Nigeria built one of the fastest instant-payment rails on the continent, then discovered the speed cut both ways. The same NIP transfers that move money in seconds also move it out of a hijacked account in seconds, and for years the customer carried most of that risk. In March 2026 the Central Bank of Nigeria moved to rebalance that equation, issuing a set of new rules on instant payments and BVNs that treat security less as a feature and more as a default setting.

The Opt-Out: Giving Customers a Brake

The headline change is quiet but structural. Customers can now opt out of instant payments. For most Nigerians, immediate settlement is the whole point of the system, and few will switch it off. But the option matters for a specific class of account holder — the high-balance saver, the dormant-account owner, the business that batches payments deliberately — for whom speed has always been a liability rather than a convenience.

Until now, the architecture assumed everyone wanted the same thing. Giving the customer a brake reframes the relationship: the bank no longer decides on the customer’s behalf that velocity outranks control. It is a small lever with a large signal behind it.

There is a wider design principle at work, and it is worth naming. The first decade of Nigerian instant payments optimised relentlessly for one variable — settlement speed — because speed was the visible differentiator and the obvious win against the friction of the old branch-and-cheque economy. What the opt-out concedes is that a mature system has more than one customer with more than one need. The retail user moving ₦5,000 to a vendor and the corporate treasurer parking working capital are not served by the same default, and a system that forces them into one is optimising for the average of two very different risk appetites. Configurability is the mark of a rail growing up.

The lesson for operators is that defaults are a security policy in disguise.

Multi-Factor Authentication: Closing the Cheapest Attack

The CBN’s requirement for multi-factor authentication on transfers attacks the most common failure point in Nigerian payments fraud — the single stolen credential. A PIN or password alone is a single wall; social engineering, SIM-swap and phishing have spent years learning to climb it.

Mandating a second factor does not eliminate fraud, but it raises the cost of every attack and removes the lowest-effort exploits from the table. The economics of fraud are, at bottom, the economics of effort: attackers pursue the highest return for the least work, and a single-factor login is the cheapest door in the building. Force a second, independent factor and a whole category of opportunistic, high-volume fraud stops paying for itself.

For the banks and fintechs that already layer authentication — the Paystacks, Flutterwaves, OPays and Moniepoints competing partly on trust — this formalises a practice the better operators had already adopted. For the laggards, it sets a floor, and floors matter in a network: fraud migrates to the weakest participant, so a system-wide minimum protects even the institutions that already exceeded it by denying attackers an easy point of entry elsewhere in the chain.

A payment system is only as strong as its weakest login, and the CBN has just lifted the weakest login.

The BVN Watchlist: A Register With Consequences

The Bank Verification Number was designed to give every account holder a single identity across the banking system. The new temporary BVN watchlist gives that identity a memory. An account flagged for suspected fraud can now be marked at the identity layer, not merely frozen at one bank, which closes a familiar gap — the fraudster who is shut out of one institution and simply opens elsewhere.

The word temporary is doing deliberate work. A watchlist that is hard to enter and easy to leave protects the innocent; one that is the reverse becomes a quiet penalty. The design intent is interdiction, not exile, and the test of the policy will be how cleanly people are removed once cleared. For an economy still working to bring tens of millions into the formal banking fold, a register that wrongly traps the innocent would corrode the very trust the reforms are meant to build — which is why the governance around entry and exit will matter as much as the watchlist itself.

Identity that travels with you is only fair if mistakes travel out as fast as they travel in.

Eighteen and Dormant: Tightening the Edges

Two further measures address the system’s edges. Setting 18 as the minimum BVN age draws a clear line under who may hold a fully fledged, transacting bank identity, narrowing a grey zone that fraud rings have exploited through accounts opened in others’ names. Tighter dormant-account rules attack a parallel problem: the long-idle account is the preferred vehicle for laundering and mule activity precisely because no one is watching it.

Neither measure is dramatic on its own. Together they reflect a maturing supervisory instinct — that fraud thrives in the parts of a system nobody is paying attention to, and that closing those parts is cheaper than chasing losses after the fact.

The quiet corners of a payment network are where its real risk lives.

So What for the Operator

For a Lagos fintech founder or an Abuja treasury manager, the March 2026 circulars are less a compliance headache than a repricing of trust. The CBN is signalling that the cost of friction-free payments — fraud absorbed largely by customers — has grown too high to leave uncorrected, and that the next phase of Nigeria’s payments growth will be built on verifiable identity and authenticated intent rather than raw speed alone.

The operators who treat these rules as a baseline to build above, rather than a ceiling to comply down to, will be the ones customers trust with the next decade of transactions. In a market where Nigerians have learnt to fear the very speed they depend on, trust is now the scarcest rail of all.