In an appeal presently pending before the Abuja Division of the Court of Appeal in Appeal No: CA/ABJ/CV/1460/2025, between Digital Rights Lawyers Initiative (Appellant) and NIBSS, the Central Bank of Nigeria (CBN), and the Attorney-General of the Federation (Respondents), the Central Bank of Nigeria has made a notable admission regarding the Bank Verification Number (BVN) scheme and its impact on citizens’ constitutional right to privacy.
![](https://thenigerialawyer.com/wp-content/uploads/2024/11/TheNigerialawyer-WhatsApp-Channel1.jpg")
The admission is contained in the CBN’s Respondent’s Brief of Argument filed on 27 January 2026, where the apex bank acknowledged that the BVN framework involves an interference with individuals’ privacy. The appeal arose from a judgment of the Federal High Court delivered on 4th July 2025 by Justice J.K. Omotosho in a suit instituted by the Nigeria Inter-Bank Settlement System (NIBSS) seeking judicial clarification on whether the BVN scheme violates the constitutional right to privacy.
Dissatisfied with the decision of the Federal High Court, the Digital Rights Lawyers Initiative filed an appeal before the Court of Appeal, challenging the lower court’s reasoning and conclusions on the privacy implications of the BVN regime.
In its brief before the appellate court, the CBN addressed the issue of privacy and the nature of the biometric data required under the BVN scheme. In doing so, the bank expressly acknowledged that the collection of biometric information constitutes an interference with personal privacy.
According to the CBN in its Respondent’s Brief of Argument:
“The Nature of the BVN ‘Intrusion’… By analogy, requiring bank customers to submit to biometric identification is a minor intrusion… To frame it clearly: Yes, there is an interference with individual privacy in the sense that information personal to an individual (their fingerprint, etc.) is being collected… The trial court’s reasoning, though phrased as ‘no infringement,’ can be understood to mean ‘no unjustified infringement.'”
By this submission, the CBN effectively conceded that the BVN scheme does interfere with the privacy of individuals, since it entails the compulsory collection of sensitive personal and biometric data from bank customers.
However, the apex bank’s argument before the Court of Appeal appears to be that while the BVN scheme interferes with privacy, such interference is minimal, proportionate, and justified in the interest of financial regulation, identity verification, and the prevention of financial crimes.
In its brief, the CBN submitted that the BVN system requires bank customers to provide certain personal data, specifically biometric information (fingerprints and photo) and some demographic details to their bank, which is then stored in a central secure database (managed by NIBSS) accessible to banks and regulators for identity verification.
“This undoubtedly involves the collection and processing of personal data, which engages privacy considerations. However, it is critical to note what the BVN system does not do; it does not involve surveillance of personal communications, it does not involve disclosure of one’s private correspondence, and it does not involve law enforcement rummaging through one’s home. It is a regulated data collection for a specific purpose,” the CBN stated.
In other words, the CBN’s position is not that privacy is unaffected, but rather that the interference does not amount to an unjustified or unconstitutional violation of the right to privacy.
According to the CBN’s brief, the Bank Verification Number (BVN) system was introduced in 2014 by the Central Bank of Nigeria, in collaboration with the Bankers’ Committee (an assembly of bank CEOs and regulators), as part of an initiative to enhance the security and integrity of the Nigerian banking system.
Under the BVN program, each bank customer is assigned a unique number linked to their biometric identifiers (fingerprints and photograph), which is used across the banking industry to verify identity and prevent fraud. The BVN system strengthens “Know Your Customer” (KYC) compliance and promotes a safe, reliable, and efficient payments system.
Pursuant to its statutory mandate to regulate banks and the financial system, the CBN issued the Regulatory Framework for BVN Operations and Watch-List for the Nigerian Banking Industry (Revised, 2021) (“the BVN Framework”) in exercise of powers conferred by the CBN Act 2007 and BOFIA 2020.
The Framework expressly designates the Nigeria Inter-Bank Settlement System Plc (NIBSS, the 1st Respondent) as the operator responsible for the day-to-day management of the central BVN database. NIBSS is a company jointly owned by the CBN and all licensed banks in Nigeria, established to provide inter-bank payments and settlement infrastructure.
Under Clause 1.5.2 of the BVN Framework, NIBSS is charged with maintaining the BVN database, ensuring its security, and providing verification services to financial institutions.
The CBN, however, retains oversight. Clause 1.5.1 of the Framework provides that the CBN has regulatory and oversight functions over the BVN system and must approve all framework and operating guidelines. In effect, NIBSS serves as a technical agent of the CBN for implementing the BVN system, under CBN’s supervision.
The CBN (as 2nd Defendant at trial) aligned with NIBSS’s position. The 2nd Respondent filed a comprehensive Counter-Affidavit and Written Address dated 11th February 2025 aligning with the position articulated in NIBSS’s Originating Summons.
In its filings, the CBN affirmed that the delegation of BVN database management to NIBSS is firmly rooted in statutory powers conferred on CBN via the CBN Act 2007 and BOFIA 2020. The CBN’s evidence outlined the objectives and legal basis of the BVN initiative, emphasizing that the BVN system was created to curb fraud and enhance the safety of the banking system.
It was also averred that bank customers supply their personal data (for BVN enrollment) voluntarily as a condition of accessing banking services, pursuant to lawful regulation and contractual terms, and that such data is kept confidential and used only for legitimate banking security purposes.
Upon being served, the Appellant (as Defendant at the trial court) entered a Notice of Preliminary Objection challenging the court’s jurisdiction, instead of filing any counter-affidavit on the merits of the Originating Summons.
The Appellant’s objection raised points of law, presumably arguing that the subject matter of the suit (alleged violation of privacy rights) was not appropriate for determination by Originating Summons and possibly questioning NIBSS’s locus standi or the justiciability of the questions posed.
The trial court, in a pragmatic move, heard the Appellant’s preliminary objection together with the substantive Originating Summons so as to determine all issues holistically.
On 4th July 2025, the learned trial Judge, J.K. Omotosho, J. delivered judgment in favor of NIBSS and CBN. The trial court dismissed the Appellant’s preliminary objection (implicitly affirming that the suit was competent) and granted all the declaratory reliefs sought by NIBSS.
In summary, the Federal High Court held that: (a) the CBN, by virtue of the CBN Act and BOFIA has the power to establish and regulate the BVN system, including delegating operational aspects to NIBSS; (b) NIBSS’s management of the BVN database is lawful and does not violate citizens’ right to privacy under Section 37 of the Constitution; and (c) given the importance of the issue and to forestall multiple suits, the judgment is one in rem, binding on all persons unless overturned on appeal.
In fact, the trial court issued a perpetual injunction restraining the Appellant (and indeed any other person) from challenging NIBSS’s role in managing the BVN database in the future.
Dissatisfied with this outcome, the Appellant initiated the present appeal. Two Notices of Appeal were initially filed on 12th and 13th August 2025; the Appellant has elected to proceed with the latter notice (dated 13/8/2025) which contains four grounds of appeal.
In its Brief of Argument filed on 24th of October, 2025, the Appellant distilled four Issues for Determination from these grounds. These issues question, in substance: (1) the correctness of the trial court’s reliance on CBN’s enabling statutes vis-à-vis the National Identity Management Commission (NIMC) Act and the Exclusive Legislative List in the Constitution; (2) the propriety of the trial court treating the Appellant’s failure to file counter-affidavit as an admission on points of law; (3) whether the trial court erred in holding that the BVN scheme does not infringe the constitutional right to privacy; and (4) whether the trial Judge was wrong to characterize his decision as a judgment in rem that precludes further litigation on the matter.
These four issues form the basis of the arguments addressed in the CBN’s Respondent’s Brief.
The CBN submitted that the learned trial Judge was correct in law to affirm the CBN’s power to establish and regulate the BVN system. The BVN initiative and the designation of NIBSS as the database operator are solidly grounded in CBN’s statutory mandate.
The trial court’s reliance on the CBN Act 2007 and BOFIA 2020 was well-placed. Furthermore, there is no conflict between the BVN scheme, and the constitutional or statutory provisions cited by the Appellant, indeed, the relevant laws operate harmoniously.
First, the CBN Act, 2007, which is an Act of the National Assembly, explicitly charges the Central Bank with the responsibility of promoting and ensuring a sound financial system in Nigeria. Section 2(d) of the CBN Act states that one of the principal objects of the Bank is “to promote a sound financial system in Nigeria.”
This broad mandate undoubtedly encompasses the authority to introduce measures that enhance the integrity and security of banking operations. By creating a centralized identification system (the BVN) to curb fraud and identity theft in the banking sector, the CBN was acting squarely within its statutory purpose of promoting sound banking practices and protecting the banking public.
Furthermore, in addition to its general mandate, the CBN Act and BOFIA contain specific provisions that empower the CBN to implement systems like the BVN. Notably, Section 47(2) of the CBN Act 2007 provides that “notwithstanding the duty to facilitate clearing of cheques, and in furtherance of Section 2(d) of this Act, the Bank shall continue to promote and facilitate the development of efficient and effective systems for the settlement of transactions (including the development of electronic payment systems).”
This provision makes clear that CBN’s role is not passive; the Bank is empowered and obliged to actively develop modern payment and transaction systems. The BVN system, which underpins the electronic payments infrastructure by providing a reliable means of verifying customer identities across banks, falls well within the scope of “efficient and effective systems for the settlement of transactions” that the CBN is to promote.
In addition to the above, Section 32(1) of the CBN Act 2007 (titled “Incidental powers”) further buttresses the Bank’s authority. It states that “The Bank may… do all such things as are incidental to or consequential upon the exercise of its powers or the discharge of its duties under this Act.”
These incidental powers clause is very broad. Even if the CBN Act does not mention a “Bank Verification Number” by name (as it could not have anticipated every modern innovation), Section 32(1) ensures that the Bank can take necessary incidental measures to fulfill its core functions.
In this case, implementing a system to uniquely identify bank customers (for purposes of supervision, fraud prevention, and credit tracking) is certainly incidental to the CBN’s duties of ensuring high standards of banking and curbing systemic risk.
Moreover, Sections 1(3) and 1(4) of BOFIA 2020 reinforces CBN’s authority. Section 1(3) of BOFIA provides that “The Bank may authorize or instruct any officer or employee of the Bank to perform any of its functions or exercise any of its powers under this Act.”
More importantly, Section 1(4) states that “The Bank may, either generally or in any particular case, appoint any person who is not an officer or employee of the Bank, to render such assistance as it may specify in the exercise of its powers, the performance of its functions, or the discharge of its duties under this Act or the CBN Act, or to exercise, perform or discharge such functions and duties on behalf of and in the name of the Bank.”
This provision is directly on point. It means the CBN can appoint an external entity to carry out certain tasks on its behalf in furtherance of its statutory functions under BOFIA or the CBN Act. NIBSS’s role in managing the BVN database is precisely such an appointment.
The CBN (through the BVN Framework and other directives) has appointed NIBSS which notably is jointly owned by CBN and the banks to maintain the centralized BVN infrastructure and database on behalf of the CBN. In doing so, the CBN has not acted outside its authority; it has acted in accordance with BOFIA’s express permission to enlist third parties to assist in executing its regulatory functions.
The CBN submitted that Item 28 of Part I of the Second Schedule to the 1999 Constitution (Exclusive Legislative List) provides that the National Assembly has exclusive legislative competence over “Fingerprints, identification and criminal records.”
The Appellant appears to argue that because this subject is on the Exclusive List, only a specific Act of the National Assembly dealing with identification (such as the NIMC Act) can validly cover collection of biometric data, and that the CBN (by regulations) cannot intrude into this area. With respect, this argument is misconceived.
Item 28 is not a limitation on the CBN’s authority rather, it is a grant of legislative authority to the National Assembly. In fact, the CBN Act 2007 and BOFIA 2020 are themselves Acts of the National Assembly, enacted pursuant to several items on the Exclusive List, including banking, financial regulation, and indeed identification.
To the extent that the BVN system involves the collection of fingerprints for identification of bank customers, it is covered by federal law specifically the CBN Act/BOFIA as implemented by duly issued regulations. There is no constitutional requirement that a single omnibus law (like the NIMC Act) must exclusively govern all instances of fingerprint or identity data collection in Nigeria.
Therefore, different federal statutes can address identification in different contexts. For example, the Police Act and Criminal Justice Acts provide for fingerprinting of criminal suspects; the Federal Road Safety Commission Act provides for biometric data on driver’s licenses; the Immigration Act covers biometric passports. Likewise, the CBN Act/BOFIA authorize the CBN to impose identification requirements within the banking sector. All are valid exercises of Item 28 (and related items) by the National Assembly.
Notably, the NIMC Act 2007 itself anticipates a collaborative approach to identification across various sectors. Section 27 of the NIMC Act explicitly lists transactions for which the National Identification Number (NIN) shall be required and opening a bank account is one of them.
In other words, the NIMC Act expects banks to request and use the NIN for customer identification. Far from suggesting that only NIMC may handle personal identification data, this demonstrates that the banking sector has its own role in collecting and verifying customer identity (albeit in coordination with NIMC’s national database).
The BVN system is in fact complementary to the NIN system. Initially, BVN filled a gap at a time when not all Nigerians had the NIN; subsequently, steps have been taken to harmonize the two, such as requiring linkage of BVN with NIN for bank customers (pursuant to CBN directives after the issuance of the Revised BVN Framework).
There is therefore no conflict between the CBN’s BVN initiative and NIMC’s mandate. Both exist side-by-side, serving different but related purposes, one for financial security, the other for general national identification.
The Appellant’s argument might also imply that CBN needed a specific amendment to the NIMC Act or a direct reference therein to create BVN. Respectfully, that is not required. The CBN did not create a national identity database; it created a financial industry identity database.
There is a clear demarcation; the BVN database is limited to bank customers and is used for banking transactions and fraud prevention, whereas NIMC’s database is for all citizens and residents for civil identity purposes. There is no duplication, all bank customers are in fact encouraged to obtain a NIN and link it to their BVN, aligning both systems. The existence of one does not nullify the other.
Section 37 of the 1999 Constitution guarantees “the privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications.” This right has been judicially interpreted to encompass the protection of personal information and data in certain contexts.
However, like all fundamental rights (except those expressly stated as absolute), the right to privacy is not an absolute right. It can be subject to restrictions or regulations in accordance with law, as long as such restrictions are justified under Section 45(1) of the Constitution.
Section 45(1) permits laws that derogate from Section 37 (and others) if they are “reasonably justifiable in a democratic society in the interest of defense, public safety, public order, public morality or public health, or for the purpose of protecting the rights and freedoms of other persons.”
Thus, the correct approach in privacy cases is determine if there is an intrusion into privacy; if yes, determine whether that intrusion is justified by a law aimed at a legitimate objective and is proportionate.
The CBN submitted that the learned trial Judge was correct to hold that the BVN scheme does not amount to an unlawful or unconstitutional infringement of the right to privacy.
Any minimal intrusion into personal privacy caused by the BVN requirement is justified, being backed by valid law and necessary in a democratic society for the protection of the public interest (specifically, the prevention of financial fraud and crimes). Therefore, it is not a “breach” in the constitutional sense.
A key consideration is that the BVN scheme is backed by laws (CBN Act, BOFIA, and the BVN Regulations made thereunder). It is not a whim or a policy without legal footing.
The Constitution does not forbid the government or its agencies from collecting personal data; it forbids unlawful searches or invasions. Here, customers are aware and consent (contractually) to providing their BVN data as part of opening an account. Moreover, the recently enacted Nigeria Data Protection Act 2023 provides a framework that governs how personal data (including BVN data) must be protected, used, and not abused.
The existence of that Act underscores that data processing by institutions is envisaged, not barred, by our legal system subject to safeguards. The BVN program operates within those safeguards. For instance, the BVN Framework itself mandates security and confidentiality of the BVN information, with NIBSS required to ensure adequate security and only grant access to authorized users. There has been no allegation that BVN data is being misused or improperly accessed.
The rationale for BVN is plainly to protect the banking public and the economy from fraud, identity theft, money laundering, and financial terrorism. Before BVN, Nigeria faced severe issues with individuals using multiple identities to open fraudulent bank accounts, perpetrate scams, or evade debts. The BVN introduced a way to uniquely tie accounts to real individuals, drastically reducing fraud incidence and enhancing the ability of law enforcement to trace criminals in the financial system.
This falls under “public order” and “public safety” (protecting the financial system is a matter of public economic safety) and “protecting the rights and freedoms of others” (i.e., protecting depositors from fraudsters). The legitimacy of this aim is difficult to dispute. Indeed, preventing crime is a textbook example of a pressing social need.
Our courts have often held that where an act of government is necessary to achieve public safety or order, it may justify a restriction on a fundamental right. For instance, in Incorp. Trustees, C.A.N. v. Kwara State Govt. (2020) 13 NWLR (Pt. 1740) 1, a case involving purported restrictions on religious attire in schools, the Court of Appeal recognized that government regulations could limit individual practices if done for a proper purpose and within the law.
By analogy, the BVN is a neutral requirement that applies to all bank customers for the good of the public. It is not targeted at violating privacy for its own sake, but to secure a safe environment for financial transactions.
Furthermore, the BVN scheme is narrowly tailored, it collects only information necessary for identity verification (basic biometrics and identifying information). It does not collect unrelated private details about one’s life. The data is stored under high security by NIBSS (which, as noted, is jointly owned by the CBN and banks and operates under strict oversight). Access to the data is limited to verifying identity when a customer conducts a transaction or when needed for investigating fraud.
In effect, the BVN serves almost like a social security number or national identification number, but solely within banking. Many democratic societies require citizens to have identification for banking (for example, under anti-money laundering laws, banks worldwide must obtain ID from customers. Indeed, Nigeria’s Money Laundering (Prevention and Prohibition) Act and CBN’s KYC regulations require this). BVN simply standardizes the identification method. This is proportionate to the risk it addresses.
If a less intrusive means could achieve the same result, perhaps one could argue proportionality; but there is no equally effective alternative on the table, reliance on physical identity cards or documents in the past proved inadequate due to forgeries. Biometric verification is internationally accepted as the gold standard for accurate identification.
It is also worth mentioning that individuals voluntarily engage the banking service; by choosing to open a bank account, one accepts certain reasonable requirements. This is analogous to how one who chooses to get a driver’s license accepts to give fingerprints and photo, it is a trade-off for access to the service. The law deems such requirements reasonable for the greater good.
This admission by the CBN is significant because it clarifies that the legal controversy surrounding the BVN regime is no longer whether it affects privacy, but whether the interference with privacy is constitutionally justified under Nigerian law.
The CBN submitted: “In conclusion on Issue 3, the trial court was right to find that the Appellant’s members (bank account holders) did not suffer an unlawful violation of privacy by reason of the BVN requirement. The interference with privacy is sanctioned by law, justified by overriding public interest, and narrowly tailored. The appeal on this point essentially invites this Court to declare a widely implemented and beneficial policy unconstitutional, a position that finds no support in our constitutional jurisprudence. Fundamental rights must coexist with the need to secure society. As the Supreme Court put it in Medical & Dental Practitioners v. Okonkwo (supra), even fundamental liberties may be restricted in the interest of the community, provided it is done lawfully. We urge this Court to uphold the trial court’s finding and resolve Issue 3 against the Appellant.”
The determination of this issue now lies with the Court of Appeal, whose decision in the pending appeal will likely have far-reaching implications for data protection, financial regulation, and the constitutional right to privacy in Nigeria.
In conclusion on Issue 3, the trial court was right to find that bank account holders did not suffer an unlawful violation of privacy by reason of the BVN requirement, according to the CBN. The interference with privacy is sanctioned by law, justified by overriding public interest, and narrowly tailored, the apex bank argued.
In Issue 4, the Appellant argues that the trial Judge erred in declaring his decision a “judgment in rem” and using it to bar the Appellant and its “associates” (or indeed any other person) from further agitation on the BVN issue.
The Appellant views this as the court granting reliefs not sought (since NIBSS had asked for declarations and maybe an injunction against the Appellant, but the wording made it bind non-parties) and as an undue restriction on the fundamental right of access to court for persons who were not parties.
The CBN submitted that the trial court’s characterization of the judgment as in rem is substantially correct. The declarations made for instance, that “the BVN database management by NIBSS does not violate any right” are universal in nature, not merely inter partes.
A judgment in rem, by definition, is a judgment that determines the status of a thing or the disposition of a property or right against the whole world. Here, the “status” determined is the legality of the BVN scheme. Such a determination, especially by a court of competent jurisdiction, should indeed be regarded as binding generally (subject to appeal).
Moreover, by virtue of the doctrine of stare decisis, even if the trial Judge had not used the words “in rem,” the effect of his judgment would still be that any other High Court of coordinate jurisdiction would be expected to follow it (absent any distinguishing facts) if a similar suit was filed by another party.
Declaring it in rem simply forewarns that the issue should be considered settled law unless the Court of Appeal or Supreme Court says otherwise. This is in line with public policy which disfavors repetitive litigation on the same subject.
The CBN argued that no identifiable person who was not party to the suit is literally bound in the sense of being punishable for contempt, unless they act in concert with the Appellant to breach the injunction. The injunction specifically names the Appellant (and anyone acting for it). It doesn’t say “all Nigerians are hereby prohibited from challenging BVN.” It was directed at the Appellant and those who might represent the Appellant’s interest (e.g., its trustees, members, agents).
This is standard when granting a perpetual injunction to protect the successful party from re-litigation. For instance, if Mr. X sues Mr. Y and loses, the court can bar Mr. X, his privies, agents etc., from suing again on that matter. That does not take away Mr. Z’s right to sue if Mr. Z has a wholly independent grievance (though Mr. Z would face stare decisis).
Considering the foregoing arguments, the 2nd Respondent respectfully submits that the Appellant’s appeal is wholly lacking in merit. The trial Court’s judgment delivered on 4th July 2025 was correct in fact and law. The Appellant has not demonstrated any reversible error or violation of rights that would warrant appellate interference.
The CBN therefore urged this Honourable Court to dismiss the appeal in its entirety, with substantial costs against the Appellant, to serve as a deterrent against frivolous or repetitive litigation that needlessly expends judicial time on issues that have been settled and to affirm the judgment of the trial Court which:
a. Declared that the Bank Verification Number (BVN) system and the role of NIBSS in managing the BVN database are lawful and within the statutory powers of the Central Bank of Nigeria under the CBN Act 2007 and BOFIA 2020.
b. Declared that the implementation of the BVN scheme does not violate Section 37 of the 1999 Constitution (right to privacy) or any other fundamental right of the Appellant’s members or the Nigerian public; and
c. Granted an injunction to give effect to these declarations, restraining the Appellant (and those represented by or acting under it) from instituting further actions on the same subject matter.
NIBBS 2nd Respondent Brief of ArgumentFinally, the CBN commended the industry of the learned trial Judge and submitted that his judgment has set the correct precedent reinforcing the Central Bank’s authority to carry out its mandate for the good of the financial system, while also respecting citizens’ constitutional rights within the bounds of law.
Upholding this judgment will further entrench the principle that regulatory measures taken for public safety and order when grounded in law will receive the strong backing of our courts.
The Respondent’s Brief was dated 7th January 2026 and filed by O.M. Atoyebi, SAN, FCIArb (UK) and other counsel from O.M. Atoyebi (SAN) & Co./Vantage Attorneys LP.
Get your copy today and take the first step toward financial growth:👉 https://selar.co/4f16676016
_______________________________________________________________________ The Law And Practice Of Redundancy In Nigeria: A Practitioner’s Guide, Authored By A Labour & Employment Law Expert Bimbo Atilola
_______________________________________________________________________
[A MUST HAVE] Evidence Act Demystified With Recent And Contemporary Cases And Materials
Available now for NGN 40,000 at ASC Publications, 10, Boyle Street, Onikan, Lagos. Beside High Court, TBS. Email publications@ayindesanni.com or WhatsApp +2347056667384. Purchase Link: https://paystack.com/buy/evidence-act-complete-annotation
______________________________________________________________________
ARTIFICIAL INTELLIGENCE FOR LAWYERS: A COMPREHENSIVE GUIDE
Reimagine your practice with the power of AI “...this is the only Nigerian book I know of on the topic.” — Ohio Books Ltd
Authored by Ben Ijeoma Adigwe, Esq., ACIArb (UK), LL.M, Dip. in Artificial Intelligence, Director, Delta State Ministry of Justice, Asaba, Nigeria.
Bonus:
Get a FREE eBook titled “How to Use the AI in Legalpedia and Law Pavilion” with every purchase.
How to Order: 📞 Call, Text, or WhatsApp: 08034917063 | 07055285878 📧 Email: benadigwe1@gmail.com 🌐 Website: www.benadigwe.com
Ebook Version: Access directly online at: https://selar.com/prv626
