Exposure of The Draft Guidelines on the Operations of Automated Teller Machines (ATMs) in Nigeria

Central Bank of Nigeria Payments System Policy Department Central Business District, Cadastral Zone, P.M.B 0187, Abuja-Nigeria. E-mail: PSPD@cbn.gov.ng Phone :09 462 35000

PSP/DIR/CON/CWO/001/043 October 9, 2025 Circular to banks, other financial institutions and payments service providers

EXPOSURE OF THE DRAFT GUIDELINES ON THE OPERATIONS OF AUTOMATED TELLER MACHINES (ATMs) IN NIGERIA

The Central Bank of Nigeria (CBN), in line with its mandate to promote a sound financial system and efficient payments system, has reviewed the current operations of Automated Teller Machines (ATMs) in Nigeria and hereby issues draft Guidelines on the Operations of Automated Teller Machines (ATMs) in Nigeria.

The Guidelines on the Operations of Automated Teller Machines in Nigeria have been developed to establish minimum standards for ATM deployment, operations, and maintenance, promote improved access to ATM services in urban and rural areas, strengthen security protocols and enhance consumer protection and align ATM operations with global best practices and regulatory expectations.

The draft guidelines are hereby exposed for comments/feedback from various stakeholders for four weeks from the date of this circular.

All stakeholders, including deposit money banks, independent ATM deployers, card schemes, payment service providers, and the banking public, are invited to submit comments for consideration.

Submission of comment/feedback

All comments/feedback should be addressed to:

The Director, Payments System Policy Department Central Bank of Nigeria Central Business District, Abuja Email: pspd@cbn.gov.ng

Deadline for submission: October 31, 2025.

Yours Faithfully,

bello For Musa I. Jimoh Director, Payments System Policy Department

1

GUIDELINES ON THE OPERATIONS OF AUTOMATED TELLER MACHINES (ATMs) IN NIGERIA

DRAFT

October 2025

2

In exercise of the powers conferred on the Central Bank of Nigeria (CBN) by Sections 2 (d) and 47 (2) of the CBN Act, 2007, to promote and facilitate the development of efficient and effective systems for the settlement of transactions, including the development of electronic payment systems; the CBN in June 2020, issued the Guidelines on Operations of Electronic Payment Channels in Nigeria. The Regulation contained the Guidelines for the operation of Automated Teller Machines (ATMs), Point of Sale (POS) Card Acceptance Services, Mobile Point of Sale (MPOS) Acceptance Services and Web Acceptance Services.

Since the issuance of the above referred Guidelines, the payment ecosystem has witnessed developments such as increased sophistication in digital finance, cyber threats and financial inclusion amongst others. In view of these developments, the CBN reviewed the section of the Guidelines on the operations of Automated Teller Machines (ATM) herein referred to as “Guidelines on the Operations of Automated Teller Machines in Nigeria”.

This Guidelines supersedes the requirements on the operations of Automated Teller Machines as contained in the Guidelines for the Operations of Electronic Payment Channels in Nigeria, issued by the CBN in 2020 and all previous regulation on ATM.

1. Objectives The objectives of the Guidelines are to:

a. provide additional guidance on the operation of ATMs;

b. guide ATM deployers on ATM density deployment requirements; and

C. provide clarity on security requirements of the ATMs.

2. Application The Guidelines on the Operations of Automated Teller Machines shall apply to all deposit money banks, other financial institutions, independent ATM deployers and any card-issuing institutions in Nigeria.

Any Independent ATM Deployer (IAD) must obtain prior written approval from the Central Bank before commencing deployment activities. The licensing/registration process shall include submission of corporate information, technical and operational capacity assessment, evidence of partnership agreement with a bank for cash provisioning, and compliance with extant payment systems regulations.

3

3. ATMs Technology Standards and Specification a. All ATM deployers/acquirers shall comply with Payment Card Industry Data Security Standards (PCI DSS).

b. All ATM systems shall have audit trail and logs capabilities, detailed enough to facilitate investigations, reconciliation and dispute resolution.

C. Card readers shall be identified by a symbol that: i. represents the card; ii. identifies the direction for which the card should be inserted into the reader; and iii. All ATMs shall accept card horizontally with the chip upwards and to the right.

d. Two percent of ATMs deployed by each acquirer shall have tactile graphic symbol for the use of visually impaired customers. Locations of such ATMs are to be visibly publicized on their corporate website at the minimum.

4. ATM Deployment a. All ATM transactions in Nigeria shall be processed by a company operating in Nigeria as acquirer-processor.

b. No card or payment scheme shall compel any issuer or acquirer to send any transaction outside the country for processing, authorization or switching. This is where the transaction is at an ATM or at any acceptance device in Nigeria and the issuer is a Nigerian bank or any other issuer licensed by the CBN.

C. All ATM transactions in Nigeria shall, where the card issuer is a Nigerian bank or any other issuer licensed by the CBN be settled under a domestic settlement arrangement operated by a Nigerian Company. All collaterals for such transactions shall be in Naira and deposited within the country.

d. No card scheme shall discriminate against any ATM owner or acquirer. Similarly, no ATM owner or acquirer shall discriminate against any card scheme or issuer.

e. Every card-scheme must publish for the benefit of all ATM owners, acquirer and the Central Bank of Nigeria, the requirements for acquiring ATM transactions under the card scheme.

4

f. Deployment of stand-alone or closed ATM networks are not allowed.

g. ATMs should be located in areas that provide easy access at reasonable times. Access to these ATMs should be controlled and secured so that customers can safely use them.

h. Proper lighting should be adequate for safe access and good visibility in areas where ATMs are deployed. It should provide a consistent distribution and level of illumination, particularly in the absence of natural light.

i. ATMs should be sited in such a way that direct or reflected sunlight or other bright lighting is prevented from striking the ATM display, for example, through the use of overhead sun shelter.

j. The design and installation features of ATMs shall have privacy so that in normal use the cardholder does not have to conspicuously take any protective action.

k. All ATMs shall accept all cards issued in Nigeria by authorised issuers .

5. Density Requirements for ATMs Deployment a. All card issuers shall deploy ATMs, of at least 1 ATM per every 5000 payment cards issued. This level shall be achieved over a period of three years, of which compliance levels are staggered as follows 30% (1st Year 2026), 60% (2nd Year - 2027), (3rd year 100% - Year 2028).

b. ATMs shall be located within a reasonable distance from each other in both urban and rural areas.

C. Any bank that issue payment cards must deploy ATM in line with the requirements of Section 6 (a and b) above.

d. ATM deployment, redeployment and decommissioning shall be with the prior-written approval of the CBN in line with extant regulations.

6. ATM Operations All ATM deployers shall ensure that:

a. The ATM downtime (due to technical fault) shall not exceed seventy-two (72) consecutive hours, where this is not practicable, customers shall be duly informed by the deployer;

5

b. Helpdesk contacts are adequately displayed at the ATM terminals. At the minimum, there should be a dedicated telephone line for reporting faults and such telephone lines shall always be functional and manned.

C. All ATM charges and fees are fully disclosed to customers.

d. The ATMs issue receipts for all transactions, where requested by a customer, except for balance enquiry. Such receipts should at a minimum state, the amount withdrawn/deposited, the terminal identity, date and time of the transaction.

e. Printed receipts and screen displays are legible.

f. Dispensing/deposit and recycling components of the machine are in proper condition. Cash retraction functionality is disabled on all ATMs.

g. There is appropriate monitoring mechanism to determine reasons for transaction failure.

h. There is online monitoring mechanism to determine ATM vault cash levels.

i. ATM vault replenishment is carried out as often as necessary to avoid cash-out.

j. ATMs are not stocked with unfit notes.

k. Cash shall be made available in the ATMs at all times. The funding and operations of the ATM deployed by non-bank institutions should be the sole responsibility of the bank or institutions that entered into agreement with them for cash provisioning. In this regard, the Service Level Agreement (SLA) should specify the responsibilities of each party.

l. Change of Personal Identification Number (PIN) functionality is provided to customers, free of charge.

m. Acquirers monitor suspicious transactions and report same to CBN, based on the agreed format and timeframe.

Ο. Back-up power (inverter) is made available at all ATM locations, to ensure uninterrupted power supply.

p. Paper disposal basket is provided at all ATM locations.

q. A register of all their ATMs in Nigeria with location, identification, serial number of the machines, etc is maintained.

r. Provision is made for extending the time needed to perform a specific step, by presenting a question, such as, "Do you need more time?"

6

S. Information sufficient to construct a usable card is not displayed on the screen or printed on a transaction record. This will guard against the possibility of such information becoming accessible to another person should the cardholder leave the ATM while a transaction is displayed or abandons a printed transaction record.

t. Precautions are taken to minimize the possibility of a card being left, by a message or voice, alerting the customer to take his card.

น. Cash out first before card is out of the ATM is adopted, to minimize the possibility of customers leaving cash uncollected at the ATM.

V. ATM acquirers shall disable cash-retract functionality and display such notice at the ATM or on the screen.

W. Acquirers reconcile and refund all funds in their possession, belonging to customers due to partial or non-dispense errors.

X. Acquirers install and adopt appropriate mechanisms to immediately initiate refunds without the prompting of the issuing bank or the customer.

7. ATM Maintenance All ATM deployers shall ensure that:

a. Notice is displayed at the ATM on disruption to service due to maintenance and the planned maintenance period.

b. An ATM maintenance register or log is properly kept.

C. All ATMs and cash in the machines are insured.

d. Their ATMs are physically inspected, as frequently as may be required to ensure safe, secure and efficient operations.

8. ATM Security All ATM deployers shall ensure that:

a. Every ATM has cameras, which views and records all persons using the machines and every activity at the ATM, including but not limited to; card insertion, transaction selection, cash withdrawal, cash deposit, card taking, etc. However, such cameras should not record customers' keystrokes while using the ATM.

b. Where a surveillance camera is used, it should be kept secret to avoid illegal removal, damage or compromise.

c. Networks used for the transmission of ATM transactions must be tested and proven to have data confidentiality and integrity.

7

d. All ATMs shall be sited in locations that guarantees safety and security of users as well as the confidentiality of their transactions.

e. ATMs shall not be placed outside buildings, unless such ATM is bolted to the floor and surrounded by structures, to prevent removal.

f. Additional precautions must be taken to ensure that any network connectivity from the ATM to the bank or switch is protected. This is to prevent the connection of unauthorized devices to the network point.

g. Where the user of an ATM blocks his image for camera capture, the ATM shall be capable of aborting the transaction.

h. ATM keys shall be changed regularly (every year) and the same keys are not used for multiple ATMs.

i. ATMs shall be installed with anti-skimming devices that would ensure effective mitigation against fraud incidents.

9. Accessibility and Inclusivity In line with extant regulations, ATMs shall be deployed to ensure accessibility and inclusivity.

Resolution of Failed Transactions a. Failed on-us ATM transactions reversal shall be instant. However, where instant reversal fails due to technical issues or other system glitches, the timeline for manual reversal shall not exceed 24 hours.

b. The timeline for refunds on failed not-on-us ATM transactions shall not exceed 48 hours.

Compliance Monitoring The CBN will conduct periodic audits to ensure compliance with this regulation and other related extant regulations. The CBN shall conduct onsite checks of ATMs with a view to ensuring compliance with cash and service availability.

Reporting Requirements Any institution that operates ATMs shall render monthly return not later than the 5th of the following month, including list of new deployments with location and addresses to the Director, Payments System Supervision Department of the Central Bank of Nigeria for compliance monitoring.

8

Penalties Appropriate penalties shall be imposed on institutions that fail to comply with any of the provisions of this Guidelines, or any other relevant Regulation issued by CBN from time to time.

a) Definition of Terms Automated Teller Machine (ATM): is a device that allows card holders to perform financial transactions such as ATM card activation, cash withdrawal, balance inquiry, bills payments, fund transfers, cash deposit, and airtime top-up.

b) ATM Deployment Density: refers to the number of Automated Teller Machines (ATMs) per specific area or population with adult bank account/card holders.

c) ATM Deployers: entities responsible for the installation and maintenance of ATMs.

d) Independent ATM Deployer (IAD): any entity, other than a bank, licensed or registered by the Central Bank to install, own, and maintain ATMs, subject to entering into agreement(s) with banks or card schemes for settlement, cash provisioning, and compliance with these Guidelines.

e) Card Scheme: a payment network or arrangement (domestic or international) that sets rules, technical standards, and procedures for card issuance and acceptance, including authorization, clearing, and settlement of card-based transactions.

f) Payment Cards: as used in this Guidelines refer to physical debit/credit cards.

g) On-us ATM Transactions: This refers to ATM transactions where a customer uses cards on bank ATMs where his/her account is domiciled.

h) Not-on-us ATM Transactions: This is an ATM transaction where a customer uses his/her card on other banks' ATMs.

CENTRAL BANK OF NIGERIA, OCTOBER, 2025

9