A customer opens an account on your neobank app in minutes. They verify their identity, receive their account number, and make their first transfer.

A few weeks later, they need higher transaction limits. Your app asks them to submit information they've already provided, complete another identity check, and wait for verification without knowing how long it will take. The customer wants to upgrade. Your onboarding process is making it difficult.

This is one of the challenges tiered KYC is supposed to solve. Neobanks can offer different levels of account access without requiring every customer to complete the most extensive identity checks from day one.

But implementing Tier 1, 2 and 3 accounts involves more than dividing a registration form into three stages. Nigerian neobanks must follow the Central Bank of Nigeria's (CBN) identification requirements, manage account restrictions, handle failed verification and account for changes introduced in 2026.

This guide explains what each tier requires, how the latest rules affect onboarding and how to build verification journeys that allow customers to move between account levels.

What Are Tier 1, 2 and 3 Accounts in Nigeria?

The CBN introduced its three-tiered KYC framework in January 2013 to make financial services more accessible while maintaining identification requirements.

The framework allows customers to access different account capabilities based on the information collected and verified during onboarding. Tier 1 provides a simpler entry point for basic accounts. Tiers 2 and 3 require additional verification and support higher account capabilities.

The identification requirements were strengthened in December 2023, when the CBN made a BVN or NIN mandatory for all individual Tier 1 accounts and wallets, and restated that Tier 2 and Tier 3 accounts must have both.

These requirements come from the CBN's December 1, 2023 circular.

The circular also requires financial institutions to begin onboarding by electronically retrieving identity information from the relevant NIBSS BVN or NIMC NIN database. This information becomes the primary identity record used to onboard the customer.

Dojah previously covered these requirements in its article on Nigeria's BVN and NIN linkage rules.

What About Transaction and Balance Limits?

Tiered accounts also have restrictions on transactions and cumulative balances. A Tier 1 account cannot simply be given the same operating limits as a fully verified Tier 3 account.

The original CBN framework established limits for each tier, while subsequent instruments have addressed limits for specific account and wallet products.

Because these ceilings can depend on the product, institution type and later regulatory changes, this guide focuses on verification rather than presenting a single limits table that might not apply to every neobank.

Before configuring transaction ceilings, compliance teams should reconcile the CBN's tiered KYC framework, subsequent circulars and the limits attached to their institution's licensed products.

The system should enforce those limits automatically and prevent customers from accessing higher-tier capabilities before completing the required verification.

Tier 1: Make Account Opening Simple Without Skipping Identity Checks

Tier 1 is designed to provide access to basic financial services with fewer onboarding requirements. But a simpler onboarding process is not permission to create accounts using unverified customer details.

Under the CBN's December 2023 circular, every new individual Tier 1 account or wallet must be linked to a BVN or NIN.

The institution must retrieve the customer's identity information electronically from the relevant official database instead of creating a profile first and attaching an identifier afterwards.

How a Tier 1 Verification Flow Should Work

A practical Tier 1 onboarding journey would look like this:

1. Collect an identifier. The customer enters their BVN or NIN.
2. Retrieve identity details. The institution obtains the customer's information through the authorised verification process.
3. Check for inconsistencies. Compare the retrieved details with the information supplied during registration.
4. Complete onboarding checks. Verify contact information and complete other required checks.
5. Activate the account. Apply the institution's approved Tier 1 limits once onboarding requirements have been satisfied.

The customer should not have to enter the same information repeatedly when it has already been retrieved and verified.

What Happens When BVN or NIN Details Don't Match?

Suppose a customer enters a name that differs from the name associated with their BVN. The identifier may be genuine, but the discrepancy still needs to be resolved.

The guidance accompanying the CBN's December 2023 circular requires onboarding to stop when information retrieved from the BVN or NIN database is inconsistent with the prospective customer's information.

The customer may need to follow the established process for correcting their official record before proceeding.

Your application should distinguish between an identity mismatch, an invalid identifier and a temporary verification service failure. These issues require different responses.

A technical timeout should not automatically be treated as identity fraud. Equally, an unresolved identity mismatch should not be treated as a successful verification.

Tier 2: Verify the Missing Identity Information Before Upgrading

Tier 2 requires both BVN and NIN. For customers who opened a Tier 1 account using one identifier, the upgrade journey should collect and verify the other.

Consider a customer who registered with their BVN. When they request Tier 2 access, your app already has a record of their verified BVN information.

The next step is to obtain their NIN, validate it and complete the remaining Tier 2 requirements. Restarting the entire account opening process would create unnecessary friction.

How a Tier 2 Upgrade Should Work

The process should:

1. Retrieve the customer's existing verification status.
2. Identify the information missing for Tier 2.
3. Collect and verify the outstanding BVN or NIN.
4. Resolve inconsistencies between identity records.
5. Complete the other checks required for the account.
6. Upgrade the account only after verification succeeds.

The goal is to collect what's missing, not everything again.

Does Tier 2 Require Selfie and Liveness Verification?

The CBN's December 2023 BVN/NIN circular does not introduce a blanket liveness requirement for every Tier 2 account. However, neobanks can use facial verification and liveness checks to strengthen remote onboarding and reduce impersonation risks.

For example, an identity number might be valid, but the neobank may need additional assurance that the person requesting an upgrade is the legitimate identity holder.

A selfie compared with trusted identity information, combined with liveness detection, can provide that additional assurance.

The institution's risk assessment and onboarding policy determine when to use these additional checks, alongside any other regulatory obligations.

BVN/NIN verification establishes identity information, while biometrics can help establish whether the person presenting that identity is its legitimate holder.

Tier 3: Complete Address and Higher-Level Identity Verification

Tier 3 involves more extensive customer verification before the account receives higher operating capabilities.

For individual customers, BVN and NIN remain mandatory. The institution must also complete the remaining customer identification and documentation requirements for the tier.

Address verification is one area that can create friction.

A customer may have supplied a residential address during registration, but entering an address does not establish that the customer lives there.

How to Handle Address Verification

A neobank can structure the process around four stages:

• Collect: Obtain the customer's full residential address.
• Validate: Check that the address information is complete and usable.
• Verify: Use an accepted verification method to establish the customer's connection to the address.
• Record: Save the outcome and any outstanding issues for review.

Verification methods may include supporting documents, digital location checks or physical verification.

For example, a customer applying for Tier 3 access might be asked to confirm the location of their residence through a digital address verification process.

Where digital verification cannot establish the required assurance, the institution can use another accepted method.

What Happens When Address Verification Fails?

Not every unsuccessful address check is evidence of fraud. The customer might have entered an incomplete address, moved recently, supplied an outdated document or experienced a device-location problem.

A useful upgrade flow should explain what needs correction and give the customer a clear next step.

If further review is necessary, the app should display a pending status rather than restarting the application.

The account should remain within its existing approved limits until the requirements for Tier 3 are met.

What Changed in Nigeria's BVN Rules in 2026?

The CBN amended its BVN operations and watch-list framework through a circular dated March 12, 2026.

The changes took effect on May 1, 2026, introducing four requirements that neobanks need to consider when designing identity verification, account recovery and fraud management processes.

1. BVN Enrolment Is Restricted to Adults

Individuals must be at least 18 years old to enrol for a BVN.

This matters for neobanks offering accounts to younger customers.

The Tier 1 framework permits BVN or NIN identification, but a person under 18 can no longer be directed to enrol for a new BVN.

Neobanks serving minors therefore need an age-appropriate onboarding process that reflects their product eligibility rules and regulatory obligations.

The amendment restricts new BVN enrolment. It does not, by itself, establish that minors are prohibited from holding every type of account.

Institutions should establish how existing BVNs held by minors and NIN-based onboarding are treated before configuring these journeys.

2. BVN-Linked Phone Numbers Can Be Changed Only Once

Under the amended framework, a phone number linked to a BVN can be amended only once.

This affects account recovery and customer information updates.

A customer changing the contact number in a neobank's app is not necessarily changing the phone number in the BVN database. The two records serve different purposes.

For example, if a customer loses access to their registered mobile number, the neobank should have a secure recovery process that does not depend on repeatedly changing the BVN-linked phone number.

That process may involve additional identity authentication, fraud checks and approved procedures for updating account contact details.

3. Suspicious Transactions Can Trigger Temporary BVN Watch-Listing

The 2026 amendment requires financial institutions to maintain a temporary watch-list for BVNs implicated in suspected fraudulent transactions reported by a financial institution.

A BVN may remain on that temporary watch-list for a maximum of 24 hours while the owner is contacted for clarification.

This introduces another reason for neobanks to connect identity records with their fraud investigation processes.

A customer may have completed all onboarding checks successfully, but suspicious activity detected later can require additional investigation.

A temporary watch-list entry is not proof that the customer has committed fraud. The institution must follow the framework's requirements for clarification, escalation, and subsequent handling.

4. BVN Database Access Remains Restricted

The amendment limits BVN database access to CBN-licensed financial institutions, while allowing the CBN discretion to approve access in exceptional circumstances under existing law.

For neobanks using third-party identity verification providers, this creates an important due diligence question.

How is the provider authorised to access or process the BVN-related information used in your verification process?

Before selecting a provider, institutions should establish the legal basis for the service, the authorised access arrangements and how customer information is protected.

Using a verification provider does not transfer the institution's regulatory responsibility to that provider.

Together, these four changes mean tiered identity verification cannot be designed independently of customer eligibility, account recovery, fraud controls and identity-data governance.

Account Tiers and Customer Risk Ratings Are Not the Same Thing

A Tier 1 customer is not automatically low risk. A Tier 3 customer is not automatically high risk.

Account tiers determine what a customer must verify to access certain account capabilities. Customer risk ratings determine how much financial crime scrutiny the customer requires.

The two should work together, but they answer different questions.

Consider a customer opening a Tier 1 wallet who produces a potential sanctions match.

The account may have low transaction limits, but those limits do not remove the institution's obligation to investigate the match.

Likewise, a Tier 3 customer with consistent account activity and no significant risk indicators does not automatically require enhanced due diligence simply because the account has higher limits.

The CBN Customer Due Diligence Regulations 2023 require financial institutions to assess customer risk and apply risk-based due diligence and ongoing monitoring.

This means screening for politically exposed persons (PEPs), sanctions exposure and other financial crime indicators should not begin only when a customer reaches Tier 3.

A customer may require investigation at any account level.

The 2026 temporary BVN watch-list provisions reinforce this distinction. Identity verification confirms information at onboarding; fraud and compliance monitoring must continue afterwards.

For more on risk-based checks, see our guide to customer due diligence requirements for African fintechs.

What the CBN's 2026 Automated AML Standards Mean for Neobanks

On March 10, 2026, the CBN issued its Baseline Standards for Automated AML/CFT/CPF Solutions.

These standards strengthen expectations for technology-supported financial crime controls across CBN-regulated institutions.

They cover customer due diligence, sanctions and PEP screening, customer risk assessment, transaction monitoring, case management, reporting, governance and related controls.

The standards introduce different full-compliance timelines:

Financial institutions were also required to submit implementation roadmaps by June 10, 2026, following the CBN's implementation guidance.

For neobanks, the applicable timeline depends on the institution's regulatory classification and licence.

The important point is that AML compliance extends beyond verifying a customer's BVN or NIN.

A Tier 1 customer who passes onboarding checks may later show transaction patterns that require investigation. A Tier 3 customer may develop new PEP or sanctions exposure after the account is opened.

Neobanks therefore need systems that can identify changes in customer risk, support investigations and maintain records of compliance decisions.

The CBN's March 2026 implementation guidance also makes clear that compliance is assessed at the financial institution level. Having an AML software provider does not automatically establish compliance with the standards.

The institution remains accountable for its control environment, governance, and operational effectiveness.

How to Make Tier Upgrades Easier Without Weakening Verification

Customers generally request an account upgrade because their current limits no longer meet their needs.

They may want to receive a larger payment, hold a higher balance or access additional account functionality.

At that point, the customer already has a reason to complete the next verification step. The neobank's responsibility is to make that step clear.

Reuse Information That Has Already Been Verified

If a customer completed BVN verification during Tier 1 onboarding, the upgrade process should recognise that result.

The application can then identify the additional information required for Tier 2 or Tier 3.

Previously verified information may need updating or revalidation when circumstances change, but customers should not be asked to repeat checks unnecessarily.

Tell Customers What They Need and Why

Generic instructions such as "Complete your KYC" do not explain what is missing.

A more useful message would be:

"Verify your NIN to continue your Tier 2 upgrade."

For a higher tier:

"Complete your address verification to finish your Tier 3 application."

These messages explain the required action and connect it directly to the customer's goal.

Make Verification Status Visible

Some checks are completed immediately. Others may require further investigation or document review.

Customers should be able to see whether their application is awaiting information, being verified, under review, or completed.

If an address check is pending, the customer should not have to restart the entire upgrade journey to find out what happened.

Keep Tier Activation Separate From Document Submission

Uploading a document does not mean that the document has been verified.

Likewise, submitting an NIN does not mean the information has passed validation.

Account limits should change only after the checks and approvals required for the new tier have been completed.

A Practical Account Upgrade Journey

Tier 1: Verify BVN or NIN

Open an eligible basic account after the required onboarding checks.

Tier 2: Verify the additional identity identifier

Retrieve existing verified information, collect the missing BVN or NIN, and complete the remaining Tier 2 checks.

Tier 3: Complete higher-tier verification

Verify the required address information, documentation, and other outstanding checks before increasing account capabilities.

Each stage builds on the previous one rather than forcing the customer to begin again.

Common Problems That Break Tiered KYC Workflows

Even when a neobank has access to the necessary verification tools, poor implementation can create unnecessary friction and compliance gaps.

Neobanks should also examine where customers abandon the verification journey.

If customers repeatedly fail NIN verification, the issue might be inconsistent identity records, confusing instructions, or inadequate support for resolving mismatches.

If Tier 3 upgrades regularly remain pending, the institution should examine its address verification and review process.

The objective is to remove unnecessary friction without removing controls that protect the institution and its customers.

How Dojah Supports Tiered Identity Verification for Neobanks

A tiered KYC process involves several verification activities, from government identity checks to biometrics and address confirmation.

Dojah provides onboarding and identity verification capabilities that can support these activities while allowing neobanks to define the checks required for different customer journeys.

Configure Verification Flows With EasyOnboard

Dojah EasyOnboard is a no-code onboarding tool that allows businesses to create custom verification flows or use pre-built templates.

For neobanks, this means teams can design verification journeys around the customer information needed at different stages of onboarding.

For example, a business can configure a flow that collects identity information and performs selected verification checks before the customer proceeds.

More extensive verification can be introduced through a separate flow when additional information is needed.

EasyOnboard supports the verification journey. The neobank remains responsible for its account-tier logic, regulatory requirements, and decisions about when a customer qualifies for an upgrade.

Verify Government Identity Information

Dojah offers government identity verification services, including BVN- and NIN-related verification capabilities.

These services can support identity checks used during customer onboarding.

However, the CBN's March 2026 amendment places restrictions on BVN database access.

Institutions should confirm that the services they use operate through authorised arrangements and comply with the applicable access and data protection requirements.

The availability of a verification service does not, by itself, establish the institution's regulatory compliance.

Add Biometric Verification When Stronger Assurance Is Needed

Dojah's biometric verification capabilities include facial comparison and liveness checks.

These can help businesses establish whether the person presenting an identity is physically present and matches the reference information used for verification.

For neobanks, biometrics may be useful during remote onboarding, identity verification or sensitive customer actions.

They provide additional protection against impersonation but do not replace BVN, NIN, or other identification requirements.

Support Address Verification

Dojah's address verification tools support digital address capture and location-based verification.

The service can compare a customer's submitted address with their location to produce an address-matching result.

This can help neobanks collect more accurate address information and reduce the friction associated with manually entering or validating addresses.

Where a physical visit is necessary, the institution should confirm the supported verification method and operational arrangements before incorporating it into the account upgrade process.

Re-Authenticate Existing Customers

Dojah's Easy Authentication capability supports re-authentication using a liveness record established during a correctly configured onboarding journey.

For neobanks, this can provide additional assurance when an existing customer performs a sensitive action.

For example, a business may require a fresh biometric authentication check before allowing certain account changes.

This is separate from completing the KYC requirements for a higher account tier.

Re-authentication helps establish who is acting; tier verification determines whether the customer has satisfied the requirements for expanded account access.

Screen Customers for Financial Crime Risks

Dojah's AML screening capabilities support checks against sanctions, PEP, and adverse media sources.

These checks can help neobanks identify potential matches requiring compliance review, regardless of the customer's account tier.

Screening is one part of the wider financial crime control environment. Transaction monitoring, investigation, regulatory reporting and governance remain necessary.

Dojah's tools can support individual parts of that process, but the institution is responsible for ensuring its overall controls meet the CBN's requirements.

Build Account Tiers Customers Can Move Through

A tiered KYC framework should make account opening accessible while ensuring customers complete the checks needed for the services they use.

For Nigerian neobanks, that starts with the CBN's identification requirements: BVN or NIN for Tier 1, both identifiers for Tiers 2 and 3, and the additional verification required for higher account access.

The 2026 BVN amendments introduce new considerations for age eligibility, account recovery, fraud watch-list procedures and identity-data access. The automated AML standards also reinforce the need to manage financial crime risk throughout the customer relationship.

But customers should not have to understand every regulatory requirement to complete an account upgrade.

They should know what information is missing, why it is needed, and what happens next.

Make verification a clear path to greater account access, not another obstacle.

Explore Dojah EasyOnboard to see how configurable verification flows can support your neobank's onboarding and account upgrade processes.

Frequently Asked Questions

• What Are Tier 1, 2 and 3 Accounts in Nigeria?

They are account levels under the CBN's tiered KYC framework. Each tier has identification requirements and operating restrictions, with more extensive verification required for higher-tier accounts.

• Is BVN or NIN Required for a Tier 1 Account?

Yes. Individual Tier 1 accounts and wallets must have a BVN or NIN under the CBN's December 2023 circular.

The institution must electronically retrieve the customer's underlying information from the relevant official database during onboarding.

• Do Tier 2 and Tier 3 Accounts Require Both BVN and NIN?

Yes. Both identifiers are mandatory for individual Tier 2 and Tier 3 accounts and wallets.

Customers must also complete the other verification and documentation requirements for their account tier.

• Can Someone Under 18 Enrol for a BVN in Nigeria?

No. Since May 1, 2026, new BVN enrolment has been limited to individuals aged 18 and above.

The restriction does not automatically prohibit every type of account for minors. Institutions offering such products must establish the eligibility and identification requirements that apply to them.

• Can a Customer Change Their BVN-Linked Phone Number More Than Once?

The March 2026 amendment permits only one change to the phone number linked to a BVN.

Updating a neobank's own account contact information is a separate process, subject to the institution's authentication and security procedures.

• Does Tier 2 KYC Require Facial Verification?

The CBN's December 2023 BVN/NIN circular does not impose a blanket liveness requirement for Tier 2 accounts.

Neobanks may introduce facial comparison and liveness checks to strengthen identity assurance and reduce impersonation risks.

• Is Address Verification Required for Tier 3?

Tier 3 involves more extensive customer identification and documentation requirements, including address-related checks under the governing KYC rules.

The verification method must satisfy the requirements applicable to the institution and its account product.

• Is AML Screening Only Required for Tier 3 Customers?

No. AML and sanctions obligations depend on regulatory requirements and financial crime risk, not simply account tiers.

A Tier 1 customer can still require investigation or enhanced due diligence if significant risk indicators emerge.

• What Changed in Nigeria's AML Requirements in 2026?

In March 2026, the CBN introduced baseline standards for automated AML/CFT/CPF solutions.

The standards cover customer due diligence, screening, risk assessment, transaction monitoring, investigation, reporting, and governance. They establish implementation requirements and full-compliance deadlines for regulated institutions.

• Can Neobanks Automate Tiered KYC?

Yes. Government identity checks, biometrics, address verification and parts of the upgrade process can be automated.

The institution must still manage exceptions, enforce account limits, assess customer risk and complete necessary compliance reviews.