The Central Bank of Nigeria (CBN) has established new minimum standards for ATM deployment, operations, maintenance, and security.
The apex bank said the new rules, contained in its circular titled “Exposure of the Draft Guidelines on the Operations of Automated Teller Machines (ATMs) in Nigeria,” released over the weekend, supersede previous ATM regulations.
According to the new regulation, all card issuers must deploy at least one ATM per 5,000 payment cards issued.
This, the apex bank directed, must be fully achieved within three years (100% by 2028), starting with 30% in the first year (2026).
It added that ATMs must be located in a manner that guarantees the safety and security of users and the confidentiality of transactions. They should not be placed outside buildings unless bolted to the floor.
The CBN further directed: “ATM deployment, redeployment, and decommissioning require prior written approval from the CBN.
“Independent ATM Deployers (IADs) must obtain prior written approval from the CBN and satisfy licensing and registration requirements, including evidence of partnership with a bank for cash provisioning.”
On failed transactions and refunds, it directed that for On-us ATM transactions (using a bank’s own ATM), reversal of a failed transaction must be instant. If instant reversal fails due to technical issues, the timeline for manual reversal shall not exceed 24 hours.
For Not-on-us ATM transactions (using another bank’s ATM), refunds shall not exceed 48 hours.
Other provisions of the new directive include: “Automatic refunds: Acquirers must adopt appropriate mechanisms to immediately initiate refunds for non-dispense errors without the prompting of the issuing bank or the customer.
“Security: All ATMs must have cameras that record all persons and activities (card insertion, cash withdrawal, etc.) but should not record customers’ keystrokes. Networks used must be tested and proven for data confidentiality.
“Anti-skimming: ATMs shall be installed with anti-skimming devices to mitigate fraud.
“PIN/Keys: ATM keys must be changed regularly (every year), and the same keys must not be used for multiple ATMs. Customers can change their PIN free of charge.
“Standards: All ATM deployers and acquirers must comply with Payment Card Industry Data Security Standards (PCI DSS).
“ATM operations and maintenance downtime: The technical downtime for an ATM shall not exceed 72 consecutive hours. Customers must be informed if this is not practicable.
“Cash provisioning: Cash shall be made available at all ATMs at all times. The bank that entered into an agreement with a non-bank institution for deployment is solely responsible for cash provisioning.
“Information: Helpdesk contacts, charges, and fees must be adequately displayed to customers.
“Receipts: ATMs must issue receipts for all requested transactions, except for balance enquiries.
“Monitoring: The CBN will conduct periodic audits and onsite checks to ensure compliance with the guidelines and the availability of cash and service.
“Reporting: All institutions must render a monthly return to the CBN, including new deployments, no later than the 5th of the following month.