For a long time, compliance in Nigeria was treated as a formality. Companies kept a policy document somewhere on a shared drive. Directors signed off on things they did not fully read. Lawyers and accountants processed transactions and told themselves that due diligence was the client’s problem. That arrangement has become expensive.
The legal framework has not changed dramatically in character, bribery was always illegal, money laundering was always prosecuted. What has changed is the seriousness of enforcement, the sophistication of the agencies involved, and the willingness of prosecutors to go after individuals rather than stopping at the institutional level. The cases filed in 2024 and 2025 make the point plainly. In June 2025, the EFCC arraigned the Managing Director and Executive Director of SunTrust Bank before the Federal High Court on six counts of money laundering totalling $12 million. Not the bank in isolation; the individuals.
That is the direction things are moving.
The Laws That Govern This Space
Several statutes operate simultaneously, and understanding their relationship matters.
The EFCC (Establishment) Act 2004 created the Economic and Financial Crimes Commission, which began operations in 2003. Its mandate covers money laundering, advance fee fraud, counterfeiting, illegal fund transfers and economic and financial crimes broadly defined. The breadth is intentional and has been interpreted expansively in practice.
The ICPC (Establishment) Act 2000 established the Independent Corrupt Practices and Other Related Offences Commission. Unlike the EFCC, which focuses on financial crimes generally, the ICPC is specifically concerned with corruption; bribery, gratification and related offences in both public and private sector dealings. The statute applies to companies as well as individuals. The person who pays a bribe and the person who receives one both face exposure under this Act.
The Money Laundering (Prevention and Prohibition) Act 2022 replaced the previous legislation from 2011 and significantly extended the compliance obligations applicable to what the statute terms Designated Non-Financial Businesses and Professions, DNFBPs. Law firms, accounting practices, notaries, estate agents, dealers in high-value goods and casino operators now carry customer due diligence obligations, ongoing monitoring requirements and a duty to report suspicious transactions to the Nigerian Financial Intelligence Unit. These are not obligations that can be delegated and forgotten.
They are continuing statutory duties with criminal consequences for non-compliance.
The Companies and Allied Matters Act 2020 provides the underlying corporate governance framework through which liability is assessed.
Section 308 sets the objective standard of care expected of every director, the degree of care, diligence and skill that a reasonably prudent director would exercise in comparable circumstances. Section 282(3) addresses board liability for decisions. These provisions are the standard against which a director’s conduct in any corruption-adjacent situation will be measured.
What Corporate Liability Actually
Means for Directors
Nigerian law attaches criminal liability to companies. But it does not stop there.
The mechanism that matters most for directors is what lawyers call the directing mind and will doctrine; the principle that where an offence is committed by the corporation acting through its senior management, the individuals behind those decisions carry personal liability alongside the institution. The MLA 2022 makes this explicit: where a corporate offence is attributable to the negligence, deliberate involvement or knowledge of a director, managing personnel or officer, both the company and the individual are subject to prosecution. Upon conviction of the body corporate, the court may order it wound up and its assets forfeited to the Federal Government.
What does this look like in practice? A director who tolerates irregular payment arrangements without investigating them. A board that excludes the compliance function from transactions involving politically connected counterparties. An executive who approves a transaction without verifying who ultimately owns the entity on the other side of the deal. A senior officer who is aware of warning signs and decides not to ask questions. Each of these is a form of exposure; not institutional exposure alone, but personal exposure.
The SunTrust Bank arraignment is worth dwelling on. The executives charged were not accused of direct fraud. They are accused, in their individual capacities, of money laundering related offences.
The regulatory and prosecutorial message is clear: holding a title without exercising oversight over what happens beneath it is not a defence.
The Obligations That Fall on Professional Service Firms
The MLA 2022’s expansion of the DNFBP category is one of the most significant developments in Nigerian compliance law in recent years, and it is still not fully understood in the professional services sector.
The supervisory authority for DNFBPs is SCUML: the Special Control Unit Against Money Laundering, established under the EFCC with specific responsibility for registering, monitoring and enforcing compliance among non-financial businesses and professions. A law firm, accounting practice or estate agency that has not engaged with SCUML is already non-compliant.
The substantive obligations under the Act are as follows.
Customer Due Diligence must be conducted before establishing any business relationship or carrying out transactions above the statutory thresholds; currently N10 million for corporate bodies and N5 million for individuals. This means verifying the client’s identity, understanding the purpose and nature of the proposed engagement, and establishing who ultimately owns and controls the client entity. These steps must be completed before work commences, not after.
Enhanced Due Diligence applies where the client is a politically exposed person or where the relationship presents elevated money laundering risk. The Act requires not merely that enhanced steps be taken, but that they be documented. An undocumented EDD review is, for enforcement purposes, no EDD review at all.
Suspicious Transaction Reporting is the obligation that most firms handle least confidently. Where a firm knows, suspects, or has reasonable grounds to suspect that a transaction involves the proceeds of unlawful activity, it must file a suspicious transaction report with the NFIU.
This duty operates regardless of client confidentiality, the statute is explicit on this point.
Failure to file where filing was required is itself a criminal offence.
Record retention must extend to at least five years. Transaction records and all CDD documentation must be preserved and available for inspection.
Beyond these, every DNFBP must maintain a functioning AML compliance programme, appoint a compliance officer with actual authority and resources, and ensure staff are trained on their obligations under the Act. A compliance programme that exists only on paper will not protect the principals of the firm when SCUML comes to inspect.
Nigeria’s International Enforcement
Reach
The domestic framework does not operate in isolation, and businesses that assume overseas structures or assets place them beyond the reach of Nigerian enforcement are mistaken.
Nigeria placed on the FATF increased monitoring list; the grey list, some years ago, and the legislative reforms of recent years, including the MLA 2022 and the strengthening of the NFIU, were driven directly by the conditions FATF set for removal from that list. Enforcement intensification was not a coincidence of political will. It was a condition of Nigeria’s rehabilitation in the international financial system.
Nigeria is a member of GIABA, the FATF-style regional body for West Africa, and the NFIU is a member of the Egmont Group – the international network of 177 financial intelligence units through which member agencies exchange intelligence.
Nigeria’s membership of the Egmont Group has not always been secure: the NFIU was suspended in 2017 over concerns about its operational independence, before legislative reform secured readmission in 2018. In June 2024, the NFIU was elected vice-chair of the Egmont Group, a position that reflects both the institution’s recovery and Nigeria’s growing role in international AML cooperation.
Through bilateral mutual legal assistance agreements and the Egmont network, the EFCC and ICPC can obtain freezing orders on overseas assets, beneficial ownership disclosures from foreign registries, and the repatriation of recovered proceeds. An investigation that begins in Lagos does not end there.
What a Functioning Compliance
Programme Looks Like
There is a difference between a compliance programme that satisfies a regulator during an inspection and one that actually prevents misconduct from occurring. Boards that conflate the two will, eventually, discover the distinction through enforcement.
The elements of a programme that does both are not complicated, but they require consistent application.
An anti-corruption and anti-bribery policy must exist and must be communicated to everyone in the organisation with meaningful exposure to corruption risk. The fact that a policy was published on an intranet is not the same as communicating it.
A risk assessment must be specific to the business — its sector, its geography, its commercial relationships and the third parties through whom it operates. A risk assessment that could have been written for any company in any industry has not actually assessed the risk. Most enforcement cases that touch private sector companies begin with an agent, intermediary or introducer who was given authority to act on the company’s behalf without adequate scrutiny of how they exercised it.
Third-party due diligence must be proportionate to risk. The level of scrutiny applied to an agent who regularly interacts with public officials should be materially greater than the scrutiny applied to an ordinary commercial supplier. This distinction must be documented and applied consistently.
A gifts and hospitality policy must have limits that are enforced. Limits that are stated but not enforced are evidence of a policy that the company itself did not take seriously.
A whistleblowing channel must allow employees and third parties to report concerns without fear of retaliation. The relevant question is not whether the channel exists but whether anyone uses it. A channel that has never received a report, in an organisation of any meaningful size, is a channel that people do not trust.
Training must be substantive. Annual e-learning that employees click through in eight minutes is not training in any meaningful sense. Directors and staff in positions of material corruption risk should receive regular, scenario-based training relevant to the specific decisions they make.
Compliance audits must be independent, must produce written findings, and those findings must reach the board and be acted on. An audit whose findings are reviewed by the person being audited and then filed is not an audit.
What 2026 Actually Requires
The enforcement picture in Nigeria today is this: the agencies are better resourced and better connected internationally than they have been at any previous point. The legislative framework, following the MLA 2022, is more comprehensive.
SCUML is actively supervising professional firms.
The courts are receiving arraignments of senior executives, not just junior employees or institutional defendants. And the international intelligence-sharing infrastructure means that the proceeds of Nigerian offences, wherever they are held, are increasingly traceable.
Against that background, directors who have treated compliance as a reputational gesture, compliance officers who have been excluded from material decisions, and professional service firms that have processed transactions without asking difficult questions are carrying personal and institutional risk that is no longer hypothetical.
The legal obligations are specific, enforceable, and increasingly enforced. Meeting them is not optional.