Payment KYC, Privacy and Compliance in Nigeria: A Buyer’s Evidence Checklist

When choosing a payment platform in Nigeria, ask what evidence supports its identity, privacy and security claims. Terms such as “KYC API”, “PCI compliant” or “NDPR compliant” describe different subjects and do not establish that your entire business arrangement is approved. Review the exact service, data flow and responsible organisations.

Wigmore Trading can assess payment integration and technology procurement enquiries and help structure a project brief. Regulated service eligibility and legal obligations should be reviewed with the responsible provider and qualified advisers for the actual operating model.

Identify each organisation’s role

Record who provides the gateway, acquiring, wallet, bank connection, identity checks and software integration. Ask which legal entity contracts with the merchant or customer and which receives or controls funds. Verify authorisation for the relevant activities using the CBN provider information and current official guidance.

A bank partnership, technical connection and reseller arrangement are not interchangeable. Request written confirmation of the proposed scope instead of inferring approval from a logo or an API demonstration.

Specify KYC and KYB outcomes

Customer verification and business verification answer different questions. Define whose identity or business details must be checked, at what stage and for what purpose. Ask what evidence the service returns, how exceptions are reviewed and who makes the final onboarding decision.

Confirm the provider’s permitted data sources and your organisation’s basis for requesting information. Avoid sending identity documents through informal channels simply because an implementation team asks for a sample.

Map personal information and responsibilities

Use the Nigeria Data Protection Act reference as a starting point for a current privacy review. Legacy searches mentioning NDPR should not replace assessment under the applicable framework. The NDPC’s 2025 annual report records implementation of GAID 2025.

Ask your advisers to review purposes, lawful basis, notices, data minimisation, retention, security, sharing and international transfers where relevant. Document the responsibilities of the parties and the process for handling rights requests or incidents.

Check card-security evidence in scope

Ask for current evidence covering the actual card-processing service and understand your own responsibilities. Outsourcing payment processing does not automatically remove a merchant’s obligations. The PCI SSC outsourcing FAQ explains the continuing need to assess provider compliance and shared responsibilities.

Have your acquirer or compliance-accepting organisation confirm the validation approach relevant to your arrangement. Avoid placing raw card data into logs, support tickets or application fields outside the approved design.

Build an evidence register

Review marketing claims before launch

A platform should describe features and evidence accurately. Do not extend a provider’s certification to unrelated services or describe all transactions as compliant merely because a gateway is integrated. Check the wording used in customer onboarding, checkout and sales material.

Agree who keeps the evidence register current and what happens when a provider, feature or operating model changes. Compliance review is tied to the real arrangement, not just an initial procurement exercise.

Include governance in implementation

Build approvals, permissions and data handling into acceptance tests. Define when a human review is required and how customers can raise an issue. Link onboarding decisions to the risk management process and technical controls to the developer handover.

Request an evidence-led project discussion

Send Wigmore Trading your business model, required payment functions, proposed providers, target users and existing documentation links. Include the advisers or compliance owners involved. The team can assess implementation and procurement scope and identify questions that need provider or specialist confirmation before a project proceeds.