PSV 2028: The Architecture, the Enablers, and the Joints It Lives or Dies

The Central Bank of Nigeria has published a blueprint for the future of Nigerian financial services. Most commentary is reading it as regulation. That reading is not wrong, but it is incomplete. The businesses that will finish the decade strongest are those reading it as something else entirely: an architecture with named load-bearing walls, quantified performance benchmarks, and dependencies that live outside the CBN's direct authority.

This analysis takes that second view. It walks through what the Nigeria Payments System Vision 2028 actually says, then examines the six thematic angles where its ambition meets the operational reality of Nigerian financial services. It closes with the enablers most commentary is ignoring: the agent framework overhaul of October 2025, the hard-won lessons of the ₦300 billion USSD dispute, and the identity infrastructure legally recast by the NIMC Act 2026.

PSV 2028 is coherent. It is quantified. It is ambitious. Whether it becomes real infrastructure over the next three years depends less on what the CBN mandates and more on whether the joints between regulators, operators, and enablers hold.

The technology investment gap in Nigerian business

What PSV 2028 Actually Is

What the CBN mandates. Full migration to the ISO 20022 messaging standard by 2026. Implementation of a National Open Banking Registry (NOBR) with standardised APIs for Tier-1 and Tier-2 banks. 100% interoperability across licensed PSPs. Adoption of the National Payment Stack (NPS) as the modernised replacement for legacy rails. A benchmark of 99.999% system uptime for customer-facing channels; the "five nines" standard familiar to any enterprise infrastructure architect.

Why it matters. ISO 20022 is not a compliance chore. It is the messaging foundation on which every downstream capability in PSV 2028 rests: real-time analytics, cross-border settlement via PAPSS, AI-driven fraud monitoring, SupTech automation. Institutions that migrate cleanly build the substrate for everything else. Institutions that treat it as a box-ticking exercise create technical debt they will spend the rest of the decade paying down.

Similarly, Open Banking under the NOBR is not a fintech-facing courtesy. It is the mechanism through which consented data becomes a resource for credit scoring, risk management, embedded finance, and customer experience. Banks that participate reluctantly hand competitive ground to institutions that participate strategically.

Who wins, who scrambles. The winners are banks and PSPs that treat the migration as a technology transformation programme, not a compliance project. These are institutions with dedicated architecture leadership, ISO 20022-fluent integration teams, and clear API strategies for participating in the Open Banking ecosystem. The scramblers are institutions still running core banking on legacy platforms with limited API surface area, treating each PSV 2028 mandate as a separate initiative rather than a coherent modernisation.

The decision on your desk this quarter. If your organisation touches money in Nigeria and you have not yet appointed a senior owner for ISO 20022 migration with board-level visibility, you are already behind. The 2026 deadline is closer than it looks once you factor in the readiness assessment, the integration testing, and the operational go-live windows. This is a Q3 2026 board conversation at the latest.

Every major Nigerian regulatory document deserves to be read on its own terms before it is interpreted through anyone else's frame. PSV 2028 is no exception.

The vision. By 2028, Nigeria operates "a secure, inclusive, innovative, and interoperable payments ecosystem that supports national economic development and integrates effectively with regional and global markets." Read carefully: this is not a domestic modernisation programme. It is a positioning statement. The CBN is declaring intent for Nigeria to be a regional and global payments participant, not just a national one.

The mission. Five operational commitments underpin the vision: strengthening regulatory oversight to protect consumers, fostering innovation through enabling policies, promoting financial inclusion, ensuring efficiency and interoperability across platforms, and driving collaborative stakeholder engagement. These are the things the CBN commits to do to deliver the vision.

The six guiding principles. Every initiative in PSV 2028 is anchored to six principles that shape how it should be designed:

1. Interoperability as default: open standards enabling frictionless value flow across platforms, institutions, and borders.

2. Security by design: comprehensive controls upholding confidentiality, integrity, and availability.

3. Inclusion first: universal and affordable access as the mandatory baseline, prioritising women, youth, MSMEs, and rural users.

4. Innovation with purpose: modern technologies (APIs, ISO 20022, AI, CBDCs) adopted where fit-for-purpose, not as decoration.

5. Trust through transparency: institutionalised SLAs, open dashboards, enforced data rights, and consistent redress mechanisms.

6. Collaboration for scale: regulators, operators, state governments, and civil society aligned on shared outcomes.

The five thematic pillars. PSV 2028 organises its interventions under five strategic themes: Cross-Border Payments and CBDC Integration; Digital Financial Inclusion, Consumer Protection, and Financial Literacy; Infrastructure, Interconnectivity, and Interoperability; Innovation, Digital Assets, and Emerging Technologies; and Regulation, Risk Management, and Cybersecurity.

The quantified outcomes. This is where PSV 2028 differs materially from its predecessors. Every strategic ambition is tied to a specific numeric target with a specific deadline. The KPIs give PSV 2028 something PSV 2020 and PSV 2010 never had: measurable accountability. Whether every target is achievable is a separate question. The point is that the CBN has now made it possible for markets, media, and the CBN itself to know unambiguously whether the vision has been delivered.

Six angles capture where the analytical action sits. They map onto the CBN's five pillars, but not identically, since a few pillars are dense enough to warrant more than one angle. The framing that follows is HAP Consulting Nigeria's lens on the document, not the document's lens on itself.

What the CBN mandates. A 70% reduction in fraud losses by 2028. Establishment of a National Payment Security Operations Centre (P-SOC) to coordinate threat intelligence and incident response across the financial sector. Automated compliance feeds delivered in real time to the CBN by 2028. AI-driven fraud monitoring and participation in a national fraud intelligence-sharing platform. Explicit alignment with the Financial Action Task Force framework, which Nigeria exited from the grey list only in 2025 and which PSV 2028 acknowledges as a re-entry risk if the fraud picture does not improve.

Why it matters. The numbers underpinning this angle are not hypothetical. Nigerian fraud losses were reported at ₦52.3 billion in 2024. That is the baseline PSV 2028 commits to reducing by 70%. Behind that headline sits a more uncomfortable observation the document makes explicitly: cybersecurity coverage across fintechs and agent networks is uneven, and consumer redress mechanisms remain weak. The framework's own language is instructive: "inclusion without trust is fragile."

The FATF context sharpens the stakes. Nigeria's 2025 exit from the grey list was hard-won. Re-entry would be materially damaging to correspondent banking relationships, cross-border settlement flows, and the country's positioning as the ECOWAS financial hub. PSV 2028 treats cybersecurity and AML not as compliance exercises but as sovereign competitiveness.

Who wins, who scrambles. Winners are financial institutions that have already invested in mature security operations, threat intelligence programmes, and integrated fraud analytics, and whose boards understand that the security posture is a board-level risk, not an IT department preoccupation. Scramblers are institutions still running fragmented security tooling, relying on point solutions rather than an integrated stack, or treating fraud monitoring as a reactive function rather than a predictive one.

The decision on your desk this quarter. Two questions your board should be able to answer. First: what is your organisation's current baseline for fraud losses as a percentage of transaction volume, and what is your credible plan to reduce it by 70% over 24 months? Second: are your security operations ready to plug into the P-SOC when it stands up, or will you be scrambling to build integration under pressure? Both answers should exist in writing.

What the CBN mandates. Formal financial inclusion rising to 95% by 2028, up from approximately 64% today. Digital payment adoption among adults growing from 52% to 80%. MSMEs, women, youth, and rural communities named explicitly as priority segments. 100% Local Government Area coverage by 2028 for agent banking, meaning every LGA in Nigeria has functional access to formal financial services through certified agents. Closing the gender gap in access, with an explicit focus on the 21 million currently excluded women. A National Agent Quality Framework defining SLAs for agent liquidity and uptime.

Why it matters. The inclusion mandate is often read as a marketing story. It is not. It is an infrastructure story wearing a social-policy dress.

Getting from 64% to 95% formal inclusion in three years requires a physical presence across every LGA in the federation. That means agent networks: POS terminals, biometric-capable devices, offline-functional hardware for areas with unstable power and internet, shared cash-management corridors for rural liquidity, and dedicated communication channels (PSV 2028 explicitly floats an MVNO model for financial services). It means National Device Programs to distribute locally-manufactured secure smartphones and POS units to underserved cohorts. It means offline wallets and Bluetooth/NFC-based micropayments for areas without stable connectivity. It means feature-phone fallbacks that keep service continuity when smartphones and data fail.

None of this is soft infrastructure. All of it requires hardware, distribution, servicing, cash management, and technical support. The demand implication for banks, super-agents, POS vendors, telecom operators, and secure device manufacturers is enormous, and it materialises over the next 24 months.

Who wins, who scrambles. Winners are institutions that treat agent banking as core distribution strategy rather than a side channel. Institutions building serious super-agent networks under the new October 2025 rules. Institutions investing in offline-capable technology stacks and rural liquidity management. Institutions with intentional strategies for women-agent recruitment and retention, which the document identifies as a critical driver for closing the gender gap.

Scramblers are institutions running under-invested agent networks with high abandonment rates, weak SLA discipline, and no strategy for the segments PSV 2028 names as priority. The mystery-shopping audits the framework introduces will surface these weaknesses publicly.

The decision on your desk this quarter. If you are a Nigerian bank or PSP, do you have a documented plan for 100% LGA coverage by 2028? Not a target. A plan, with geographies, agent numbers, liquidity strategies, uptime commitments, and named accountability. If your answer is no, that plan needs to exist by end of Q4.

What the CBN mandates. 80%+ Payment Service Provider adoption of biometric and vein-based authentication. Full BVN-NIN harmonisation, with 95% of financially active adults holding verified NIN-BVN digital IDs. On-device biometric payments as a standard channel. Dual offline-capable biometric cards and devices for Government-to-Person disbursements and routine cash-out at agent locations for populations with limited smartphone access.

Why it matters. This is the angle where PSV 2028 stops being just a payments document and becomes a national identity infrastructure document. The 80% biometric authentication target sits on top of BVN-NIN harmonisation, which sits on top of NIMC's operational capacity to enrol Nigerians at scale. The infrastructure is not just a security measure; it is Nigeria's clearest path to a genuine unique-identifier system that mitigates identity theft, streamlines KYC, and unlocks credit for the previously invisible.

BVN enrolments reached 67.8 million by end of 2025, up from 63.5 million in 2024; a steady trajectory. NIN enrolment continues to expand. The direction of policy travel is clear: Nigeria wants a single, sovereign, biometrically-anchored digital identity that every citizen holds and every institution can verify in real time.

Who wins, who scrambles. Winners are institutions with clean digital ID linkage across their customer base, biometric-capable device deployments, and the technology stack to consume NIMC's verification APIs at scale. Scramblers are institutions with fragmented customer databases, incomplete NIN-BVN linkage, and legacy KYC processes that assume paper.

The decision on your desk this quarter. What percentage of your active customer base holds fully verified, linked NIN-BVN records today? If the answer is less than 90%, you have work to do before the mandate takes hold. If the answer is unknown, the audit starts this week.

What the CBN mandates. The establishment of a National RegTech and SupTech Lab. Machine-readable regulatory rulebooks in JSON and XML formats; a genuinely significant shift from PDF-and-circular regulation. AI-driven fraud analytics dashboards. Predictive risk models integrated into supervisory workflows. Explicit encouragement of stablecoin regulation, Virtual Asset Service Provider (VASP) frameworks, and programmable payments. The eNaira is named as a core payment rail with intended programmable-money features: split payments, time-bound usage, and conditional disbursement.

Why it matters. This is the clearest signal in the entire document that AI adoption in Nigerian financial services will be regulatory-driven, not optional. When regulators publish rulebooks in machine-readable formats, they are announcing that compliance itself will become programmable. Institutions with the internal capability to consume and act on machine-readable regulation gain a durable operational advantage. Institutions still processing regulatory guidance manually will be systematically slower to market and systematically more expensive to run.

The eNaira story deserves honest treatment. PSV 2028 acknowledges what everyone already knew: adoption has been slow. The document names the reasons: limited stakeholder engagement, insufficient real-economy use cases, weak merchant onboarding. The vision going forward is to make eNaira the rail for G2P disbursements, subsidies, and programmable government payments. Whether this succeeds depends on whether the CBN and the fiscal authorities can align on operational delivery, and whether the private sector sees enough value to build meaningfully on the rail.

Who wins, who scrambles. Winners are institutions with data science and machine learning capability already embedded in their compliance and risk functions, and the technology strategy to make machine-readable regulation a competitive advantage rather than an integration burden. Scramblers are institutions still treating AI as an experimental sandbox project rather than an operational necessity, and those without clear positioning on stablecoins and virtual assets as PSV 2028 forces the regulatory picture into focus.

The decision on your desk this quarter. Is AI in your organisation a strategic capability or a proof-of-concept? PSV 2028 makes clear that the former will be table stakes by 2028. If your organisation does not yet have named AI capability leadership at senior level, that appointment is overdue.

What the CBN mandates. 50% year-on-year transaction volume growth through the Pan-African Payment and Settlement System (PAPSS). 75% bank adoption of PAPSS across ECOWAS by 2028. Nigeria positioned as the regional settlement hub for pan-African trade under the AfCFTA framework. Formal remittance inflows growing 25 to 35% (approximately $5 to $7 billion annually), with transaction costs reduced to below 5%. Bilateral CBDC corridors piloted with selected African partners for programmable cross-border payments.

Why it matters. This is the pillar where PSV 2028's ambition to position Nigeria internationally becomes most concrete. If PAPSS adoption meets the targets, Nigeria becomes the operational hub through which a material share of intra-African trade settles. That is not a minor prize. It concentrates FX flows, foreign correspondent relationships, and financial-services capability inside Nigeria's borders in a way that reinforces every other pillar of the vision.

The remittance angle is the more immediate opportunity. Nigeria receives more than $20 billion in remittances annually. Formalising a larger share of that flow and reducing transaction costs from current double-digit levels to below 5% would put billions of dollars back into consumer hands each year. This is the pillar with the shortest path from mandate to measurable citizen impact.

Who wins, who scrambles. Winners are banks with genuine correspondent banking capability and PAPSS integration already in flight. Fintechs building cross-border rails on top of the emerging infrastructure. Nigerian businesses with cross-border trade or remittance exposure who position now for the settlement hub reality. Scramblers are institutions still treating cross-border as niche when PSV 2028 has made it core.

The decision on your desk this quarter. For any Nigerian business with pan-African ambitions, whether in trading, remittance, or professional services, the settlement infrastructure is being built now. Positioning happens before the infrastructure lands, not after. If you have not yet mapped what PAPSS-native operations look like for your business, that mapping starts this month.

Enabler 1: The Agent Framework Overhaul

The third enabler is where PSV 2028 becomes genuinely consequential, because it is where the architecture connects to sovereign infrastructure being built at the same moment.

On 8 July 2026, President Bola Tinubu signed the NIMC Act 2026 into law. The Act repeals and replaces the 2007 framework in full. It establishes the National Identification Number as Nigeria's sole recognised means of identification under a "One Person, One Identity" policy. It mandates database integration across government agencies. It introduces zero-tolerance penalties for identity fraud. And it creates the legal architecture for the General Multipurpose Card, a physical card combining identity, financial services, and access to public services in a single credential.

Read alongside PSV 2028, the Act is the missing legal spine. PSV 2028's biometric authentication targets, its BVN-NIN harmonisation ambitions, and its plans for on-device biometric payments all now rest on statute rather than administrative guideline. The NIMC Director-General has publicly confirmed that the NIN is now the master identity, with sector-specific identifiers like BVN linked to it, so that banks, telecoms operators, insurance companies, and fintechs authenticate customers through NIMC's real-time verification platform.

By the end of 2025, 67.8 million BVN enrolments were on record, an increase of 4.3 million on the prior year and a clear upward trajectory. NIN enrolment continues in parallel. The direction of travel is unambiguous: Nigeria is building the most integrated national identity infrastructure in any major African economy.

But direction of travel is not the same as arrival. The July 2026 reporting in Vanguard is honest about the gap between claimed integration and operational reality. The NIMC's real-time verification platform exists in principle, and the legal architecture now sits in the NIMC Act. But operational performance across all sectors is uneven: verification latency, database consistency across agencies, and platform capacity under peak load remain genuine open questions. If NIMC's operational capacity does not scale to the volumes PSV 2028 assumes, the 80% biometric authentication target slips. If it does scale, Nigeria will have delivered something rare: a working national digital identity that mitigates identity theft, streamlines KYC, and unlocks credit for the invisible.

Named honestly, this is the most fragile joint in the PSV 2028 architecture. Framed forward, it is Nigeria's clearest path to identity sovereignty. Both readings are true, and serious strategy has to hold both simultaneously.

No serious analysis of PSV 2028 can conclude without acknowledging what the document itself acknowledges. The framework is ambitious. It is also constrained by realities that do not disappear because they are named.

Infrastructural bottlenecks remain material. Unreliable power and weak internet connectivity in rural areas continue to undermine the reliability of high-tech solutions. Offline wallets, feature-phone fallbacks, and dedicated communication channels are all in the document precisely because the underlying infrastructure is not yet dependable enough for pure online-first solutions. This is why the National Device Programs and MVNO-for-financial-services proposals matter.

The trust deficit is real. ₦52.3 billion in fraud losses in 2024. Weak consumer redress mechanisms. Social engineering fraud outpacing user understanding of new products. PSV 2028's line, "inclusion without trust is fragile," is not rhetoric. It is diagnosis. Every institution should read it as a direct challenge to its own consumer protection practices.

Financial and digital literacy remain the softest joint. Nigeria has among the lowest financial literacy rates in Sub-Saharan Africa. Sophisticated fintech products routinely outpace user understanding. Inclusion mandates that do not carry serious literacy investment risk producing users who are formally included but functionally excluded.

Regulatory harmonisation is genuinely difficult. The CBN, SEC, NDPC, NCC, and NIMC each play essential roles in the PSV 2028 architecture. Their coordination is improving; the USSD resolution and the NIMC Act 2026 are evidence. But fragmentation remains a live risk. Fintechs and innovators are frequently caught between overlapping mandates.

System resilience is a moving target. Transaction volumes are growing faster than infrastructure investment in some areas. The 99.999% uptime benchmark is a stretch target for institutions still running on architecture designed for a fraction of current volumes.

Compliance with international standards is only partial. CPMI-IOSCO Principles for Financial Market Infrastructures alignment is incomplete, with notable gaps in cyber resilience and cross-border oversight.

These are not reasons to discount PSV 2028. They are the reasons the framework matters. The vision is credible precisely because it names the constraints and commits to addressing them. Whether it succeeds depends on whether the addressing gets done.

The Central Bank of Nigeria has published a document that sets out, in 132 pages, what Nigerian financial services should look like by the end of 2028. It has quantified the outcomes. It has named the pillars. It has articulated the principles. And it has, more clearly than any predecessor, made the commitments measurable.

What the document cannot do is deliver itself.

The delivery depends on the six angles being read not as separate mandates but as a coherent architecture. On the three enablers, being the agent framework, MNO layer, and identity infrastructure, holding at the joints. On the CBN's coordination with the NCC, NIMC, SEC, and NDPC being pre-emptive rather than reactive. On banks, fintechs, PSBs, super-agents, and enterprise businesses positioning now for what PSV 2028 makes clear rather than reacting later to what PSV 2028 will have made real.

The businesses reading PSV 2028 as compliance are reacting. The businesses reading it as architecture are positioning. Between now and the end of 2028, the second group will be building the infrastructure that the first group ends up buying access to.

That is the strategic choice on the table. It is available today. It closes fast.

Enabler 2: The MNO Layer and the USSD Lesson

The CBN did not wait for PSV 2028 to rewrite the agent banking rulebook. On 6 October 2025, it issued the Guidelines for the Operations of Agent Banking in Nigeria, replacing both the 2013 agent-banking guidelines and the 2015 super-agent framework with a single consolidated document. The provisions are sweeping. Super-agents are now prohibited from offering agent banking services directly. Their role is restricted to recruiting, aggregating, and managing agent networks on behalf of Principal financial institutions. Individuals may now be appointed directly as agents, but they cannot appoint or manage other agents. Transaction limits are tighter: ₦100,000 daily and ₦500,000 weekly for cash-in, cash-out, and bill payments; ₦1.2 million daily cash-out limit for agents themselves. From 1 April 2026, agents must operate exclusively for a single Principal.

Every operating provision came into force immediately on issue. The exclusivity clause takes effect in April 2026.

This is not a footnote to PSV 2028. It is the delivery mechanism for the 95% inclusion target. Every POS agent in a rural community is now a PSV 2028 endpoint. The framework says who owns those endpoints, who monitors them, how they are branded, how they are paid, and how their SLAs are enforced. The institutions and super-agents that build strong compliant networks under these rules are the institutions that deliver the inclusion numbers. Those treating agent banking as a side channel miss the target, and the mystery-shopping audits PSV 2028 introduces will make the underperformance publicly visible.

The agent framework is where PSV 2028's inclusion ambition meets its distribution reality. Every strategic conversation about the inclusion pillar should now start with the October 2025 Guidelines.

The most instructive story in recent Nigerian financial services is not in PSV 2028 at all. It is the ₦300 billion USSD debt dispute between deposit money banks and mobile network operators, resolved in early 2026 after five years of accumulated liability, regulatory intervention, and near-catastrophic operational disconnection.

The story has two readings, and PSV 2028 needs both.

The precedent reading. The dispute was ultimately resolved. Joint intervention by the CBN and the NCC in December 2024 produced a structured settlement framework: 60% of pre-API invoices paid as full and final settlement; 85% of post-API invoices cleared within one month of issuance; an end-user billing model that transferred USSD charges from bank invoicing to direct customer airtime deduction. By February 2026, the debt was cleared and the ecosystem had transitioned to a sustainable framework at ₦6.98 per 120-second session. Regulatory coordination worked when it was forced.

The cautionary reading. It took five years. It accumulated nearly ₦300 billion in commercial debt. It required an NCC ultimatum threatening the disconnection of nine banks. It exposed millions of Nigerian consumers to potential loss of access to essential mobile banking. And it produced material reputational damage to both the banking and telecommunications sectors that will take longer to recover from than the ₦300 billion took to settle.

PSV 2028 has dozens of joints structurally similar to the USSD dispute: interfaces where two regulatory regimes, two commercial sectors, and two operational cultures must find a common settlement mechanism. The lesson to draw is not that the USSD story ended well. The lesson is that pre-emptive multi-regulator coordination is materially cheaper, faster, and less damaging than reactive intervention.

The MNO layer itself is the second half of this enabler story. MTN, Airtel, and 9Mobile between them reach demographics that no bank branch or POS agent reaches cost-effectively. Their Payment Service Bank licences give them a seat at the table, but the deeper play is collaborative Memoranda of Understanding with financial institutions on USSD access, agent overlay, distribution reach, and eventually on QR/NQR, offline payments, and biometric enrolment. The NCC's role in brokering these MOUs is not incidental; it is central.

In Closing

The Synthesis: Why the Six Angles Are Interdependent

The analysis above is the strategic picture. Below is where it lands for specific organisational contexts.

What This Means for Your Business

Enabler 3: Identity Infrastructure and the NIMC Act 2026

Reading the six angles separately, it is easy to see PSV 2028 as a catalogue of independent mandates. Reading them together, a different picture emerges.

Every one of the six angles translates into three underlying infrastructure demands. The first is local hardware and compute capacity: servers, secure devices, POS terminals, biometric hardware, and eventually the data centres to support real-time analytics and AI workloads at national scale. The second is integration and API-first architecture: the messaging, connectivity, and interoperability substrate that makes ISO 20022, Open Banking, PAPSS, and NIMC verification work as a coherent whole. The third is identity and authentication infrastructure: the biometric, cryptographic, and legal machinery that lets every counterparty know who they are dealing with in real time.

If your business touches money in Nigeria, you have work to do on all three. Not sequentially. In parallel. The organisations that will finish the decade strongest are those investing in all three foundations at once, understanding that each one enables the others.

That is the frame the CBN itself does not explicitly draw in the document. The six angles are drawn as five thematic pillars in PSV 2028. But read the pillars alongside the six principles, and the underlying architecture becomes clear: hardware, integration, and identity as the three load-bearing walls, with the six principles as the design discipline running through all of them.

This is why "compliance" is the wrong reading. Compliance implies reacting to a set of separate rules. Architecture implies building coherent capability across an integrated set of foundations. The businesses reading PSV 2028 as an architecture are the ones that will still be delivering on it in 2029.

The Honest Constraints

Address

3rd Floor, AXA Mansard Place,
Plot 927/928, Bishop Aboyade Cole,
Victoria Island,
Lagos, Nigeria

Contacts

+234-201-330-4318; +234-806-700-1171
hello@hapconsulting.ng

Our Privacy Policy