CBN Automated-AML Baseline
Market regime · CBN Baseline Standards for Automated AML/CFT/CPF Solutions (2026)
Central Bank of Nigeria
Nigeria
Circular and baseline standards, March 2026
CBN supervision; the institution is accountable regardless of vendor
CBN-supervised institutions running automated AML systems
Curated, versioned & cross-mapped
The obligation, plainly.
The 2026 baseline standards change what an AML system has to be: not just automated, but governed. Model ownership, independent validation, change control, explainability and demonstrable effectiveness, with the institution responsible regardless of which vendor built the model.
That is a model-governance regime in all but name, and it is the reason a spreadsheet programme cannot carry Nigerian AML any further: the mandate asks for a living register with a trail, not a PDF.
Where programmes are tested.
Model ownership
Every model named, owned and inventoried, with its purpose and limitations on the record.
Independent validation
Validation separated from development, with findings and revalidation tracked.
Change control and explainability
Changes approved before deployment, and decisions explainable to an examiner.
Demonstrable effectiveness
Evidence that the system works: testing, tuning and outcomes, not assertions.
Curated once, evidenced continuously.
- The baseline is curated in the catalog and maps pillar for pillar to the Model Governance module, with ISO/IEC 42001 cross-walked beside it.
- Requirements resolve to shared controls: implement a control once and it counts toward every framework it maps to.
- Status is evidence-gated: a requirement can't be marked implemented without valid, in-date evidence behind it.
- Every attestation carries maker/checker, and every action lands in an append-only audit trail.
CBN Automated-AML Baseline, asked plainly.
The questions compliance teams actually ask before an adoption decision or an audit.
What are the CBN Baseline Standards for Automated AML?
A 2026 mandate setting minimum standards for the automated systems doing AML/CFT/CPF work in supervised institutions: model ownership and inventory, independent validation, change control, explainability, and evidence of effectiveness. In substance, a model-governance regime for financial-crime systems.
Do the standards apply if our AML system is vendor-built?
Yes, fully. The baseline is explicit that the institution remains responsible for the system's governance and outcomes regardless of who built it, so vendor documentation does not substitute for your own inventory, validation records and change log.
What does demonstrable effectiveness mean in practice?
Evidence, not assertion: testing and tuning records, threshold rationale, outcome analysis and periodic review that show the system detects what it claims to detect. A model that has never been challenged is a finding waiting to be written.
How does ISO/IEC 42001 relate to the baseline?
42001 is the closest international standard to the baseline's shape, wrapping the same disciplines in a certifiable management system. The two are cross-mapped in the catalog, so one governance implementation carries the supervisory mandate and the international standard together.
Where it connects.
The full catalogCompliance you can prove.
Walk into your next audit ready.
Book a working demo. We'll map your obligations to the standards you're audited against and the regulators you actually answer to.
The platform, modules, catalog, audit trail and security architecture are live today; the continuous live-evidence engine is in active development, shown in a working demo. Reach us at hello@cardinalgrc.com.