CBN Updates Payment Service Provider Licensing Requirements for 2026

The Central Bank of Nigeria has published updated licensing guidelines for Payment Service Providers, tightening several requirements that had previously been loosely enforced. The changes affect any PSP processing transactions on behalf of Nigerian merchants, including those serving high-risk categories like forex trading and betting operators.

The headline change is a stricter minimum capital requirement for PSPs handling merchant settlement directly, rather than routing through a licensed switch. Providers that previously operated on a lighter registration tier now need to either recapitalize or restructure their settlement flow through a fully licensed partner bank. For merchants, this mostly matters as a diligence question: any PSP you're evaluating should be able to show which tier they hold and how it affects your settlement path.

BVN verification requirements have also been extended. Where previously BVN checks applied primarily to individual account holders, the update now requires PSPs to verify BVN data for the beneficial owners of corporate merchant accounts above a certain transaction volume threshold. This is squarely aimed at reducing shell-company fraud, but it does mean onboarding documentation requirements for larger merchants have grown.

For licensed forex brokers and regulated betting operators specifically, the CBN has clarified that PSPs may continue processing on their behalf provided the merchant holds valid, current licensing from the relevant regulator (SEC for forex, National Lottery Regulatory Commission or state equivalents for betting) — this closes some ambiguity that had made a few PSPs unnecessarily conservative about onboarding regulated high-risk merchants.

Merchants currently processing through Nigerian PSPs should expect a documentation refresh request over the coming quarter as providers bring their compliance files in line with the new requirements. It's worth getting ahead of this rather than waiting for the request — providers who can show clean compliance are generally the first to get exceptions when edge cases come up later.