CBN sets New ATM Deployment Ratio

The Central Bank of Nigeria (CBN) has unveiled new minimum standards governing the deployment, operation, maintenance and security of Automated Teller Machines (ATMs across the country).

The apex bank announced the directives in a circular titled “Exposure of the Draft Guidelines on the Operations of Automated Teller Machines (ATMs) in Nigeria”, released on Thursday, noting that the new framework supersedes all previous ATM-related regulations.

Under the revised guidelines, all card-issuing institutions are now required to deploy a minimum of one ATM for every 5,000 payment cards issued. The CBN directed that full compliance must be achieved within three years, with a phased implementation beginning in 2026, when at least 30 per cent of the requirement must be met. Full compliance is expected by 2028.

The CBN further stipulated that ATMs must be sited in locations that guarantee the safety and security of users, as well as the confidentiality of transactions. Machines are not to be installed outside buildings unless they are properly secured and bolted to the floor.

According to the circular, all ATM deployment, redeployment or decommissioning activities will now require prior written approval from the CBN. Independent ATM Deployers are also mandated to obtain written clearance from the regulator and meet licensing or registration requirements, including evidence of a partnership with a bank for cash provisioning.

On transaction failures and refunds, the CBN directed that reversals for on-us transactions—where customers use their own bank’s ATM—must be instant. Where technical issues prevent immediate reversal, manual refunds must not exceed 24 hours. For not-on-us transactions, involving the use of another bank’s ATM, refunds are to be completed within 48 hours.

The guidelines also require acquirers to implement automatic refund mechanisms that promptly initiate reversals for non-dispense errors without waiting for intervention from the issuing bank or the customer.

In terms of security, all ATMs must be equipped with cameras that record activities around the machine, including card insertion and cash withdrawals, while excluding customers’ keystrokes. Networks used for ATM operations must be tested and certified to ensure data confidentiality. The CBN also mandated the installation of anti-skimming devices on all ATMs to curb fraud.

ATM keys are to be changed annually, with strict instructions that the same keys must not be used across multiple machines. Customers, the bank added, must be allowed to change their Personal Identification Numbers (PINs) free of charge. All ATM deployers and acquirers are required to comply with the Payment Card Industry Data Security Standards (PCI DSS).

On operations and maintenance, the CBN stated that technical downtime for any ATM must not exceed 72 consecutive hours. Where this is unavoidable, customers must be duly informed. Cash availability at ATMs must be maintained at all times, with the responsibility resting solely on the bank that entered into a deployment agreement with any non-bank institution.

Banks are also required to clearly display helpdesk contacts, applicable charges and fees at ATM locations. Machines must issue receipts for all transactions requested by customers, except balance enquiries.

The CBN disclosed that it will conduct periodic audits and onsite checks to monitor compliance with the guidelines, including cash availability and service efficiency. All institutions are required to submit monthly reports on new ATM deployments to the regulator no later than the fifth day of the following month.

The apex bank warned that appropriate sanctions will be imposed on institutions that fail to comply with the new standards.