Open banking can be a safer way to share financial information in Nigeria when it uses legitimate, customer-authorised APIs, strong authentication and effective privacy controls—but it is not automatically safe simply because an app says “open banking”. Under the Central Bank of Nigeria's (CBN) rules, an eligible service should explain what it wants to access, why, how often and for how long. You should be able to refuse or withdraw that permission.
This matters when a budgeting app, lender or business-accounting service asks to connect to your bank. Done properly, the arrangement can avoid handing a third party your banking password. Done badly, it could expose transaction histories, invite phishing, encourage excessive data collection or create an unclear path for complaints.
Nigeria issued open banking operational guidelines in March 2023. The wider national rollout, however, should not be treated as universally live: the expected August 2025 launch was missed, and the official and industry sources examined for this article did not confirm a nationwide go-live by 3 November 2026. Some private bank integrations and controlled regulatory tests exist separately. This guide explains the rights and safety standards, rather than claiming every Nigerian app already follows a single active national system.
How can open banking be safer than sharing your bank password?
Traditional third-party connections sometimes depend on manually uploading bank statements or letting software access information using customer credentials. A properly designed open banking connection instead allows an eligible application—called an API consumer—to request a limited service or dataset from an API provider, such as a participating bank. The customer authenticates and authorises the request under the applicable rules.
Consider an illustrative budgeting app that asks to read transactions from your current account for three months. If the permitted integration is available, the bank could verify your permission and return the allowed information through a secure application programming interface (API). The app would not need unrestricted control over your entire internet-banking session.
That does not mean a connection is harmless. An application that receives transaction data can still store, analyse or mishandle it. The safety question is therefore about who gets access, which operations are permitted, and what happens after the data leaves the bank.
The CBN's Operational Guidelines for Open Banking in Nigeria set out minimum rules for participants, consent, security and complaint handling. They are more useful for evaluating safety than a provider's marketing claims.
What does valid customer consent actually look like?
Section 11 of the CBN's 2023 guidelines requires the API provider to verify valid customer consent before sharing personal account information with an API consumer. The guidelines also require the requesting business to present relevant identity and access details.
A clear permission request should identify:
- Who is requesting access: the API consumer's legal name and brand name, where different, together with relevant company and registry identification.
- What it may access: the specific account information or service category, rather than an unexplained request for everything.
- Why it wants the information: a defined purpose such as expense categorisation or reviewing repayment affordability.
- How often access occurs: once, periodically or through another explicitly described schedule.
- When permission expires: a time limit or end date; consent should not silently last forever.
- How to revoke it: clear information on withdrawal, any practical consequences and treatment of redundant data.
The CBN's customer-experience appendix calls for explicit consent, suitable multi-factor authentication, a retained copy of the agreement, and the ability to access, manage or withdraw permissions. It also provides for revalidation annually and/or after 180 days of inactivity, as described in that appendix. These are regulatory requirements, not proof that every provider currently implements them correctly.
Example: read a consent screen before tapping “Allow”
| What you see | What to ask before agreeing |
|---|---|
| “Read account balances and transactions” | Which accounts, and how many months of history? |
| “Access for 90 days” | Is this a one-time retrieval or repeated access throughout the period? |
| “Improve your financial insights” | Does the service explain what analysis it performs and whether data is shared onward? |
| “Enable payments” | Can the app only read information, or can it request a payment action requiring approval? |
| “Manage permissions” | Where can you see and revoke the grant later? |
The 90-day duration above is an illustrative example, not a universal Nigerian legal limit. A trustworthy interface should make each permission understandable before you approve it.
Can an open banking app withdraw money from your account?
Permission to read account information is not the same as permission to initiate a payment. The CBN's technical standards envisage different permissions for information access and account functionality, with authentication, access controls, token restrictions and contextual limits where appropriate.
An application intended only to display balances should not be granted broader payment privileges simply because you agreed to link an account. A service proposing a payment-related operation must have the required legal and technical permissions and follow the relevant customer authorisation process.
Do not assume a data-sharing consent grants permanent debit authority. Equally, do not assume an unfamiliar app's “read only” label is trustworthy without verifying the provider and actual authorisation screen. If an app requests unusual or unnecessary permissions, decline and contact the bank through a genuine channel.
What protections does the CBN require?
The 2023 standards address security beyond the consent screen. Participants are expected to use strong authentication, token-based authorisation, encryption, secure APIs, monitoring, access controls, incident response, audits and data-retention procedures.
In particular, the standards describe OAuth 2.0 and OpenID Connect, financial-grade API security profiles, protected communication between systems, restricted scopes and ways for customers to review or cancel permissions. A token should represent defined access, not an unlimited right to act as the customer.
These controls reduce certain risks but cannot eliminate them. Providers can misconfigure systems, employees may misuse legitimate privileges, tokens can be stolen, and customers may be deceived by realistic-looking fake consent pages. A regulated design is only as protective as its real implementation.
Seven open banking risks Nigerian customers should recognise
| Risk | Why it matters | Practical response |
|---|---|---|
| Fake consent links | Criminals imitate a bank or fintech to collect credentials | Start from the provider's authentic app and verify redirects |
| Excessive permissions | More financial history may be collected than the service requires | Review scope, frequency, purpose and expiry |
| Weak third-party security | Data may be exposed after leaving the bank | Check provider identity, security practices and privacy notice |
| Credential or OTP theft | A convincing impostor may bypass careful consent processes | Never disclose passwords, PINs or OTPs to support agents |
| Persistent access | Expired or revoked permissions may be mishandled | Use the genuine permission dashboard and report continued access |
| Unexpected reuse or retention | Financial behaviour may be analysed beyond the stated purpose | Read retention and onward-sharing terms; exercise privacy rights |
| Incorrect automated conclusions | Incomplete transaction data may affect lending or other decisions | Request correction, explanation and available human review |
Some scams have nothing to do with a genuine open banking API. A phishing message can simply pretend to be a consent request. FlyingEze has reported on a CBN warning about phishing links targeting banking customers . Treat unsolicited “verify your open banking connection” messages with the same caution as fake account-reset messages.
Can you revoke consent, and does it delete your data?
The CBN guidelines require a method for customers to view and withdraw access. In a functioning compliant service, withdrawal should end future data access under that consent. If an app provides a permissions dashboard, use it; otherwise contact the authorised API consumer and relevant bank through their verified support routes.
However, revocation is not the same as deleting everything already collected. The Nigeria Data Protection Act 2023 states that withdrawing consent does not undo lawful processing that happened beforehand. Some existing records may also have to be retained for applicable legal, accounting, security or dispute purposes.
Ask the organisation to explain which records it holds, how long it will retain them, what can be erased or de-identified, and whether it shared information with another service provider. Where relevant rights apply, you may request deletion or correction separately from revoking future API access.
To help document the process, save the date of the original grant, the permissions displayed, the withdrawal confirmation and any follow-up communications. Do not publish sensitive banking details publicly to demonstrate your complaint.
Your rights under Nigeria's data-protection law
Open banking rules operate alongside the Nigeria Data Protection Act (NDPA) 2023. The Act provides rights that can help you challenge unnecessary or inaccurate processing of personal information. The Nigeria Data Protection Commission (NDPC) summarises rights including being informed, access, rectification, objection, portability, erasure in applicable circumstances, and protections relating to certain automated decisions.
These rights are not unconditional in every situation. For example, a company may have a valid legal obligation to retain particular records even after the service relationship ends. Consent is also not the only possible lawful basis for all forms of data processing, although customer consent is central to the specific open banking access process covered by the CBN guidelines.
- Right to know: ask why personal information is processed and who receives it.
- Right of access: request information about data being processed and, where applicable, a copy.
- Correction and erasure: seek correction of inaccurate records or deletion where the statutory conditions are satisfied.
- Withdrawal and objection: stop consent-based processing or object to certain other uses where the law provides for it.
- Portability and automated decisions: exercise qualifying rights regarding movement of data and consequential automated decisions.
- Complaint: report an alleged violation of personal-data rights to the NDPC.
For organisations operating financial-data services, FlyingEze's guide to Nigerian business obligations under the NDPC provides additional compliance context. A firm's registration or regulatory status should be verified separately from its promises about consumer rights.
Who is responsible if something goes wrong?
There may be multiple organisations involved: the bank or other API provider, the application receiving the data, a supporting technology provider and possibly a regulator. Responsibility depends on what happened, which parties were involved, contractual duties and the applicable law.
If an application accesses information without permission, first ask whether a valid consent record exists and whether the account provider authenticated it. If a criminal takes money, report the suspicious payment to the affected bank or payment provider immediately; you should not wait for a privacy complaint to be resolved before protecting an account.
CBN guidelines require participating organisations to maintain complaint and redress procedures. Their customer-experience standards provide for a complaint acknowledgement within 24 hours, including a reference number, contact desk and expected next steps, and state a 48-hour resolution timeframe for complaints. Those rules are procedural expectations, not an automatic refund guarantee; complicated investigations may require further action and applicable escalation.
How to report a disputed open banking connection or data misuse
- Stop or restrict suspicious access. Use genuine bank and app security controls; revoke permissions if available, and protect compromised credentials.
- Contact the service involved. Submit a clear complaint to the API consumer, API provider or both, depending on what happened. Ask for a written reference and an explanation of the consent or transaction record.
- Preserve evidence. Keep consent screens, times, alerts, connected-app lists, relevant statements, complaint messages and evidence of attempted revocation.
- Follow the CBN financial complaint route where applicable. The 2023 open banking appendix provides for escalation to the CBN Consumer Protection Department after exhaustion of the participant's internal dispute process or failure to resolve satisfactorily within 14 days, subject to the stated exclusions. The CBN's general complaint guidance also explains when financial institution complaints can be escalated.
- Report privacy-rights violations to the NDPC. Use the official NDPC website and its privacy breach reporting facilities. Provide only necessary evidence through authentic channels.
These routes serve different purposes: a financial complaint may concern unauthorised transfers or institutional conduct; a data-protection complaint may concern unlawful processing or mishandling of personal information. Not every private bank-data integration is necessarily part of a fully operating national open banking scheme, so check which provider, regulator and complaint rules apply to the actual service.
If money is moving without authorisation, treat it as urgent. Contact the bank's fraud service immediately, regardless of the ordinary complaint deadlines, and make any appropriate criminal report in parallel.
Is open banking already fully operational in Nigeria?
A nationwide, fully operational CBN-standard open banking network could not be independently confirmed as of 3 November 2026. The CBN framework dates to 2021 and the operational guidelines to March 2023. The originally expected August 2025 go-live did not occur. Open Banking Nigeria's July 2026 implementation update still discussed workstreams and further regulatory direction.
The CBN's 2026 fintech review described continuing challenges around fragmented APIs and data access. Separately, its Regulatory Sandbox Cohort 2 included permission-based data sharing and account aggregation. A sandbox is supervised testing, not proof of universal launch or a licence to conduct any financial service outside approved conditions.
As a result, readers should not assume that every banking app currently offers a CBN-standard consent dashboard. Always check what system a particular provider actually uses and which protections it has implemented.
A practical checklist before connecting any bank account
Use the following eight checks whenever a service invites you to link an account:
- Confirm the real business name and verify that you are using its genuine website or app.
- Read which accounts and categories of data it requests.
- Check whether the request is read-only or includes payment-related actions.
- Verify the exact purpose, access frequency and expiry.
- Look for a genuine way to view and withdraw permission.
- Review how existing records are stored, shared, retained and deleted.
- Use authenticated bank-controlled steps; do not give OTPs or passwords to a person claiming to be support staff.
- Know how to contact both the service provider and bank if an unfamiliar connection appears.
Declining an unnecessary request is a legitimate choice. A properly designed service should explain whether declining optional data access limits a particular feature rather than pressure customers into granting broader access than the service needs.
Frequently asked questions
Is open banking safer than sending a bank statement by WhatsApp?
A properly secured, permissioned API can offer stronger access controls and better auditability than sending documents to an unverified chat contact. But security depends on the actual service and its implementation. Never send sensitive banking records to an unknown requester.
Can I allow transaction history but refuse payment access?
The CBN's design includes defined permissions to data and account functionality. A read-only request should be separate from broader payment capabilities; inspect the actual scope rather than assume every application exposes all choices.
Does withdrawing consent make my old transactions disappear from the app?
Not necessarily. Withdrawal stops new access under the permission. Existing records may be retained under lawful rules or may qualify for erasure or restriction following a separate request.
Can an app sell my bank transactions because I clicked “Allow”?
Consent to a specific financial service is not permission for unrestricted unrelated uses. Request the privacy terms and information on sharing, and challenge processing that is not supported by a valid legal basis.
Will the CBN reimburse every victim of an open banking scam?
No automatic reimbursement can be inferred from the open banking guidelines. Any disputed transaction requires investigation under the applicable financial services and consumer-protection rules.
What if a third-party app has no clear consent or complaint controls?
Do not proceed with a suspicious connection. Contact your bank through official channels, ask the provider for its identity and policies, and consider reporting apparent breaches to the relevant regulator.
Conclusion: Safety depends on meaningful control, not a marketing label
Open banking can help Nigerians use financial apps without handing out banking passwords, but only when customer permission is genuine, limited, authenticated and enforceable. The CBN guidelines describe these protections, and the Nigeria Data Protection Act provides additional rights over personal information.
Before connecting an account, check who wants access, what they can see or do, when the permission ends, and how you can revoke it. If access looks suspicious, stop it and report the problem promptly. Those habits will remain valuable as Nigeria's regulated open banking infrastructure develops.
