Since June, some Nigerians have been able to buy airtime by typing a sentence into ChatGPT or Claude. Paystack’s new product, Index, lets early-access users ask an AI assistant to buy airtime and data, send money through Zap or order food from Chowdeck, and the payment completes inside the chat. Paystack calls it an experiment and does not expect real traction for at least a year. But the door is open. The person pressing ‘pay’ is no longer always a person.
That should get the attention of the Central Bank of Nigeria, because our fraud rules are written for a world where it is. Nigerian Banking Launch
Late last year, the CBN released draft guidelines for handling authorised push payment fraud, the scams where a customer is tricked into sending money themselves. The draft sets a 14-working-day limit on investigations, requires reimbursement within 48 hours of a concluded investigation, and splits the loss equally between the institutions involved when neither is at fault. For a country where NIBSS says social engineering remains the most common fraud technique, these are welcome steps.
But read the definition closely. The draft describes APP fraud as a case where a customer ‘is manipulated, persuaded, or misled to voluntarily make a payment to a third party’s account.’ The word ‘authorised’ is never defined. Neither is ‘customer’. There is no mention of software, APIs, automated payments or artificial intelligence. Reimbursement is excluded where the customer ‘acted fraudulently or with negligence’, and the customer must have had ‘no cause to suspect fraud’.
Now picture a case that will soon be ordinary. A customer tells her AI assistant to pay a supplier. The assistant reads a fake invoice planted on a web page and pays a fraudster instead. Nobody manipulated the customer. The software was manipulated. Did she ‘voluntarily’ make that payment? Was it negligent to give an assistant permission to pay at all? Under the draft as written, a bank could argue either way, and the customer would be the one waiting for an answer.
Other countries are asking the same question, and they are asking it now.
At Sibos in Miami on 29 September, US Federal Reserve Governor Christopher Waller put it plainly: ‘Who is on the hook if an agent makes the wrong purchase?’ He added, ‘Existing fraud detection and prevention systems, calibrated to human behaviour, may not translate well to agents.’ In July, the UK Treasury opened a consultation on modernising payment services regulation that asks whether the rules on consent, authentication and liability for unauthorised payments need updating for agent-initiated payments. It closed on 6 October. In April, an IMF note warned, ‘Traditional fraud models rely on human behavioural patterns.’ It recommended that regulators move from Know Your Customer towards Know Your Agent.
The industry is not waiting. On 9 September, Visa, Mastercard and Ant International announced joint work on a Know Your Agent framework, under which each agent is tied to a validated operator, cardholder or business, assessed against security requirements and monitored continuously. They will develop it through a platform convened by the Monetary Authority of Singapore. Mastercard has already launched a service that says it credentials every agent and enforces spending limits set by organisations.
Notice who is at that table. Singapore’s regulator is helping to write the standards that card networks will carry into every market, including ours. If Nigeria does not set its own position, we will inherit one designed for someone else’s consumers. Nigerian Banking Launch
As far as I can tell, the APP guidelines are still in draft. That makes this the cheapest moment to fix them. I would suggest five changes.
First, define ‘authorised’ so that it covers payments made by software acting under a customer’s instruction. The instruction should be recorded as a mandate, showing what the agent may buy, from whom, up to what amount and until when.
Second, allocate liability by the mandate. If the agent paid within the mandate to a payee and the amount the customer approved, the customer carries the outcome. If the agent paid outside it, the institution that accepted the payment without checking the mandate should carry the loss. And a manipulated agent should be treated like a manipulated customer, as fraud, not as negligence. Giving an assistant permission to pay should never, on its own, count as carelessness.
Third, make agent payments visible. NIBSS has just announced a new national payment stack built on ISO 20022, the messaging standard that carries far richer payment data. A simple field flagging that a payment was initiated by an agent, with an identifier for that agent, would let banks, NIBSS and the CBN see what is happening instead of guessing.
Fourth, add that flag to the quarterly fraud returns the draft already requires. Within a year, we would know how many agent payments go wrong and why.
Fifth, test before scaling. The IMF recommends supervised testing for agentic payments. The CBN already runs a regulatory sandbox. Products like Index should be able to grow inside it, with clear rules, rather than outside it with none.
Nigeria knows how to move early. NIBSS says its instant payment system handled 11.2 billion transfers in data published this year. We do not need to wait for Washington or London to finish their consultations. We need to make sure that when a Nigerian’s assistant presses ‘pay’, the law knows who pressed it. Nigerian Banking Launch
Tosin Folarin is a payment strategy leader who has driven regional product growth, monetisation modelling, and card scheme strategy across West Africa for major financial technology organisations. Drawing on his foundational management consulting experience and his track record of scaling digital infrastructure, Tosin brings an authoritative, practical perspective to discussions on emerging payment technologies and regulatory policy.