The Central Bannk of Nigeria has established new standards for deployment, operations and maintenance of ATMs.
CBN has said that the directives in its communique titled “Exposure of the Draft Guidelines on the Operations of Automated Teller Machines (ATMs) in Nigeria,” supersedes previous ATM regulations.
Here is a summary of the Major Requirements:
1. ATM Deployment and Density
Target: All card issuers must deploy at least 1 ATM per 5,000 payment cards issued. This must be fully achieved within three years (100% by 2028), starting with 30% in the first year (2026).
Location: ATMs must be located in a way that guarantees safety and security of users and confidentiality of transactions. They should not be placed outside buildings unless bolted to the floor.
Approval: ATM deployment, redeployment, and decommissioning require prior written approval from the CBN.
IADs: Independent ATM Deployers (IADs) must obtain prior written approval from the CBN and satisfy licensing/registration requirements, including evidence of partnership with a bank for cash provisioning.
2. Failed Transactions and Refunds
On-us ATM Transactions (using a bank’s own ATM): Reversal of a failed transaction must be instant. If instant reversal fails due to technical issues, the timeline for manual reversal shall not exceed 24 hours.
Not-on-us ATM Transactions (using another bank’s ATM): The timeline for refunds shall not exceed 48 hours.
Automatic Refunds: Acquirers must adopt appropriate mechanisms to immediately initiate refunds for non-dispense errors without the prompting of the issuing bank or the customer.
3. Security and Technology
Security: All ATMs must have cameras that record all persons and activities (card insertion, cash withdrawal, etc.), but should not record customers’ keystrokes. Networks used must be tested and proven for data confidentiality.
Anti-Skimming: ATMs shall be installed with anti-skimming devices to mitigate fraud.
PIN/Keys: ATM keys must be changed regularly (every year), and the same keys are not to be used for multiple ATMs. Customers can change their PIN free of charge.
Standards: All ATM deployers/acquirers must comply with Payment Card Industry Data Security Standards (PCI DSS).
4. ATM Operations and Maintenance
Downtime: The technical downtime for an ATM shall not exceed 72 consecutive hours. Customers must be informed if this is not practicable.
Cash Provisioning: Cash shall be made available at all ATMs at all times. The bank that entered into an agreement with a non-bank institution for deployment is solely responsible for cash provisioning.
Information: Helpdesk contacts, charges, and fees must be adequately displayed to customers.
Receipts: ATMs must issue receipts for all requested transactions, except for balance enquiry.
5. Compliance, Monitoring, and Reporting
Monitoring: The CBN will conduct periodic audits and onsite checks to ensure compliance with the guidelines and availability of cash and service.
Reporting: All institutions must render a monthly return to the CBN, including new deployments, no later than the 5th of the following month.
Penalties: Appropriate penalties shall be imposed on institutions that fail to comply
Key Objectives
The main goals of the guidelines are to:
Provide additional guidance on the operation of ATMs.
Guide ATM deployers on ATM density deployment requirements to improve access.
Provide clarity on the security requirements for ATMs.
Strengthen security protocols and enhance consumer protection.