Nigeria at 66: From AML Compliance to AML Effectiveness — Is the System Ready for the 2027 FATF Test?

Abstract

• Nigeria’s AML regime has evolved from building legal frameworks to demonstrating measurable effectiveness. As the country approaches its 2027 FATF evaluation, sustained enforcement, intelligence use and institutional capacity face scrutiny.

At 66, Nigeria’s AML regime faces a defining test: proving that strengthened laws and institutions can deliver measurable results, Paul Uviase, Kunmi Ajeigbe, Chico Nwabunor and Adedayo Adejobi, ask the critical questions confronting Nigeria’s financial-crime control system.

 As Nigeria marks 66 years of independence today, its anti-money laundering regime is entering a new phase. Having completed the action plan that led to its removal from the Financial Action Task Force’s increased-monitoring process, the country now faces a different test: whether its laws, institutions and controls can consistently produce measurable results.

 Nigeria’s anti-money laundering story has changed considerably since the country was placed under the Financial Action Task Force’s increased monitoring in February 2023.

 At the time, the challenge was framed largely around deficiencies in the country’s legal, regulatory and institutional architecture. Nigeria was required to strengthen risk-based supervision, improve access to beneficial ownership information, increase the use of financial intelligence, demonstrate more money-laundering and terrorism-financing investigations and prosecutions, improve asset recovery, and strengthen controls around high-risk sectors. Much of that work has since been completed.

 In October 2025, the FATF removed Nigeria from its list of jurisdictions under increased monitoring after an on-site assessment and a determination that Nigeria had completed its action plan. The FATF said Nigeria had made significant progress in strengthening the effectiveness of its AML/CFT regime, including improvements in financial intelligence dissemination and use, money-laundering investigations and prosecutions, beneficial ownership information, risk-based supervision and asset recovery.

 The achievement matters. But it also changes the question confronting Nigeria’s financial-crime control system.

 The issue ahead is less about whether Nigeria has AML/CFT laws and more about whether the system can demonstrate, consistently and with credible evidence, that those laws and controls are working.

 That distinction is particularly important as the country prepares for its 2027 FATF mutual evaluation.

 From legislation to results….

 The FATF has long distinguished between technical compliance and effectiveness.

 Technical compliance asks whether the required laws, regulations, institutions and procedures exist. Effectiveness asks whether those arrangements actually deliver the outcomes they are supposed to deliver.

 The FATF identifies 11 immediate outcomes against which the effectiveness of an AML/CFT system is assessed. These include understanding and mitigating risk, international cooperation, supervision, preventive measures, financial intelligence, money-laundering investigations and prosecutions, confiscation, terrorism-financing investigations, and the prevention of terrorist financing. The distinction was significant in Nigeria’s 2021 mutual evaluation.

 Although subsequent follow-up exercises recorded considerable improvements in technical compliance, Nigeria remained in enhanced follow-up because of its effectiveness ratings. The FATF’s country assessment recorded low effectiveness ratings for nine of the 11 immediate outcomes and moderate ratings for two.

 Those ratings relate to the period assessed under the previous evaluation framework and should not be treated as a current scorecard of Nigeria’s AML regime. They do, however, explain why the country’s next evaluation is so important.

 Nigeria’s reform programme since 2023 was therefore not simply about writing new rules. It was also about generating evidence that institutions could identify financial crime, produce useful intelligence, investigate cases, prosecute offenders and recover criminal proceeds.

 The FATF itself identified those outcomes in its 2025 assessment of Nigeria’s action plan. Among the requirements it cited were increased dissemination and use of financial intelligence, sustained increases in money-laundering investigations and prosecutions, better asset-recovery data and increased investigations and prosecutions of terrorism-financing activities.

 The intelligence question: what happens after an STR?

 For compliance professionals, perhaps the most important link in the chain is the journey from a suspicious transaction report to an investigative or enforcement outcome.

 Nigeria has built a substantial reporting infrastructure. The Nigeria Financial Intelligence Unit receives suspicious transaction reports from financial institutions and designated non-financial businesses and professions, analyses them and disseminates resulting intelligence to law-enforcement, security, regulatory and other competent authorities. The scale of reporting is considerable.

 According to reporting on the NFIU’s 2025 Annual Report, the agency received 42,082 suspicious transaction reports, 10,513 suspicious activity reports and more than 41.7 million currency transaction reports during the year. Deposit money banks accounted for 38,715 of the STRs, or about 92 per cent of the total.

 The same report indicates that the NFIU disseminated 3,431 domestic intelligence reports in 2025, comprising 1,398 proactive and 2,033 reactive reports. Tax crimes accounted for 30 per cent of intelligence reports within the top ten designated offences, followed by fraud at 21 per cent and money laundering at 15 per cent.

 These numbers demonstrate activity. But activity is not necessarily effectiveness.

 A high volume of STRs does not, by itself, demonstrate that illicit finance is being disrupted. Equally, a fall in STRs does not automatically demonstrate deterioration. Changes in reporting quality, filtering, regulatory expectations, transaction-monitoring systems or institutional behaviour can affect volumes.

 Indeed, the 2025 figures contain an interesting contrast. STRs reportedly fell from 82,143 in 2024 to 42,082 in 2025, while currency transaction reports rose from about 25.8 million to 41.7 million.

 The more consequential question is therefore what happened after the reports were filed.

 How many intelligence reports generated new investigations? How many led to arrests, charges or prosecutions? How many resulted in the identification of previously unknown criminal networks? How much criminal property was frozen, seized or ultimately confiscated? And how often did financial intelligence alter the direction or outcome of an investigation? Those are the kinds of questions that turn compliance reporting into effectiveness measurement.

Nigeria has moved the needle, but the next test is sustainability….

 The FATF’s October 2025 decision provides evidence that Nigeria made progress against precisely these questions.

 The FATF said Nigeria demonstrated an increase in financial-intelligence dissemination and its use by law-enforcement agencies. It also recognised a sustained increase in money-laundering investigations and prosecutions, alongside improvements in asset-related data and terrorism-financing investigations.

 That is important because the country’s 2023 action plan explicitly required evidence of improvement rather than merely new legislation.

 Nigeria also improved its technical ratings during the follow-up process. By the 2024 follow-up report, 36 of the FATF Recommendations were rated compliant or largely compliant, while four recommendations concerning beneficial ownership, DNFBP supervision and cash couriers were upgraded from partially compliant to largely compliant.

 But the FATF’s October 2025 decision came with an important qualification: Nigeria must continue working with GIABA to sustain its improvements.

 That word, sustain, is central to the next phase.

 An AML system cannot demonstrate effectiveness through a single burst of enforcement activity. It needs to show that institutions routinely identify risk, produce useful intelligence, investigate the right cases, prosecute them appropriately and recover criminal proceeds over time.

 The DNFBP challenge….

 One of the areas worth watching before 2027 is the Nigeria’s designated non-financial businesses and professions sector.

 Banks have traditionally been the most visible source of suspicious transaction reporting. But lawyers, accountants, real-estate professionals, casinos, dealers in precious metals and stones and other DNFBPs can sit at critical points in the movement, conversion or concealment of illicit proceeds.

 The NFIU’s 2025 reporting data illustrate the imbalance. DNFBPs accounted for 1,029 STRs, compared with 38,715 from deposit money banks.

 That disparity cannot by itself establish under-reporting. Different sectors have different transaction volumes, risk profiles and reporting obligations. Nevertheless, it makes DNFBP supervision an important area for the effectiveness test.

 The EFCC’s Special Control Unit Against Money Laundering has acknowledged the sector’s vulnerability. In July 2025, EFCC Chairman Ola Olukoyede described DNFBPs as among the sectors identified through the National Risk Assessment as vulnerable to money laundering and terrorism-financing risks.

 Regulatory infrastructure is also evolving. The 2024 SCUML regulations contain administrative sanctions for DNFBP compliance failures, while from January 2026 SCUML moved specified reporting by DNFBPs to its electronic portal rather than accepting CTR and CBTR submissions by email.

 The effectiveness question is now whether those controls produce better risk detection, higher-quality reporting and stronger enforcement outcomes.

Supervision: from checking files to testing controls….

 The same issue applies to financial-sector supervision. A compliance programme can look complete on paper while failing to identify the actual risks confronting an institution.

 Nigeria’s regulators appear to be moving towards more practical testing.

 In April 2025, the Central Bank of Nigeria announced that it would introduce mystery-shopping exercises for licensed bureau de change operators as a complement to routine examinations, targeted examinations and spot checks. The exercise was intended to test practical implementation of customer identification, KYC and suspicious-transaction reporting requirements. The CBN warned that breaches could result in monetary penalties or licence revocation.

 The Securities and Exchange Commission has likewise strengthened its risk-based approach. Its 2024 enterprise-risk directive requires capital-market operators to maintain risk-management frameworks and to assess emerging vulnerabilities, new technologies, beneficial ownership changes and new financial-crime typologies.

 These developments point towards a broader understanding of supervision: not simply asking whether a policy exists, but testing whether it operates effectively. That distinction will matter for compliance officers preparing for 2027.

Are Sanctions changing behaviour?

 Another measure of effectiveness is enforcement. A regulatory framework can contain extensive sanctions, but the existence of penalties is different from their practical use.

 Nigeria now has formal AML/CFT sanctioning mechanisms across multiple sectors. The SCUML regulations, for example, provide administrative penalties for DNFBP breaches. SEC rules similarly provide for regulatory sanctions, while recent SEC directives have required capital-market operators to freeze designated assets, report suspicious transactions and comply with targeted financial sanctions.

 The more difficult question is whether enforcement is sufficiently risk-based, timely, proportionate and dissuasive.

 This does not necessarily mean imposing the largest possible penalties. An effective supervisory regime should be capable of distinguishing between administrative deficiencies, repeated control failures and conduct that materially exposes the financial system to illicit-finance risk.

 For institutions, the message is that AML/CFT enforcement should increasingly be viewed as a test of the control environment rather than merely a regulatory cost.

The 2026 National Risk Assessment…..

 The National Risk Assessment is likely to be one of the most important pieces of evidence feeding the next phase.

 The NFIU says the 2026 assessment covers the 2022–2025 period and brings together approximately 55 public-sector agencies and private-sector participants including banks, virtual asset service providers, lawyers, accountants and real-estate professionals. The exercise is using the World Bank’s ML/TF Risk Assessment Toolkit and RUSI methodology for proliferation-financing risks, with thematic work covering areas such as legal persons, virtual assets, and environmental and natural resources.

 That scope reflects an important change in the financial-crime environment.

 Nigeria’s risk landscape is no longer limited to conventional banking transactions. Virtual assets, digital fraud, complex corporate structures, environmental crimes, cross-border flows and new payment channels all create different compliance challenges.

 For the 2027 evaluation, the value of the NRA will therefore depend not only on identifying risks but on whether the findings change resource allocation, supervisory priorities and investigative activity.

 A risk assessment that sits on a shelf is a compliance document. A risk assessment that changes how institutions and government agencies deploy resources becomes a risk-management tool.

What should compliance officers be doing differently?

 For compliance teams, the coming period may require a shift away from measuring success principally through the number of policies, training sessions, alerts or STRs generated. The more useful question is whether the entire control chain works.

 That means knowing the institution’s highest-risk products, customers, channels and geographies; testing whether transaction-monitoring scenarios actually detect those risks; documenting why alerts are closed or escalated; strengthening beneficial-ownership verification; and ensuring that suspicious-transaction reports contain meaningful intelligence rather than simply meeting a reporting requirement.

 It also means preparing to demonstrate outcomes.

 A compliance officer should be able to explain which financial-crime risks are most material to the institution, how those risks have changed, which monitoring controls detect them, why alerts are escalated or closed, what makes an STR useful to the NFIU, how quickly the institution can respond to law-enforcement requests, how beneficial-ownership risks are managed and what evidence demonstrates that senior management and the board understand the institution’s AML/CFT exposure.

 These are not merely questions for an eventual FATF assessor. They are questions of day-to-day control effectiveness.

Independence at 66: a different measure of financial integrity

 Nigeria’s 66th Independence anniversary therefore arrives at an interesting point in the country’s AML journey.

Nigeria has moved through one significant milestone: it entered increased monitoring, implemented an action plan, underwent an on-site assessment and exited that process in October 2025.

 The next milestone is harder to measure. Can Nigeria maintain the institutional capacity that produced those reforms? Can financial intelligence consistently move from reporting entities to analysts, investigators, prosecutors and courts? Can supervisors demonstrate that sanctions and remedial measures change behaviour?

 Can the country show that criminal proceeds are not merely identified but frozen, seized and ultimately confiscated? Can high-risk sectors outside traditional banking demonstrate the same level of compliance maturity? And can the system produce credible evidence that its resources are being directed towards the risks identified in its national assessments?

 The FATF’s new evaluation approach makes those questions increasingly consequential. In October 2025, the organisation said the new round of mutual evaluations places greater emphasis on countries’ results in tackling money laundering, terrorist financing and proliferation financing. The first assessments under the new round were described as more time-bound and risk-based.

 That makes the period between Nigeria’s exit from increased monitoring and the 2027 evaluation more than a gap between assessments.

 It is a test of whether reforms have become institutionalised.

 For Nigeria’s compliance community, the practical implication is straightforward: the strongest AML programme may no longer be the one with the thickest policy manual or the largest number of alerts.

 It may be the one that can demonstrate, with evidence, that a suspicious transaction was identified for a reason, that the intelligence was useful, that the right authority acted on it, that the proceeds were pursued and that the outcome reduced the risk of the financial system being abused again.

 At 66, Nigeria’s AML journey is therefore entering a new chapter.

 The first question was whether the country could build the framework. The next is whether the framework can consistently deliver results.

 And by the time the 2027 evaluation arrives, it will be the evidence of those results, rather than the existence of the rules alone,  that will tell the more complete story of Nigeria’s financial-crime defences.