Nigeria NFIU goAML Reporting: CTR, STR and FTR Rules for Banks (2026)
Short answer: Nigerian reporting entities file to the Nigerian Financial Intelligence Unit (NFIU) through its goAML portal. Under the Money Laundering (Prevention and Prohibition) Act 2022, cash transactions above ₦5 million for an individual or ₦10 million for a body corporate are reported as Currency Transaction Reports within seven days; suspicious transactions are reported within 24 hours, with no minimum amount; and cross-border transfers above USD 10,000 are reported as Foreign Transaction Reports. A goAML upgrade that took effect in early 2026 split STRs into six typed categories, added a monthly PEP transaction report, and from 1 February 2026 rejects reports that use the wrong type or omit predicate-offence and indicator codes.
This guide is for compliance officers at Nigerian banks, other financial institutions and designated non-financial businesses and professions (DNFBPs) who need the reporting rules in one place, and for East African groups with Nigerian operations who already know the goAML system from Kenya, Uganda or Tanzania and need to see where Nigeria differs.
Nigeria's AML reporting framework
The Money Laundering (Prevention and Prohibition) Act, 2022
The MLPPA 2022 replaced the 2011 Act and is the statute that creates the reporting duties described here. It applies to financial institutions — banks, discount houses, finance companies, bureaux de change, insurers, capital-market operators, payment providers — and to DNFBPs such as lawyers, accountants, real-estate dealers, casinos, dealers in precious metals and stones, and the other professions the Act designates. Financial institutions are supervised for AML purposes by their prudential regulators (the Central Bank of Nigeria, the Securities and Exchange Commission, the National Insurance Commission); DNFBPs register with and report through the Special Control Unit against Money Laundering (SCUML).
The NFIU and the goAML portal
The NFIU is Nigeria's financial intelligence unit, established as an autonomous body by the NFIU Act 2018. It receives, analyses and disseminates the reports described below, and it runs the UNODC goAML platform as the channel for them. Financial institutions submit through the goAML web portal after registering as a reporting entity; bureaux de change, DNFBPs and non-profit organisations file currency transaction reports through the NFIU's RapidAML platform. Nigeria is a member of GIABA, the West African FATF-style regional body, so the same FATF recommendations that shape ESAAMLG members' regimes shape Nigeria's.
Registration before reporting
Nothing can be filed until the institution is registered on the portal. Registration establishes the reporting entity, its compliance officer (the "MLRO" role in goAML terms) and the users who may submit. Keep the registration details — organisation name, registration number, contact officers — exactly as the NFIU holds them: a mismatch between the XML header and the registry is one of the standard rejection reasons in every goAML deployment, as our guide to fixing goAML submission rejections explains.
The three transaction reports
Currency Transaction Reports: ₦5 million and ₦10 million
Section 11 of the MLPPA 2022 requires a financial institution or DNFBP to report any single cash transaction, lodgement or transfer above ₦5,000,000 for an individual and ₦10,000,000 for a body corporate to the NFIU (and, for DNFBPs, to SCUML) within seven days of the transaction. Since the 2026 goAML upgrade, the CTR report type is reserved for domestic transactions: a cash movement that is part of a cross-border transfer belongs in an FTR, and from 1 February 2026 the portal rejects a CTR filed for a cross-border transaction.
Two operational points follow. The thresholds are naira-denominated and split by customer type, so the CTR rule engine must know whether the account holder is a natural person or a body corporate — a data-quality dependency on the KYC record. And seven days is generous compared with Kenya's Friday-of-the-week rule, but the volume at ₦5 million is high in a cash-heavy economy: the practical constraint is not the deadline but the pipeline that extracts, validates and files hundreds of CTRs a week without error.
Suspicious Transaction Reports: 24 hours, six categories
Section 7 requires a report to the NFIU within 24 hours where a transaction is unusually frequent or complex, lacks apparent economic justification, is inconsistent with the customer's known pattern, or appears connected to money laundering, terrorist financing or another crime. There is no monetary threshold and the duty extends to attempted transactions.
The goAML upgrade replaced the single STR with six typed reports — Terrorism Financing STR, Kidnapping for Ransom STR, Corruption STR, Fraud STR, Drug Trafficking STR and STR (General) — with the general category reserved for suspicions that do not fit the five named offences. Predicate offences are consolidated into 21 defined categories, each with coded indicators, and every STR must carry the predicate offence and the indicator codes that support it. The narrative still matters — the guidance in how to write an STR narrative for goAML applies unchanged — but a well-written narrative with no indicator code is now rejected outright.
Foreign Transaction Reports: USD 10,000
Transfers to or from Nigeria above USD 10,000 (or the equivalent) are reported as Foreign Transaction Reports. After the upgrade the FTR type is exclusively for cross-border transactions; an FTR filed for a domestic-only movement is rejected from 1 February 2026. Institutions that previously used one report type for both flows need a routing rule — domestic cash above threshold to CTR, cross-border above USD 10,000 to FTR — driven by the transaction's counterparty country, not by the officer's judgement at filing time.
Other reports introduced or reclassified in 2026
- PEP Transaction Report — a new monthly report covering every transaction of a politically exposed person, whether or not anything about it is suspicious. This turns PEP status from an onboarding flag into a standing reporting population, which means the PEP indicator in the customer record must be reliable and current.
- BVN Name Change Request — a dedicated report type for changes to the name on a Bank Verification Number, separating what used to be an ad-hoc request from the suspicious-transaction stream.
- Typed STR indicators — the 21 predicate-offence categories and their coded indicators replace free-text typology descriptions, so an institution's indicator library must be mapped to the NFIU codes before the first filing under the new schema.
The NFIU ran virtual training from 5 January 2026 and set 1 February 2026 as the date from which the system automatically rejects CTRs for cross-border transactions, FTRs for domestic-only transactions, and STRs without predicate-offence and indicator selections.
Nigeria-specific data rules
- Identifiers. The Bank Verification Number is the identifier Nigerian banks use for individuals across institutions, and the National Identification Number is increasingly required alongside it; corporate customers are identified by their Corporate Affairs Commission registration number. Whatever the NFIU's current schema profile designates as mandatory, the identifier must be stored in the format the portal validates — the same lesson as Kenya's national-ID format rule in our mandatory fields reference.
- Customer type drives the threshold. Because CTR thresholds differ for individuals and bodies corporate, the customer-type flag in the core banking record is a reportable data element in all but name. Sole proprietorships and unregistered businesses are the usual source of misclassification.
- Currency and rate. Naira thresholds applied to foreign-currency cash require conversion at a documented rate, and FTRs need the USD equivalent of naira-denominated transfers; use one rate source and record it in the report.
- Schema version. Confirm the schema version the NFIU publishes after the upgrade before regenerating files; the general rules in the goAML XSD v5 XML generation guide — UTF-8 without a byte-order mark, ISO dates, two-decimal amounts, lowercase booleans — apply, but the enumerations for report and indicator types are Nigeria's own.
How Nigeria compares with East African goAML regimes
| Rule | Nigeria (NFIU) | Kenya (FRC) | Uganda (FIA) | Tanzania (FIU) |
|---|---|---|---|---|
| Cash threshold | ₦5m individual / ₦10m corporate | USD 15,000 | UGX 20 million | USD 10,000 |
| Cash report deadline | 7 days | Friday of the week | Per FIA guidance | 5 working days |
| STR deadline | 24 hours | 3 days | 2 working days | 24 hours |
| Cross-border report | FTR above USD 10,000 | — | URA declaration above UGX 30m | EFT report above USD 1,000 |
| Typed STRs | Six categories, coded indicators | Indicator codes | Indicator codes | Indicator codes |
The country guides for Kenya, Uganda, Tanzania and Zambia cover each regime in depth. The pattern is the same everywhere: one goAML core, one XML discipline, and a country layer of thresholds, deadlines, identifiers and codes that must be configuration rather than code.
Compliance checklist for Nigerian reporting entities
- Confirm goAML registration details match the NFIU registry exactly, including the current compliance officer.
- Route reports by transaction type: domestic cash above threshold → CTR; cross-border above USD 10,000 → FTR; suspicion → the correct typed STR.
- Map the institution's internal typologies to the NFIU's 21 predicate-offence categories and coded indicators.
- Verify the individual/body-corporate flag on every account that can cross the ₦5m/₦10m lines.
- Establish the monthly PEP Transaction Report as a standing job, with the PEP flag reviewed at onboarding and periodically.
- Validate every XML file against the NFIU's published schema before submission, and keep the acknowledgement and any rejection message with the case.
- Log the 24-hour STR clock from the moment suspicion is formed, not from the end of the investigation.
Frequently asked questions
What is the CTR threshold in Nigeria?
₦5,000,000 for an individual and ₦10,000,000 for a body corporate, applied to a single cash transaction, lodgement or transfer, under section 11 of the Money Laundering (Prevention and Prohibition) Act 2022. The report goes to the NFIU — and to SCUML as well for DNFBPs — within seven days. Since the 2026 goAML upgrade the CTR type is for domestic transactions only.
How quickly must an STR be filed in Nigeria?
Within 24 hours, under section 7 of the Act, with no minimum amount and including attempted transactions. The STR must be filed under one of six typed categories — Terrorism Financing, Kidnapping for Ransom, Corruption, Fraud, Drug Trafficking, or General — and must carry the NFIU's predicate-offence and indicator codes.
What is a Foreign Transaction Report?
The NFIU report for transfers into or out of Nigeria above USD 10,000 or its equivalent. After the goAML upgrade the FTR type is reserved for cross-border transactions and a domestic-only transfer filed as an FTR is rejected.
What changed in the NFIU goAML upgrade?
Six typed STR categories, 21 predicate-offence categories with coded indicators, CTRs limited to domestic and FTRs to cross-border transactions, a new monthly PEP Transaction Report, and a dedicated BVN Name Change Request type. From 1 February 2026 the system automatically rejects CTRs for cross-border transactions, FTRs for domestic transactions, and STRs without predicate-offence and indicator selections.
Do DNFBPs file through goAML?
Financial institutions file through the goAML web portal. Bureaux de change, DNFBPs and non-profit organisations file their currency transaction reports through the NFIU's RapidAML platform, and DNFBPs also register with SCUML.
Automate NFIU reporting on a country-profile basis
Creodata's goAML Reporting Platform holds each FIU's thresholds, identifiers, channel codes, report types and validation rules as a country profile rather than custom code, generates schema-valid XML from core-banking data, and validates every file before it reaches the portal — the approach described in the complete goAML reporting guide. If you are a Nigerian reporting entity, or a regional group adding Nigeria to an existing East African deployment, book a demo and we will walk through the NFIU's typed reports and thresholds against your own transaction data. In the meantime, the free goAML XML validator and the goAML error-code library apply to any goAML file, whichever FIU it is bound for.