---

Abstract

---

Table of Contents

---

1. Introduction

The global financial services industry has, over the past decade, undergone a structural transformation driven by the unbundling of banking services and the rise of Application Programming Interface (API)-based data sharing. This model, widely termed "open banking," originated in jurisdictions such as the United Kingdom and the European Union, where the Revised Payment Services Directive (PSD2) obliged banks to grant licensed third parties access to customer account data upon customer consent (European Union, 2015). In Africa, Nigeria has emerged as an early mover, with the Central Bank of Nigeria (CBN) issuing the Regulatory Framework for Open Banking in Nigeria in February 2021, followed by the Operational Guidelines for Open Banking in Nigeria on 7 March 2023 (Central Bank of Nigeria, 2023; Businessday NG, 2023). These instruments are frequently described as the first comprehensive open banking regulatory regime on the African continent (Pavestones Legal, n.d.).

This paper provides an academic overview of open banking, situating the discussion within Nigeria's regulatory and market context. It addresses twelve interrelated themes: the definition of open banking; the mechanics of open banking APIs; the distinction between open banking and traditional banking APIs; the process of developer integration; payment initiation services; account-to-account payments; security; authentication; the relevance of open banking APIs to fintech developers; the relationship between open banking and financial inclusion; the future trajectory of open banking in Nigeria; and, finally, a comparison of open banking with conventional payment gateways.

2. What Is Open Banking?

Open banking is a model of financial services delivery in which banks and other holders of customer financial data make that data available, in a secure and standardised format, to third-party providers, subject to explicit customer consent (Central Bank of Nigeria, 2023). Rather than financial data residing exclusively within the systems of the institution that collected it, open banking treats the data as belonging, in a meaningful sense, to the customer, who may authorise its portability across providers. The Afriwise legal commentary on the CBN Guidelines describes open banking, although not formally defined in the Guidelines themselves, as the exchange of a customer's data between institutions for the purpose of delivering innovative financial services (Afriwise, 2023).

In the Nigerian context, the CBN's 2021 Regulatory Framework was designed to enable financial institutions to grant third-party financial service providers access to financial data through APIs, and to allow the linking of accounts and data across institutions for use by financial institutions, customers, and third parties alike (Mondaq, 2023). The 2023 Operational Guidelines operationalised these principles by categorising participants, prescribing data-sharing tiers, and establishing an Open Banking Registry (OBR) through which the CBN maintains oversight of all licensed participants (Pavestones Legal, n.d.; DCSL, 2023).

Conceptually, open banking rests on three pillars: (i) customer consent and control over personal financial data; (ii) standardised, machine-readable APIs that replace ad hoc or manual data-sharing arrangements; and (iii) a regulatory or contractual framework that allocates liability, sets security standards, and defines the rights and obligations of participants.

3. How Open Banking APIs Work

At a technical level, open banking is implemented through RESTful APIs that expose defined categories of banking functionality to authorised consumers. The CBN Operational Guidelines annex detailed API standards, alongside risk management, security, and customer-experience standards, and an operational readiness checklist (Mondaq, 2023). In practice, the workflow proceeds through several stages:

• Consent capture: the customer, typically through a third-party application, authorises a specific scope of data sharing or a payment instruction, often via a redirect to their bank's own authentication interface.
• API request: the authorised third party (the API Consumer) transmits a structured request to the data-holding institution (the API Provider) over a secure, authenticated channel.
• Data or payment response: the API Provider validates the request against the consent record and returns the requested account information, or executes the requested payment, within a defined service-level window.
• Logging and reporting: both parties log the transaction for audit, dispute resolution, and regulatory reporting purposes, including monthly returns to the CBN on transaction volumes (Businessday NG, 2023).

The CBN Guidelines also specify performance benchmarks; for example, an average API response time of under three seconds is treated as an acceptable key performance indicator for participants (Afriwise, 2023). This performance discipline distinguishes regulated open banking APIs from the informal data-scraping techniques that preceded formal open banking regimes, in which third parties would use customer-supplied online banking credentials to log in and scrape account data on the customer's behalf—a practice that open banking APIs are explicitly designed to replace.

4. Open Banking vs Traditional Banking APIs

Traditional or proprietary banking APIs are typically built by a bank for its own internal use, for a narrow set of pre-approved partners, or for a single mobile or web application. Access is usually negotiated bilaterally, documentation is often not publicly available, and the scope of data exposed is determined unilaterally by the bank. Open banking APIs differ in several structural respects.

4.1 Standardisation

Open banking APIs conform to a common technical standard prescribed by the regulator or an industry standards body, ensuring that a third party can integrate once and connect to multiple banks with minimal incremental effort. Traditional APIs, by contrast, are often bespoke, requiring separate integration work for each institution.

4.2 Regulatory mandate versus commercial discretion

Under the CBN Guidelines, participation categories and minimum data-sharing obligations are defined by regulation rather than left entirely to commercial negotiation, and API Providers and Consumers are prohibited from engaging in anti-competitive practices such as de-marketing rivals who rely on the shared infrastructure (Businessday NG, 2023). Traditional banking APIs impose no such non-discrimination obligation.

4.3 Consent architecture

Open banking APIs are built around explicit, revocable, purpose-limited customer consent, typically logged and auditable. Traditional APIs may rely on broader terms-of-service consent or on the bank's own discretion regarding what a partner may access.

4.4 Governance and liability

Open banking arrangements require a documented Service Level Agreement between API Providers and Consumers, a board-approved data governance policy, and a formal information security policy with regular threat assessments (Pavestones Legal, n.d.; Businessday NG, 2023). Traditional bilateral APIs may or may not carry equivalent governance requirements, depending on the negotiating strength of the parties.

5. How Developers Can Integrate Open Banking

For a fintech company or independent developer seeking to build on Nigeria's open banking ecosystem, integration generally follows a structured pathway shaped by the CBN's regulatory categorisation of participants.

• Determine eligibility and register: prospective API Consumers and Providers must be identifiable within the Open Banking Registry (OBR), using their Corporate Affairs Commission (CAC) registration number as a unique identifier (Pavestones Legal, n.d.).
• Classify participation category: the Guidelines categorise participants (for example, by the sensitivity of data handled), which determines the compliance obligations, capital, and security requirements applicable to a given developer or firm.
• Execute a Service Level Agreement: API Providers and Consumers intending to share data must sign an SLA meeting the minimum requirements set by the Guidelines, covering uptime, response time, and dispute resolution (Pavestones Legal, n.d.).
• Adopt the prescribed technical standards: developers implement the CBN's API, data, and security specifications, including authentication protocols, encryption in transit and at rest, and standardised data schemas, before onboarding.
• Establish consent and audit infrastructure: applications must incorporate a compliant consent capture flow, together with logging sufficient to support the monthly regulatory returns required of participants (Businessday NG, 2023).
• Conduct operational readiness testing: the Guidelines include an operational readiness checklist against which a participant's systems are assessed prior to go-live (Mondaq, 2023).

In practice, many developers accelerate this process by integrating with a licensed open banking aggregator or API hub that has already completed CBN registration and SLA negotiation with multiple banks, allowing the developer to connect once to the aggregator rather than negotiating individually with each deposit money bank.

6. Open Banking and Payment Initiation

Payment initiation is one of the two principal service categories enabled by open banking, alongside account information access. A Payment Initiation Service Provider (PISP) is authorised, with customer consent, to instruct a bank to move funds directly from the customer's account to a recipient, without the payment passing through the PISP's own settlement accounts. This distinguishes payment initiation from traditional card-based or wallet-based payment flows, in which funds typically move through an intermediary's pooled account before reaching the beneficiary.

Within the CBN framework, participants offering payment and remittance services fall within the scope of institutions to which the Guidelines apply (Mondaq, 2023, discussing the 2023 Compliance Alert overview). Payment initiation under open banking offers a lower-friction checkout experience, reduced dependence on card networks, and, because funds move bank-to-bank, potentially lower transaction costs than card-scheme-based alternatives. It also shifts a portion of fraud and dispute risk toward the strength of the consent and authentication process, making robust authentication (discussed in Section 9) a precondition for safe payment initiation.

7. Account-to-Account Payments Explained

Account-to-account (A2A) payments are transfers initiated and settled directly between the payer's and payee's bank accounts, bypassing card rails, payment wallets, or other intermediary settlement layers. Open banking payment initiation is the principal enabling mechanism for modern A2A payments, because it allows a merchant's checkout page or a fintech application to trigger a bank-authenticated transfer directly from the customer's account.

In Nigeria, the pre-existing instant payment infrastructure operated by the Nigeria Inter-Bank Settlement System (NIBSS), including the NIBSS Instant Payment (NIP) rail, already supports real-time interbank transfers; open banking adds a standardised, consent-driven initiation layer on top of this settlement infrastructure, allowing third-party applications to trigger such transfers programmatically rather than requiring the customer to manually operate their banking app. The principal advantages of A2A payments include near-real-time settlement, the elimination of card-scheme interchange fees, reduced exposure to card fraud typologies such as card-not-present fraud, and a checkout experience that keeps the customer within a single authenticated flow. The principal limitations include continued dependence on the payer's bank's system availability, the need for robust dispute-resolution mechanisms in the absence of card-scheme chargeback protections, and the requirement for strong customer authentication to prevent unauthorised initiation.

8. Open Banking Security

Because open banking necessarily increases the number of parties with access to sensitive financial data, the CBN Guidelines treat security as a central pillar of the regulatory regime, identifying cybersecurity, data privacy and integrity, product management risk, money laundering, and regulatory compliance as the principal risk categories requiring active management (Afriwise, 2023). Security obligations imposed on API Providers and Consumers include:

• Maintenance of a board-approved, or at minimum senior-management-approved, data governance policy (Businessday NG, 2023).
• Development and maintenance of an information security policy, supported by regular threat assessments (Businessday NG, 2023).
• Compliance with the Nigeria Data Protection Regulation and any supplementary CBN data protection requirements, together with continuous protection against data breaches (Businessday NG, 2023).
• Encryption of data in transit and at rest, and adherence to the API security standards specified in the Guidelines' technical appendices (Mondaq, 2023).
• Adherence to anti-money laundering and counter-terrorism-financing obligations already applicable to banks and other financial institutions, including the filing of returns on reportable transactions conducted through the open banking ecosystem (Mondaq, 2023).

The Guidelines further prohibit anti-competitive practices such as de-marketing, reflecting a recognition that market conduct risk, not merely technical risk, forms part of the broader security and integrity of the ecosystem (Businessday NG, 2023).

9. Open Banking Authentication

Authentication is the mechanism by which an API Provider verifies that a request for data access or payment initiation is genuinely authorised by the account holder. Internationally, open banking regimes typically mandate some form of Strong Customer Authentication (SCA), combining at least two independent factors drawn from knowledge (something the customer knows, such as a PIN), possession (something the customer has, such as a registered device or token), and inherence (something the customer is, such as a biometric marker).

In implementation terms, most open banking authentication flows use the OAuth 2.0 authorisation framework together with OpenID Connect for identity assertion, under which the customer is redirected to their own bank's authentication interface—rather than entering credentials directly into the third-party application—before a time-limited, scope-restricted access token is issued to the requesting party. This "redirect" model reduces the risk of credential exposure to third parties and allows the customer to see precisely what data or payment authority they are granting, and for how long. Consistent with this, the CBN Guidelines require participants to maintain robust identity verification and consent management mechanisms as part of their broader security and customer-experience standards (Mondaq, 2023). Authentication tokens are typically scoped narrowly (for example, read-only access to account balances for ninety days, or a single one-off payment instruction) and are revocable by the customer at any time, consistent with the consent-centred design of the framework.

10. Open Banking APIs for Fintech Developers

For fintech developers, regulated open banking APIs offer several practical advantages over the informal data-access methods that many African fintechs historically relied upon, such as screen-scraping or the storage of customer banking credentials.

• Reduced integration cost over time: a single technical standard, once implemented, can be reused across multiple participating banks, lowering the marginal cost of adding new institutions.
• Reduced credential risk: because customers authenticate directly with their bank rather than sharing login credentials with the developer's application, the developer's liability and security exposure in the event of a breach is reduced.
• Regulatory legitimacy: operating within the CBN's registered ecosystem, with an executed SLA and OBR registration, gives a fintech a defensible compliance posture when dealing with banking partners, investors, and regulators (Pavestones Legal, n.d.).
• New product categories: reliable access to account information and payment initiation underpins products such as automated personal finance management, income and affordability verification for credit underwriting, direct debit alternatives, and merchant payment acceptance without card-scheme dependency.

At the same time, developers must budget for the compliance overhead the Guidelines impose, including data governance documentation, information security policy maintenance, and monthly regulatory reporting, which represent a materially higher bar than integrating with an unregulated data aggregator (Businessday NG, 2023).

11. Open Banking and Financial Inclusion

Financial inclusion is frequently cited as a principal policy justification for open banking regulation in emerging markets, and the CBN Guidelines were framed in part around fostering the adoption of open banking practices, enabling the sharing of customer-permissioned data, and enabling the building of customer-focused products and services (UUBO, 2023). Nigeria's financial inclusion indicators provide useful context for assessing this rationale.

According to the Enhancing Financial Innovation and Access (EFInA) Access to Financial Services (A2F) 2023 survey, formal financial inclusion in Nigeria rose from 56 per cent in 2020 to 64 per cent in 2023, while overall financial exclusion fell from 32 per cent to 26 per cent over the same period, moving the country closer to the Nigeria Financial Inclusion Strategy's target of reducing exclusion to 25 per cent (EFInA, 2023). Notably, growth in inclusion was driven disproportionately by non-bank financial institutions, including fintechs, whose share of formal inclusion rose from 5 per cent in 2020 to 12 per cent in 2023 (A2F, 2023). A related, broader measure placed overall financial inclusion, encompassing informal mechanisms, at 74 per cent in 2023 (Vanguard News, 2025; NAN, 2023). At the same time, EFInA's data pointed to a widening gender gap in inclusion and a decline in the financial health index, underscoring that access alone is an incomplete measure of inclusion (Vanguard News, 2025).

Open banking is positioned to reinforce these gains by allowing fintechs and other non-bank providers to underwrite credit using account transaction history rather than collateral or formal credit bureau records, by enabling lower-cost payment products that do not depend on card issuance, and by allowing thin-file or previously unbanked customers to access tailored financial products once even a single formal account relationship exists. Academic analysis of fintech adoption in Nigeria over the 2018–2024 period similarly links growth in digital financial channel usage to gains in measured financial inclusion, using CBN electronic payment statistics and EFInA's A2F dataset (Fintech Adoption and Financial Inclusion in Nigeria, 2024).

12. The Future of Open Banking in Nigeria

Several trends are likely to shape the continued development of open banking in Nigeria. First, full operationalisation of the Open Banking Registry and completion of Service Level Agreements across the banking sector remain ongoing processes; the pace at which deposit money banks, microfinance banks, mobile money operators, and payment service providers complete onboarding will materially affect how quickly the ecosystem reaches critical mass (DCSL, 2023).

Second, enforcement and supervisory capacity will determine the credibility of the regime. Because the Guidelines impose detailed obligations around data governance, security, and anti-competitive conduct, consistent CBN supervision, including review of the monthly returns participants are required to file, will be necessary to sustain market confidence (Businessday NG, 2023).

Third, product innovation is likely to expand beyond basic account information and payment initiation toward variable recurring payments, embedded lending underwritten on open banking data, and open finance extensions covering insurance, pensions, and capital markets data, an expansion explicitly anticipated as a growth opportunity in EFInA's 2023 survey findings (EFInA A2F, 2023).

Fourth, interoperability with existing payment rails, particularly NIBSS Instant Payments and the Bank Verification Number (BVN) identity infrastructure, positions Nigeria favourably relative to jurisdictions that had to build both open banking and instant payment rails simultaneously. Finally, as one of the first comprehensive open banking regimes in Africa, Nigeria's implementation experience is likely to inform regional peers considering similar reforms, reinforcing Nigeria's position as a reference point for open banking policy design on the continent (Pavestones Legal, n.d.).

13. Open Banking vs Payment Gateways

Open banking and payment gateways are complementary but structurally distinct mechanisms for moving money, and the two are frequently, and imprecisely, conflated.

A payment gateway is a technical intermediary that authorises and routes card, wallet, or bank-transfer payments between a merchant and the customer's chosen payment instrument, typically settling funds into the gateway provider's or merchant's collection account before onward disbursement. Gateways generally operate under a commercial licence, such as a Payment Solution Service Provider or Switching and Processing licence, rather than the open banking-specific categorisation created by the 2023 Guidelines, and they often support multiple payment methods, including cards, USSD, and bank transfers, within a single integration.

Open banking, by contrast, is a data- and consent-sharing architecture that operates at the level of the customer's own bank account, enabling either information access or direct, bank-to-bank payment initiation without funds necessarily passing through the third party's own settlement account. The distinction carries several practical implications:

• Settlement path: gateways commonly pool funds before disbursement; open banking-initiated A2A payments settle directly between payer and payee accounts.
• Regulatory basis: gateways are licensed as payment service providers; open banking participants are additionally subject to the CBN's open banking categorisation, data governance, and OBR registration requirements (Pavestones Legal, n.d.).
• Data scope: gateways are generally limited to transaction processing; open banking additionally permits regulated access to account information, such as balances and transaction history, for purposes beyond payment execution.
• Cost structure: gateway transactions, particularly card transactions, typically carry scheme interchange and processing fees; direct A2A open banking payments can reduce or eliminate these fees, though they may still incur bank transfer charges.

In practice, many Nigerian fintechs are likely to use both mechanisms in combination, deploying a payment gateway for card acceptance and a wide range of payment methods, while layering open banking APIs on top for account verification, income analysis, and lower-cost direct-transfer checkout options.

14. Conclusion

Nigeria's Regulatory Framework for Open Banking (2021) and Operational Guidelines for Open Banking (2023) constitute one of the more comprehensive open banking regimes to have been adopted in Africa to date. By mandating standardised APIs, consent-based data sharing, a central Open Banking Registry, and detailed security and governance obligations, the CBN has sought to balance the innovation and financial inclusion benefits of open data sharing against the cybersecurity, privacy, and market conduct risks the model introduces. The evidence to date, including measurable gains in formal financial inclusion driven substantially by fintech and non-bank channels, suggests that a well-supervised open banking regime can meaningfully expand access to financial services. The extent to which this potential is realised in Nigeria will depend on the pace of registry onboarding, the rigour of ongoing supervision, and the willingness of banks and fintechs to build genuinely interoperable, secure, and customer-centred products on top of the framework the CBN has established.

---

References