Last updated: November 2026 · Reading time: about 12 minutes
 |
| The reform is not the API. It is the permission screen: who is asking, what they want, how long they keep it, and how you take it back. |
What this guide covers
Why screen-scraping is being replaced
Before open banking, a Nigerian fintech that wanted your bank transaction history had two options. It could ask you to hand over your banking login, then use software to read your account the way you would — a practice called screen-scraping. Or it could build a separate, bespoke integration with each bank, a process that took months and had to be rebuilt for every new partner.
Both were bad. Screen-scraping meant sharing credentials that could be misused, and the data pulled was often more than the service needed. The EFInA guide to open banking describes the reality plainly: some providers use your bank login to pull data without your consent and share it with third parties. The bespoke-integration model meant fintechs spent their engineering budgets rebuilding the same connection to twenty different banks.
The replacement is not just better for customers. It is better for fintechs, because an integration built once against a standard API can be reused across every participating bank. That is the difference between a market where every partnership takes six months and one where it takes a fortnight.
Consent, the registry and the BVN anchor
The regulatory machinery has three moving parts, and each one matters for a different reason.
| Component | What it does | Why it matters |
|---|---|---|
| Consent management | An API provider may only share a customer’s data when presented with valid proof of consent, and must authenticate that consent as coming from its own customer | This is the legal core of the framework. Without authenticated consent, there is no lawful data sharing. |
| Open Banking Registry | A central register run by NIBSS, listing accredited participants | It is the gatekeeper. Only registered institutions can operate, which is what separates open banking from the informal data economy it replaces. |
| BVN anchor | Consent is tied to the customer’s Bank Verification Number | The BVN is the one identity standard Nigeria has already enforced at national scale. Anchoring consent to it makes the permission portable and verifiable. |
The consent requirements are specific, and they are worth reading in the original because they describe what a customer must be shown before they agree.
For consent to be valid, the API consumer must present: its full legal name and any brand name it operates under; its registry accreditation number; its CAC business registration number; the type of access requested; the duration of the consent and when it expires; the frequency of access or whether it is one-off; and the process for withdrawal, including a statement that the customer can withdraw at any time and what happens if they do.
There is also a data minimisation requirement. Consent must specify whether the request includes permission to collect data for anonymous or de-identified analysis, and it must set out the AC’s policy on deleting or de-identifying redundant data, along with the customer’s right to elect deletion. That is the difference between a permission and a blank cheque.
The inclusion promise: 74 million adults
The case for open banking is not that it makes existing banking more convenient. It is that it reaches people the branch model cannot.
BusinessDay puts the target population at 74 million Nigerian adults who are either unbanked or underserved. The CBN’s Payment System Vision 2028 sets a 95% financial inclusion target by 2028, and identifies open banking, embedded finance, AI and digital identity as the technologies expected to deliver it.
The mechanism is embedded finance: financial services delivered inside a platform a person already uses, rather than through a bank they have to visit.
| Who | What open banking changes |
|---|---|
| A delivery rider | A bank may not lend to him. But a platform that holds his transaction history can show a lender his income pattern, and he becomes eligible for an overdraft to fix his motorbike. |
| A market trader in Kano | She cannot convince a bank of her creditworthiness. But a fintech that gave her a virtual account to receive payments holds years of sales data, which can support a loan for seasonal stock |
| A first-time borrower | Instead of handing over contacts and photos for a small loan, she grants access only to the wallet history the lender needs . |
The numbers explain why this matters more than another branch. Only around 9% of Nigerian adults have access to formal credit, and insurance penetration sits near 0.5% of GDP. Neither figure moves by building more bank branches. They move when financial services are embedded in contexts people already trust.
The timeline that kept slipping
Nigeria was the first African country to issue an open banking framework, in February 2021. The operational guidelines followed in March 2023. The commercial launch was originally anticipated for August 2025 — and it slipped.
| Date | Milestone | Status |
|---|---|---|
| February 2021 | Regulatory Framework for Open Banking issued | Complete — Africa’s first |
| March 2023 | Operational Guidelines finalised | Complete |
| 2025 | Five industry workstreams deliver governance, security and onboarding | Complete |
| August 2025 | Originally anticipated commercial launch | Slipped |
| February 2026 | CBN Fintech Report commits to a 2026 phased rollout | Committed |
| Mid-2026 | Phased go-live | In progress |
The delay is worth noting because it reveals where the caution sits. The CBN’s position, as reported in late 2025, was that the framework and guidelines were in place but the regulator remained cautious about data protection and consumer consent before going live. That is not a technical delay. It is a decision about whether the consent machinery actually works.
The history of CBN mandates suggests the scepticism about whether banks will open their APIs is overdone. When the BVN was mandated in 2014, enrolment moved from zero to 12.4 million in sixteen months and stands above 67 million today. When the CBN required accounts to be linked to a national ID by early 2024, tens of millions were restricted within weeks. The NUBAN standard, introduced in 2011, is the backbone of every interbank transfer. The playbook is hard deadlines, account-level enforcement, and NIBSS as a neutral operator.
The AI guardrail gap
The rails are ready. The rules for what runs on them are not.
That is the warning from IT governance and risk specialist Akinwumi Opeoluwa Ayodele, and it is the most important criticism of the rollout: “Open banking rails are ready. The rules for the AI running on them are not.”
The concern is specific. Open banking will release a volume of financial data that lenders will use to make automated credit decisions. Nigeria has a National AI Strategy introduced in 2025, but no dedicated AI law and no independent regulator with powers to oversee deployment across sectors. There are no binding rules defining how AI systems in lending, fraud detection or risk assessment should be audited, how developers should test for algorithmic bias, or whether a customer has a right to an explanation when an automated system rejects a loan application.
The CBN has begun informally reviewing fairness, explainability and transparency when assessing AI-powered products in its sandbox . But those expectations remain confined to the sandbox and have not become mandatory across the wider ecosystem. That is the difference between a pilot and a rule.
The liability problem nobody has solved
The second gap is legal rather than technical, and it will surface the first time a data breach or a bad credit decision is contested.
An open banking transaction is a tripartite relationship: the bank (API provider), the third-party service provider (API consumer), and the customer. Each has obligations under the CBN Guidelines — registration on the registry, access rules, security standards, consent management. But when something goes wrong, the liability architecture is underdeveloped.
| Scenario | What the framework says | What remains unclear |
|---|---|---|
| Data breach | Both bank and AC must implement preventive measures, maintain a breach policy, notify the CBN and relevant parties, and review the cause | Which party bears the loss when the breach crosses an API boundary and the cause is contested |
| Unauthorised access | Consent must be authenticated by the API provider | Liability when a consent is forged or replayed, and the bank relied on it in good faith |
| Bad automated decision | No binding AI explainability rule | Whether the customer can compel an explanation, and from whom |
BusinessDay’s legal analysis puts it directly: while Nigeria has established a functional regulatory architecture, the liability and dispute resolution architecture remains underdeveloped, leaving significant uncertainty for banks, fintechs and end-users . The doctrine of contractual privity in a multi-party API chain is not yet settled.
What to watch in the next 12 months
| Indicator | Why it matters |
|---|---|
| Registry go-live and participant numbers | How many banks and fintechs actually register is the clearest signal of whether the rail is real or nominal. |
| First enforcement action | The CBN has authority to sanction, revoke licences and fine. The first use of that authority sets the tone. |
| Consent revocation rates | If customers use the revocation kill-switch, the system is working as designed. If nobody revokes, consent may be nominal. |
| AI explainability rules | Whether the sandbox expectations become mandatory is the test of whether open banking delivers fair credit or just faster credit. |
| The first liability test case | A contested data breach or bad automated decision will define how the tripartite relationship works in practice. |
| Inclusion data | The 95% by 2028 target is the benchmark. Watch whether the 74 million figure moves, and in which segments. |
Frequently asked questions
What is the CBN Open Banking Framework?
A regulatory framework issued by the Central Bank of Nigeria in February 2021, operationalised by guidelines in March 2023, that sets the rules for secure, consent-based sharing of customer financial data between banks, fintechs and licensed third-party providers through standardised APIs.
What is screen-scraping and why is it being replaced?
Screen-scraping is a method where a fintech uses a customer’s bank login to pull account data without explicit consent, often accessing more than the service needs. Open banking replaces it with consent-based APIs that release only the agreed data, for an agreed purpose, for an agreed period, with the customer able to revoke.
When does open banking go live in Nigeria?
A phased go-live is committed for 2026, set out in the CBN’s February 2026 Fintech Policy Insight Report. The originally anticipated August 2025 commercial launch slipped because the CBN remained cautious about data protection and consent before going live.
What is the Open Banking Registry?
A central register run by the Nigeria Inter-Bank Settlement System (NIBSS) that lists accredited participants. Only registered institutions can operate in the open banking ecosystem, which is what separates it from the informal data-sharing market it replaces.
How does consent work under the framework?
An API provider may only share customer data when presented with valid proof of consent, and must authenticate that the consent comes from its own customer. Before consent is given, the customer must be shown the AC’s legal name, registry number, CAC number, the type of access, the duration, the frequency, and the process for withdrawal.
Does open banking mean my bank will share my data without my permission?
No. The framework is built on explicit consent, and the customer can revoke it at any time. The EFInA guide describes the shift as moving from “data grabbing” to “data sharing,” with the customer in control.
What is embedded finance and why does it matter?
Embedded finance is the delivery of financial services inside a platform a person already uses, rather than through a bank branch. Open banking is the rail it runs on. It matters because only around 9% of Nigerian adults have access to formal credit and insurance penetration is near 0.5% of GDP, and neither figure moves by building more branches .
What are the main criticisms of the rollout?
Two. First, there are no binding rules for the AI systems that will make lending decisions on open banking data — no audit standard, no bias testing requirement, no right to an explanation. Second, the liability and dispute architecture for multi-party API failures is underdeveloped, leaving uncertainty when a breach or bad decision is contested.
Related reading on Dedon Tech: OPay vs traditional banks: who holds your deposit · wrong account transfer: the five-step recovery path · Nigerian banks and stablecoins: what happens to deposit protection · full site map
0 Comments: