In Part One, we established why the CBN’s new Baseline Standards for Automated AML Solutions rank among the world’s best. Here, we examine the risks those Standards create and the hard governance work that genuine compliance requires.
A regulatory framework is only as valuable as the quality of its implementation.
The CBN has been explicit on this point from the opening pages of its new Baseline Standards – they are designed to ensure “demonstrable effectiveness and not merely feature-based compliance or vendor-driven implementation”.
That phrase is both an aspiration and a warning. It tells institutions precisely what the CBN will be looking for when it examines compliance and what will not satisfy it.
What follows is an analysis of the ten most significant risks embedded in the new framework, explained in terms that non-technical readers can follow, with the supporting detail and specific Standards references that Compliance Officers and Risk Managers need to act on.
The risk that connects all the others. An institution can deploy a system that meets every technical requirement on paper, while the underlying controls are not genuinely effective. The CBN has explicitly anticipated this risk and stated what it will do about it – assess demonstrable effectiveness, not feature-based conformity.
When a genuine financial crime case surfaces that the system should have caught and did not, the institution that claimed compliance is in a materially worse regulatory position than one that was honest about its gaps from the outset.
What institutions must do – Build a genuine effectiveness test into the deployment plan. Before go-live, validate that the system can detect the financial crime typologies most prevalent in the institution’s specific risk profile using typology guidance published by the NFIU and FATF, not just vendor defaults. After deployment, conduct periodic red-team exercises presenting the system with scenarios that should trigger alerts and confirming that they do. Where they do not, treat this as a Board-level governance matter.
Three Areas Where Further CBN Guidance Would Strengthen the Framework
In the spirit of constructive engagement with what is genuinely strong regulatory work, three areas merit attention in future CBN guidance.
- Generative AI tools (large language models being actively marketed to compliance teams for drafting Suspicious Transaction Reports (STRs), generating case narratives and summarising investigation outcomes) are not addressed in the Standards. They introduce hallucination risk and third-party data confidentiality exposure that the current framework does not contemplate. Supplementary guidance is needed before institutions deploy these tools in a regulatory context.
- The fairness and bias testing requirements in §5.5b.i are the right requirements but are not yet supervisable in any consistent way. Without a specified methodology, defined characteristics and an acceptable disparity threshold, well-resourced institutions will conduct rigorous testing and smaller ones will not, and the CBN will have no consistent basis to distinguish between them.
- Practical proportionality guidance for smaller institutions (Microfinance Banks, Payment Service Providers, Smaller Fintechs) should arrive early in the implementation window, not at its end. The gap between the Standards’ requirements and the current capabilities of these institutions is real, and acknowledging it with practical guidance is both fair and in the interest of the financial system.
Conclusion
The CBN has produced a framework of genuine international standing, technically rigorous, carefully structured and backed by enforcement provisions that make the stakes clear. The institutions that implement it seriously will be stronger, better protected and more credible to international partners as a result.
The roadmap submission due in June is not the finish line. It is the first accountability moment in a compliance commitment that will determine, in practical terms, whether Nigeria’s financial crime controls are as strong as the framework that governs them.
The CBN has been clear about what it expects. What happens next is up to the institutions.
This article draws on the CBN Baseline Standards for Automated Anti-Money Laundering Solutions (Circular BSD/DIR/PUB/LAB/019/002, 10 March 2026); FinCEN’s Notice of Proposed Rulemaking on AML Programme Effectiveness (June 2024); the EU Anti-Money Laundering Regulation 2024/1624; the EBA SupTech Report (August 2025) and EBA Fifth Biennial AML Opinion (July 2025); the New York City Bar Association Compliance Committee Report on AI and Machine Learning in AML/CFT (March 2024); and publicly available reporting on AML regulatory developments in Ghana, Kenya and South Africa. It does not constitute legal or regulatory advice.
Henry Nduka Onyiah is a Cyber Risk Advisor and an Independent Non-Executive Director of a Nigerian Financial Institution. He writes in a personal capacity.
The views expressed are entirely his own and do not represent the position of any institution with which he is associated. He welcomes reactions, views and engagement. He can be reached at onyiah@tuta.io or on LinkedIn at linkedin.com/onyiah.
