The Central Bank of Nigeria (CBN) has issued new directives on the deployment, operation, maintenance, and security of Automated Teller Machines (ATMs), mandating that card issuers provide a minimum of one ATM for every 5,000 payment cards they issue.
The requirements, according to the CBN, in its Memo titled “Exposure of the Draft Guidelines on the Operations of Automated Teller Machines (ATMs) in Nigeria,” released over the weekend, will replace all earlier ATM standards.
The central bank stated that full compliance must be accomplished within three years, targeting a 100 percent by 2028, beginning with a 30 percent implementation in the first year, 2026.
It also emphasized that ATMs must be sited in places where user safety, transaction confidentiality, and overall security are ensured, noting that machines should not be installed outside buildings unless they are securely and firmly fixed in place.
CBN said, “ATM deployment, redeployment, and decommissioning require prior written approval from the CBN.
“Independent ATM Deploys (IADs) must obtain prior written approval from CBN and satisfy licensing/registration requirements, including evidence of partnership with a bank for cash provisioning.”
Addressing concerns regarding failed transactions and refunds, the directive states that for on-us ATM transactions, where customers use the ATM of their respective banks, failed transactions must be reversed immediately. If technical challenges prevent instant reversal, any manual refund must be completed within 24 hours.
For not-on-us ATM transactions, where customers use another bank’s ATM, banks are directed to process refunds within 48 hours.
Other provisions in the new directive include automatic refunds, which require acquirers to implement suitable systems that promptly trigger refunds for non-dispense errors without waiting for requests from either the issuing bank or the customer.
CBN added more directives on “Security: All ATMs must have cameras that record all persons and activities (card insertion, cash withdrawal, etc.), but should not record customers’ keystrokes. Networks used must be tested and proven for data confidentiality.
“Anti-Skimming: ATMs shall be installed with anti-skimming devices to mitigate fraud.
“PIN/Keys: ATM keys must be changed regularly (every year), and the same keys are not to be used for multiple ATMs. Customers can change their PIN free of charge.
“Standards: All ATM deployers/acquirers must comply with Payment Card Industry Data Security Standards (PCI DSS).
“ATM Operations and Maintenance Downtime: The technical downtime for an ATM shall not exceed 72 consecutive hours. Customers must be informed if this is not practicable.
“Cash Provisioning: Cash shall be made available at all ATMs at all times. The bank that entered into an agreement with a non-bank institution for deployment is solely responsible for cash provisioning.
“Information: Helpdesk contacts, charges, and fees must be adequately displayed to customers.
“Receipts: ATMs must issue receipts for all requested transactions, except for balance enquiries.
“Monitoring: CBN will conduct periodic audits and onsite checks to ensure compliance with the guidelines and availability of cash and service.
“Reporting: All institutions must render a monthly return to CBN, including new deployments, no later than the 5th of the following month.
“Penalties: Appropriate penalties shall be imposed on institutions that fail to comply.” It concluded.
