The Central Bank of Nigeria (CBN) has issued new minimum standards for the deployment, operation, maintenance, and security of Automated Teller Machines (ATMs) across the country. The directive, detailed in a circular titled “Exposure of the Draft Guidelines on the Operations of Automated Teller Machines (ATMs) in Nigeria”, supersedes previous ATM regulations.
Under the new rules, all card-issuing banks must deploy at least one ATM for every 5,000 payment cards issued. Banks are required to achieve full compliance within three years, reaching 30% coverage in the first year (2026) and 100% by 2028. ATMs must be positioned to ensure user safety, transaction confidentiality, and, where installed outdoors, secured to the floor.
The CBN also mandated that any ATM deployment, relocation, or decommissioning must receive prior written approval. Independent ATM Deployers (IADs) must obtain CBN approval, register, and partner with a bank for cash provisioning.
To improve transaction reliability, failed transactions on a bank’s own ATMs must be reversed instantly. If technical issues prevent instant reversal, the refund must be completed within 24 hours. For transactions using another bank’s ATM, refunds must not exceed 48 hours.
Additional requirements include:
- Automatic refunds for non-dispense errors without customer prompting.
- ATMs must have cameras to monitor activities while protecting customers’ keystrokes.
- Anti-skimming devices and regular key updates, with free PIN changes for customers.
- Compliance with Payment Card Industry Data Security Standards (PCI DSS).
- Maximum ATM downtime of 72 hours, with customers notified of delays.
- Continuous cash availability, with the responsible bank managing cash provisioning.
- Clear display of helpdesk contacts, charges, and fees, and issuance of receipts for all transactions except balance inquiries.
- Monthly reporting of new deployments to the CBN by the 5th of each month.
The apex bank will conduct regular audits and onsite inspections to ensure compliance. Penalties will apply to institutions that fail to meet the guidelines.
