WHEN A BANKING PARTNER LOSES ITS LICENCE: WHAT THE CBN’S REVOCATION OF 46 MFB LICENCES MEANS FOR FINTECH RESILIENCE AND CUSTOMER FUNDS

1. Background

Many Nigerian fintech products rely on a licenced bank or other regulated institution for the legally regulated layer beneath the interface. The fintech may control the brand, technology and customer experience, while the regulated institution accepts deposits, provides accounts or performs other activities within its licence and approvals. The precise allocation of roles varies by product, contract and licence, so the model should not be treated as identical across the market.

On the 1^st July, 2026, the Central Bank of Nigeria revoked the operating licences of 46 microfinance banks. The list covered Tier 1, Tier 2 and state MFBs. The NDIC confirmed the revocations and published the list. For any fintech that actually depended on one of those institutions for customer accounts, settlement, savings or credit delivery, the regulatory rail beneath the product was immediately compromised.

That does not mean every product bearing a name similar to an affected MFB was disrupted. The practical effect depends on whether the revoked entity was operational, held customer funds, or supported a live fintech integration. The CBN’s public statement did not assign a specific ground to each MFB.

In this Tech Brief, we examine the circumstances leading to these revocations, the grounds provided by the CBN for its decision, options available to the MFBs, and affected fintech partners leaning on MFB rails, and what happens to customers’ funds held with these entities.

2. Why the CBN Revoked Licences

The CBN acted under sections 12 and 13 of the Banks and Other Financial Institutions Act 2020. It said each affected MFB had failed one or more regulatory conditions for continued operation:

1. insufficient assets to meet their liabilities;
2. closure of operations without CBN approval;
3. inactivity, and cessation of financial intermediation;
4. failure to commence operations within twelve (12) months of licence approval; or
5. failure to maintain minimum capital funds unimpaired by losses.

Following revocation, the NDIC was appointed official liquidator and began the orderly closure, depositor verification and payment process. The affected MFBs are no longer authorised to conduct banking business.

3. What the NDIC Means for Depositors

Deposit insurance protects eligible deposits in insured institutions. It does not necessarily protect every claim, investment or amount described in an app as a balance. The legal character of the product, the account structure and the failed institution’s records matter.

Insured Deposits: The current maximum for an MFB is ₦2,000,000 per depositor, per MFB, in the same right and capacity. For a deposit money bank, including a non-interest bank, the maximum is ₦5,000,000. These are maximum coverage limits, not a promise that every balance automatically qualifies. The NDIC’s current FAQ explains the aggregation rules, while its 2024 coverage announcement records the revised limits. Section 28 of the NDIC Act, 2023 requires payment of insured deposits within 30 days after the NDIC becomes liquidator. In practice, payment still depends on account verification, valid depositor data, and the absence of unresolved restrictions or disputes.

For these 46 MFBs, the NDIC stated that depositors with BVNs linked to the failed-bank accounts would be paid through alternative accounts at existing banks. Depositors without linked BVNs may submit claims online, visit an affected bank’s office, or visit an NDIC office with the required evidence.

Uninsured deposits: Any balance above the insured threshold is classified as an uninsured deposit. These amounts are not immediately reimbursed. Instead, they are recovered over time as liquidation dividends, funded from the sale of the MFB’s assets, loan recoveries, and the realisation of investments. The NDIC administers all such recovery processes in its capacity as liquidator.

The Key Fintech Issue: Whose Deposit Is It?

A fintech should not assume that each app user automatically receives a separate ₦2,000,000 MFB limit. The answer depends on whose name the deposit is held in, whether the arrangement is a qualifying trust or pool structure, whether beneficial interests are properly disclosed, and whether the underlying records satisfy applicable KYC and deposit-insurance requirements.

The NDIC expressly recognises pass-through deposit insurance for qualifying Mobile Money Operator pool or trust accounts. Its conditions include a bare-trust arrangement, clear records showing that funds belong to individual subscribers, compliant KYC, and proper disclosure of subscriber interests. That framework should not be assumed to apply automatically to every fintech-MFB pooled account. Product-specific advice and direct confirmation from the relevant institutions are advisable.

4. Bank Partners are Critical Infrastructure

Due diligence in bank-fintech relationships often runs mainly in one direction. The bank conducts KYC and onboarding on the fintech, while the fintech treats the bank’s licence as sufficient comfort. A licence should be the start of the assessment, not the end of it.

A partner may be properly licenced at onboarding and later encounter financial, operational or regulatory distress. If that partner holds customer funds or provides the account and settlement layer, its failure can interrupt service and expose customers to a claims process even when the fintech itself remains compliant.

A Resilience Checklist For Fintechs

• Verify the exact regulatory model: Map each product feature to the entity legally responsible for it, the licence or approval relied on, and the account in which customer money is actually held.
• Perform counterparty due diligence before integration: Check licence status, prudential and governance indicators that can lawfully be obtained, compliance history, operational resilience, audit rights, insurance status and material regulatory action.
• Monitor continuously: Use periodic certifications, regulatory-status checks, service and settlement metrics, adverse-event notification duties and escalation triggers. Onboarding diligence ages quickly.
• Build an independent reconciliation layer: Maintain accurate customer sub-ledgers and transaction records that can be reconciled against the regulated institution’s books. The contract should specify which record prevails, how discrepancies are resolved, and what data can be exported on exit.
• Design lawful portability: Pre-agree exit assistance, data export formats, account mapping, customer communications and migration steps. Any transfer of KYC or customer data must comply with applicable data-protection, confidentiality and CBN requirements.
• Reduce concentration risk where the model permits: A second regulated partner is useful only if it is live, tested and legally capable of receiving the relevant activity. Failover may still require account opening, KYC, customer notices, consent or regulatory steps, so it should not be described as instantaneous unless those dependencies have been solved.
• Negotiate for distress and exit, not only normal operations: Contracts should address regulatory-event notifications, suspension rights, data and ledger access, reconciliation, transition support, customer communications, treatment of funds and cooperation with the CBN or NDIC.
• Consider an appropriate licence, but do not treat it as a shortcut: Owning a licence can reduce some dependencies, but it also creates capital, governance, compliance, operational and supervisory obligations. The right answer depends on the activities and scale of the business.

Payment-Data Localisation: The 1 January 2027 Deadline

The CBN’s circular of 15 June 2026 requires financial institutions and participants facilitating payments in Nigeria to store and manage payment transaction data generated in Nigeria within Nigeria. Compliance takes effect on 1 January 2027. The requirement concerns payment transaction data and should not be restated as a blanket rule that every category of fintech data must be processed locally. Portability planning should, therefore, distinguish payment transaction data from other records, identify each system and processor, and align migration design with both the circular and the Nigeria Data Protection Act 2023.

Conclusion

The revocation of 46 MFB licences is a reminder that regulated partners are part of a fintech’s operating architecture. Resilience requires more than a second API connection. It requires verified legal structures, transparent customer-fund arrangements, reliable records, continuous counterparty monitoring, tested transition plans and contracts that still work when the relationship is under stress.