Transaction Monitoring applies rules and models on live flows, with typologies tuned to multi-currency, mobile money and cross-border corridors, so structuring under section 2(2) and inconsistent behaviour under section 4 surface as alerts rather than hindsight.

When a flag becomes a case, Case Management holds the queues, SLAs, the entity graph, evidence and a decision trail you can hand to an examiner, which is what a 24-hour reporting deadline needs. Regulatory Reporting drafts STRs, CTRs and periodic returns from the case file, formatted per regulator and filed with the evidence attached, covering sections 7 and 11 without manual collation.

Your compliance officers, internal audit and filing decisions stay yours, as the Act requires. Youverify gives them the checks, the alerts and the record behind each one. Book a walkthrough with our compliance team to see how your obligations map to the platform, section by section.