Suspicious Transaction Reporting Rules in Nigeria Explained

In 2026, the Nigerian financial landscape has entered a new era of “automated vigilance.” With the Central Bank of Nigeria’s (CBN) rollout of new Baseline Standards for Automated AML/CFT/CPF solutions, banks and fintechs are now required to use AI-driven monitoring to flag suspicious activities in real-time. For an SME owner, understanding these systems is the only way to avoid the nightmare of an unexplained account freeze.

Here are the critical questions every Nigerian entrepreneur should be asking about these regulations.

Understanding AML/CFT Compliance in 2026

1. What is an STR, and why does my bank file one without telling me?

A Suspicious Transaction Report (STR) is a formal report filed by your bank to the Nigeria Financial Intelligence Unit (NFIU) when a transaction triggers an alarm in their automated compliance system. Under the “No-Tip-Off” rule, the law strictly forbids the bank from notifying you that an STR has been filed. This is to prevent “tipping off” a potential criminal who might otherwise move funds or destroy evidence.

2. What are the common “triggers” that cause my account to be flagged?

The AI systems look for “atypical” behavior, not just large sums. Common triggers include:

• Structuring: Depositing or transferring funds in many small chunks (e.g., just under ₦10,000) to avoid reporting thresholds.

• Rapid Movement: Receiving large inflows and moving them out almost immediately—often called a “flow-through” or “pass-through” account.

• Atypical Activity: If your business profile is “Retail/Trade” but you suddenly receive a ₦50 million transfer from a tech startup, the mismatch triggers an automatic audit.

• Unknown UBO: Transactions involving companies whose Ultimate Beneficial Owner (UBO) is obscured or linked to adverse media/sanctions lists.

3. What is a “False Positive,” and why is it happening more often?

A False Positive occurs when the AI flags a perfectly legitimate business transaction as suspicious because it deviates from your historical profile. As AI monitoring becomes more aggressive in 2026, these are increasing. To minimize them, ensure your KYC (Know Your Customer) information is always updated. If you expect a massive, one-off payment, notify your account officer in advance so they can “whitelist” or annotate the expected inflow in your profile.

4. I am a Real Estate Agent. Do I really need a SCUML certificate?

Yes, absolutely. Under Nigerian law, Designated Non-Financial Businesses and Professions (DNFBPs)—which include real estate, luxury goods dealers, and professional firms (lawyers/accountants)—must be registered with the Special Control Unit Against Money Laundering (SCUML). Without this certification, banks are often restricted from allowing you to maintain business accounts or process large property transactions, as you are considered a high-risk sector for money laundering.

5. How can I protect my business from a sudden account freeze?

Your best defense is a “proactive paper trail”:

• KYC Annual Update: Don’t wait for the bank to call you. Update your business turnover projections, address, and directors’ information annually.

• Documented Source of Wealth: For any inflow above ₦5 million, keep the supporting documents (contracts, invoices, or sales agreements) in a digital folder. If the bank queries the payment, you can provide the evidence within hours rather than days.

• Corporate Verification: Use the Corporate Affairs Commission (CAC) database or similar tools to verify the companies you are transacting with to ensure they are legitimate entities.

6. What should I do if my account is suddenly restricted?

Remain calm and contact your relationship manager immediately. If an STR has been filed, they may be limited in what they can disclose, but they can guide you on the specific documentation needed to “clear” the flag. Provide all requested financial documentation immediately—such as invoices, tax filings, and proof of your business activities—to prove the legitimacy of the funds.

7. Is there a way to see what the NFIU is looking for?

Yes. The Nigeria Financial Intelligence Unit (NFIU) publishes “red-flag indicators” on their official portal. Reviewing these occasionally helps you understand how the authorities define “suspicious” behavior so you can ensure your internal bookkeeping aligns with national compliance standards.

8. How does my Tax ID (TIN) relate to my account activity?

As of 2026, your banking and tax profiles are inextricably linked. The FIRS and banks share data to ensure that the volume of money flowing through your account matches your reported tax returns. A major discrepancy here is now a primary reason for both tax audits and AML-related account freezes.

Pro-Tip: The “Documentation First” Culture

In 2026, the mantra for every SME should be “Evidence Before Inflow.” Never receive a large payment without a corresponding, signed, and dated contract or invoice. When your business operations are as transparent as your documentation, you become “un-flag-able” to the automated AI systems that monitor our financial ecosystem.