CBN's New BVN Rules 2026: What Every Nigerian Must Know

Nigeria's banking system is tightening its grip. On March 12, 2026, the Central Bank of Nigeria issued a circular signed by Musa I. Jimoh, Director of the Payments System Policy Department, announcing sweeping changes to how the Bank Verification Number system works. These rules take effect on May 1, 2026, and they will touch every single Nigerian who owns a bank account.

The BVN was introduced in 2014 as the foundational identity layer for Nigeria's banking sector. Today, 68.59 million Nigerians are enrolled. But as digital banking exploded, so did fraud. The CBN is now responding with its most aggressive BVN overhaul yet.

The One-Time BVN Phone Number Rule That Changes Everything

This is the rule that will affect the most Nigerians the most immediately. Under the new CBN directive, you can update the mobile number linked to your BVN only once in your lifetime. After that, it is locked permanently.

The CBN made this decision to stop a loophole that fraudsters have exploited for years. Criminals repeatedly updated BVN phone numbers to reroute one-time passwords (OTPs) and hijack accounts. The Nigeria Inter-Bank Settlement System recorded 62,901 fraud cases in 2023 alone that were tied to compromised mobile numbers.

If you are currently using a borrowed SIM card or a number you can no longer access, act now. Once these rules kick in on May 1, 2026, your only remaining update will be gone the moment you use it. Do not waste it.

How the New 24-Hour BVN Fraud Watchlist Works

The CBN has given banks a powerful new weapon against real-time fraud: a temporary watchlist. If a transaction on your account triggers a red flag, your bank can place your BVN on a watchlist for up to 24 hours while it investigates.

During that window, transfers, payments, and withdrawals can be paused. Your bank will contact you to verify whether the flagged activity is legitimate. If you confirm it, the hold is lifted. If you cannot be reached, the bank takes protective action.

This is a major shift from the way things worked before. Previously, banks had limited authority to freeze transactions in real time without court orders or lengthy compliance processes. The new rule gives them that power instantly, while capping it at 24 hours to prevent abuse.

The CBN also stated that access to the BVN database remains restricted to licensed financial institutions only. The apex bank retains the authority to grant access in exceptional cases, in line with existing laws.

BVN Enrolment Age Limit: Why Children Are Now Excluded

The CBN has set a firm minimum age of 18 for BVN enrolment. Before this circular, no universal age threshold existed in the BVN framework. Going forward, only adults can register for a BVN.

For parents and guardians managing finances for minors, this means a structural shift. Children's savings products and accounts will now need to operate under the guardian's own BVN and name, rather than through separate child-linked biometric registrations.

The policy is designed to tighten customer due diligence and reduce the likelihood that accounts are used for illicit financial activity. It also brings Nigeria's biometric identity framework closer to global standards, where financial identity systems are tied exclusively to legally recognised adults.

Device Binding Rules for Mobile Banking Apps Starting July 2026

Alongside the BVN changes, the CBN issued a separate but closely related directive on March 12, 2026, targeting digital banking applications. Starting July 1, 2026, your banking app can only be active on one device at a time.

Banks and fintechs must now implement device binding, tracking IMEI numbers, device IDs, and MAC addresses. If you log in from a new phone, the system detects the change and triggers a full re-authentication process, including BVN validation, biometric verification, and OTP confirmation.

During the 24-hour re-authentication window on a new device, your transaction limit drops to a temporary cap of N20,000 for both inflows and outflows. This cap is designed to limit how much damage a fraudster can do even if they bypass initial security.

Apps like OPay, Kuda, Moniepoint, and PalmPay, which collectively serve an estimated 30 to 50 million Nigerians, will all need to comply. Traditional banks must build or upgrade device fingerprinting infrastructure within 109 days of the directive.

Liveness Verification Now Mandatory for Online Account Opening

The CBN has also mandated that all digital account opening and reactivation processes must include a liveness check, verified in real time against the BVN or National Identity Number (NIN) database. This means selfie-based identity checks that confirm you are a living, present individual, not a photo or a mask.

Financial institutions must comply with this requirement by July 1, 2026. Banks that reactivate dormant accounts digitally must also apply biometric verification and token-based security checks before granting access.

In a separate, welcome change, the CBN has scrapped the requirement for an affidavit when reactivating dormant accounts. This simplifies a process that previously frustrated thousands of customers who needed notarised documents just to access their own frozen funds.

Why the CBN Is Tightening BVN Rules Now

The numbers explain it clearly. Fraud losses in Nigeria's financial system jumped 603% year-on-year to N3.29 billion in Q1 2025 alone, according to data from the Financial Institutions Training Centre. More than 12,000 cases were reported in that single quarter.

Instant payments hit N284.99 trillion in Q1 2025. That volume creates an enormous attack surface. As more Nigerians move to digital banking, the CBN must raise the security floor to match the scale. These new rules are not bureaucratic additions. They are a direct response to a fraud crisis that is accelerating.

The CBN has also recognised artificial intelligence and machine learning as approved tools for financial crime detection, embedding them into new compliance standards for financial institutions.

Key Dates and Compliance Timeline

What You Should Do Before May 1, 2026

You still have a narrow window to act. Start by confirming that the phone number linked to your BVN is a number you own and control. If it is an old number, a family member's SIM, or a line you have lost, contact your bank immediately and update it now, before the one-time update rule locks in.

Parents who currently have their children enrolled in the BVN system should speak to their banks about transitioning those accounts to guardian-controlled structures. Waiting until May 1 will cause delays and disruptions.

For digital banking users, ensure your bank app is installed on the device you use daily. After July 1, 2026, switching devices without preparing for re-authentication could lock you out of transactions at a critical moment.