CBN Introduces New ATM Deployment Ratio, Tightens Operations and Security Rules

The Central Bank of Nigeria (CBN) has unveiled new minimum standards governing the deployment, operations, maintenance, and security of Automated Teller Machines (ATMs) across the country.

The apex bank announced the changes in a circular titled “Exposure of the Draft Guidelines on the Operations of Automated Teller Machines (ATMs) in Nigeria,” released on Tuesday, noting that the new framework supersedes all previous ATM regulations.

Under the revised guidelines, card-issuing institutions are now required to deploy a minimum of one ATM for every 5,000 payment cards issued. The CBN directed that full compliance must be achieved within three years, with 30 per cent implementation in 2026 and 100 per cent by 2028.

The bank also stressed that ATMs must be installed in locations that ensure user safety, transaction confidentiality, and adequate security. Machines should not be placed outside buildings unless they are securely bolted to the floor.

According to the CBN, ATM deployment, redeployment, or decommissioning will now require prior written approval from the regulator. Independent ATM Deployers (IADs) are also required to obtain CBN approval and meet licensing and registration requirements, including proof of partnership with a bank for cash provisioning.

On failed transactions and refunds, the CBN directed that on-us ATM transactions—where customers use their bank’s own ATMs—must be reversed instantly. Where instant reversal is not possible due to technical issues, manual reversals must not exceed 24 hours.

For not-on-us transactions, involving the use of another bank’s ATM, refunds must be completed within 48 hours.

The guidelines further mandate automatic refunds, stating that acquirers must immediately initiate reversals for non-dispense errors without waiting for customer complaints or issuer intervention.

On security, the CBN ordered that all ATMs must be fitted with surveillance cameras to record activities such as card insertion and cash withdrawal, but without capturing customers’ keystrokes. Networks used must also be tested and proven to ensure data confidentiality.

To combat fraud, the regulator directed that anti-skimming devices must be installed on all ATMs. ATM keys are to be changed annually and must not be used across multiple machines. Customers, meanwhile, are allowed to change their PINs free of charge.

All ATM deployers and acquirers are also required to comply with Payment Card Industry Data Security Standards (PCI DSS).

On operations and maintenance, the CBN stated that ATM downtime must not exceed 72 consecutive hours, and customers must be informed where this is unavoidable. Banks are also required to ensure constant cash availability at all ATMs, with the partnering bank bearing full responsibility for cash provisioning in non-bank deployments.

ATMs must display helpdesk contacts, applicable charges, and fees clearly, while receipts must be issued for all transactions except balance enquiries.

In terms of compliance, the CBN said it would conduct periodic audits and onsite checks to monitor adherence to the guidelines. Institutions are also required to submit monthly returns on new ATM deployments to the CBN no later than the 5th day of the following month.

The apex bank warned that appropriate penalties will be imposed on institutions that fail to comply with the new standards.

Opinion Nigeria News