Guidelines on the Operation of ATM Machines in Nigeria

The Central Bank of Nigeria (CBN) introduced its Draft Guidelines on the Operations of Automated Teller Machines (ATMs) on October 9, 2025, as the latest move in the government's broad push for financial system integrity. Following steps like commercial bank recapitalization and successful Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) measures that removed Nigeria from the Financial Action Task Force (FATF) 'grey list' (officially, Jurisdictions under Increased Monitoring), these guidelines aim to refine the regulatory environment for consumer protection and operational efficiency.

This article analyzes the specifics of the new CBN ATM guidelines, exploring service availability, transaction security, and the financial impact on consumers. For all stakeholders, from commercial banks to Independent ATM Deployers (IADs), these rules highlight the tension between profitability and compliance. We break down five critical areas below.

CBN Guidelines on the Operations of ATM

Reduced Downtime

‍Perhaps the most impactful measure for consumers is the CBN’s direct attack on machine unavailability. For too long, the sight of an "Out of Service" screen has been a routine frustration. The new rule is straightforward: ATM downtime due to a technical fault shall not exceed seventy-two (72) consecutive hours. It is buttressed by mandates requiring deployers to provide back-up power (inverter) at all locations to ensure transactions are never interrupted midway, and to maintain dedicated, functional, and constantly manned helpdesk contacts at every terminal. Furthermore, ATMs must be continually replenished with cash and, specifically, stocked with fit notes.‍

ATM Deployment Density and Coverage Requirements

‍The guidelines establish specific requirements for network expansion to enhance service coverage. To directly link ATM infrastructure with customer growth, the CBN mandates that all card issuers must maintain a ratio of at least one ATM for every 5,000 payment cards issued. This requirement includes a structured, three-year compliance timeline (30% by 2026, 60% by 2027, and 100% by 2028). Compliance will necessitate a capital expenditure review for Nigerian banks, as the mandate will require the deployment of new machines in areas beyond established high-traffic city centers, ensuring that the increase in payment cards is supported by accessible physical infrastructure.‍

Accelerated Dispute Resolution Timelines

‍The guidelines introduce revised, mandatory timelines for the resolution of failed transactions. This focus aims to reduce the duration and complexity of the reversal process for customers. The rule streamlines reversals:

• "On-Us" Failures (your card, your bank's ATM) must be instant, with a manual reversal limit of 24 hours.
• "Not-On-Us" Failures (your card, another bank's ATM) must be resolved with a refund timeline of 48 hours.

Crucially, acquirers are now mandated to implement mechanisms to immediately initiate refunds without prompting from the issuing bank or the customer. This pivotal shift forces the acquiring bank to assume responsibility for the error and correct it automatically, removing the customer from the tedious process of raising complaints.

Security Requirements and Inclusivity Provisions

‍The new framework addresses both security and accessibility, requiring both technical upgrades and revised operational procedures. On the security front, every ATM must have cameras that record activity, but with a vital safeguard: the cameras must not be capable of recording the customer’s keystrokes (PIN entry). Furthermore, the installation of anti-skimming devices is now mandatory. Deployers must also implement the "Cash out first before card is out" sequence to prevent accidental cash abandonment. The controversial "cash retract" functionality, which often complicates non-dispense errors, is now disabled on all ATMs.

Additional Security Directives

• ATM networks used for transaction transmission must be tested and proven to have data confidentiality and integrity.
• ATMs located outside buildings must be bolted to the floor and surrounded by structures to prevent removal.
• The ATM must be capable of aborting a transaction if the user blocks their image for camera capture.
• ATM keys shall be changed regularly (every year), and the same keys must not be used for multiple ATMs.

For inclusivity and accessibility, the guidelines introduce several user-experience requirements:

• At least 2% of all deployed ATMs must feature tactile graphic symbols for visually impaired customers, with their locations publicized.
• To prevent accidental card abandonment, the machine must alert the customer via message or voice to take their card.
• The Change of Personal Identification Number (PIN) functionality must be provided to customers free of charge.
• ATMs must provide a mechanism (like a prompt asking "Do you need more time?") to allow customers to extend the time needed to perform a specific step.

Enforcement, Audits, and Sanctions

‍CBN explicitly states it shall impose appropriate sanctions on all erring institutions for non-compliance with these guidelines. Enforcement is backed by a robust oversight mechanism, including:

• Periodic and Ad Hoc Monitoring and Audits: The CBN will conduct audits of ATM deployers to ensure physical and operational compliance.
• Mandatory Monthly Reporting: ATM deployers are required to forward monthly reports detailing their ATM deployment, redeployment, and decommissioning status to the CBN.

Sanctions range from mandatory monetary fines per infraction (often accruing daily or weekly until rectified) to more severe non-monetary actions, such as suspension from electronic payments or clearing operations for grave or persistent failures.

Conclusion

The CBN's new guidelines are a clear signal that operational excellence is no longer optional, it is a regulatory requirement. For financial institutions, full compliance with these standards will require significant investment in infrastructure, software upgrades, and staff training. However, the institutions that embrace this framework proactively stand to gain a competitive edge by demonstrably improving service reliability and earning greater customer trust.

‍