What know your customer means
KYC is a bank confirming you are who you say you are, before it lets you move money.
The purpose is not administrative. It exists because financial institutions are the point at which the proceeds of crime enter the legitimate system, and anti money laundering rules put the obligation to check on them.
It has three parts. Identifying the customer, by collecting identity information. Verifying that identity against reliable independent sources. And ongoing monitoring, so that transactions inconsistent with what the institution knows about the customer are noticed.
In Nigeria the framework comes from the Central Bank's anti money laundering and combating the financing of terrorism regulations, and from the Money Laundering (Prevention and Prohibition) Act, with the Nigerian Financial Intelligence Unit receiving reports.
How it is used
For individuals, the Nigerian system is tiered, and the tier decides both the documents required and the limits on the account.
Lower tier accounts have minimal documentation requirements and correspondingly low balance and transaction limits, which is how financial inclusion is intended to work. Higher tier accounts require full documentation, including a Bank Verification Number, a valid means of identification, proof of address and a photograph, and carry no such limits.
For businesses, corporate KYC is heavier. A bank opening a company account will want the certificate of incorporation, the status report or the equivalent CAC filings, the memorandum and articles, a board resolution authorising the account and naming signatories, identification and BVNs for directors and signatories, proof of the registered address, and often the Taxpayer Identification Number.
Ongoing monitoring is the part customers notice least until it affects them. Transactions that do not fit the profile can trigger queries, requests for documentation, or a freeze while the institution satisfies itself.
Key features
- Required of banks and other financial institutions under Nigerian AML rules
- Three parts: identification, verification and ongoing monitoring
- Individual accounts operate on a tiered basis, with documents matched to limits
- BVN and NIN are central to Nigerian identity verification
- Corporate accounts require CAC documents, a board resolution and director identification
- Institutions must report suspicious transactions to the Nigerian Financial Intelligence Unit
How this works in Nigeria
The BVN changed Nigerian KYC more than any other single measure. A biometric identifier tied to a person rather than to an account made it possible to link accounts across banks, and it underpins most verification today. The NIN has been layered on top and linked to telecommunications and other services.
For businesses, the practical consequence is that account opening depends on the company's CAC records being current. A company whose directors changed but whose filings were never updated will be asked to regularise before the account is opened, and that takes time nobody planned for.
For fintechs and other regulated businesses, KYC obligations flow down. A business onboarding its own customers may itself be required to run checks, and the standard expected rises with the risk of the product.
KYC also collides with data protection. Everything collected for KYC is personal data under the Nigeria Data Protection Act, so it must be collected for a stated purpose, kept securely, retained only as long as required, and disclosed in a privacy notice. Collecting more than the rules require is a data protection exposure rather than caution.
KYC vs due diligence vs data protection
Three checking exercises that overlap and answer different questions.
KYC asks who is this customer, and is required by financial regulation. It is standardised, it applies to every customer, and the institution has no discretion about whether to do it.
Due diligence asks what am I buying or who am I dealing with, and is commercial rather than regulatory. A buyer investigating a company before an acquisition is doing due diligence, and the scope is whatever the transaction warrants.
Data protection asks whether I am allowed to hold this information, and governs everything collected in the other two. It limits what may be collected, how long it may be kept and what it may be used for.
So a bank runs KYC because it must, a buyer runs due diligence because it is prudent, and both are constrained by data protection law in what they may keep afterwards.
Limits and risks
KYC is a check on identity, not on honesty. It confirms who somebody is, not what they intend to do, which is why ongoing monitoring exists alongside it.
It also excludes people. Nigerians without formal identification, a verifiable address or a BVN face real barriers to financial services, which is what the tiered system was designed to soften.
Re verification is a recurring frustration. Customers are asked repeatedly for documents they have already supplied, because institutions hold data in fragmented systems.
And over collection is a genuine risk. An institution that collects more than the rules require, and keeps it indefinitely, has created a data protection exposure and a target, rather than additional safety.
Worth knowing
Before opening a corporate account, confirm your CAC records match your current directors and address. Nigerian account opening is delayed more often by stale company filings than by anything the bank asks for, and updating a filing takes longer than the bank will wait.
Questions people ask
What does KYC mean?
Know Your Customer, the checks a financial institution runs to identify and verify a customer before doing business, and to monitor their transactions afterwards. It is required by Nigerian anti money laundering rules.
What documents do I need to open a Nigerian bank account?
It depends on the account tier. Higher tier accounts require a BVN, a valid means of identification, proof of address and a photograph. Lower tier accounts require less but carry balance and transaction limits.
What does a company need to open a corporate account?
Certificate of incorporation, current CAC filings or status report, memorandum and articles, a board resolution authorising the account and naming signatories, identification and BVNs for directors and signatories, proof of address and often the TIN.
Why does my bank keep asking for the same documents?
Institutions hold customer data in fragmented systems and are required to keep records current, so re verification requests recur. It is a common frustration rather than a sign of a problem with your account.
Is KYC data covered by the data protection law?
Yes. Everything collected for KYC is personal data under the Nigeria Data Protection Act, so it must be collected for a stated purpose, kept securely, retained only as long as needed and disclosed in a privacy notice.
Why was my account frozen after a large transfer?
Ongoing monitoring flags transactions inconsistent with what the institution knows about you. The institution may query it, request documentation, or restrict the account while it satisfies itself, and suspicious transaction reports go to the Nigerian Financial Intelligence Unit.