LMS for Banks and Fintechs in Nigeria: Conduct, Cybersecurity and Customer Protection Training Beyond AML

An LMS for banks in Nigeria is usually bought with anti-money-laundering training in mind, because AML is the obligation everyone recognises. But when you look at where Nigerian financial institutions actually lose money, attract sanctions and damage trust, the biggest exposures sit elsewhere: staff who act improperly, employees and customers who fall for social engineering, and complaints that are handled too slowly or not at all. Those are training problems as much as technology problems, and they apply to a fintech with 200 staff as much as to a bank with 20,000.

This guide covers what training a Nigerian bank or fintech needs beyond AML, what the Central Bank of Nigeria (CBN) and other authorities expect of staff, what real fraud and complaint data say about where to focus, and what to require from a learning platform. AML itself is covered in Learnep’s separate guide to AML training requirements for Nigerian financial institutions, so this piece deliberately starts where that one stops. It also sits inside Learnep’s broader hub of LMS solutions by industry in Nigeria.

What Does Training in a Bank or Fintech Have to Cover Beyond AML?

Beyond AML, a Nigerian bank or fintech needs training in four areas: conduct and insider risk, cybersecurity and fraud awareness, customer protection and complaints handling, and data protection. Each maps to a different regulator expectation, and each is typically owned by a different department, which is why they are often delivered inconsistently.

Learnep’s guide to using an LMS across industries describes a four-pillar framework that adapts well to financial services:

1. Regulatory compliance. Mapping each obligation, from the CBN’s consumer protection and cybersecurity rules to the Nigeria Data Protection Act, to the roles that must be trained.
2. Role-based onboarding. A teller, a relationship manager, a complaints officer, a systems administrator and a fintech customer-support agent face different risks and need different content from day one.
3. Continuing education and certification tracking. Many banking roles carry professional qualifications and refresher cycles that must be tracked.
4. Operational realism. Branch networks, shift work, agent banking and fast product changes shape how training can actually be delivered.

The rest of this guide takes the first pillar apart by risk area.

Why Is Insider and Conduct Risk the Problem Banks Cannot Ignore?

Insider involvement is now one of the most consistently reported features of fraud in Nigerian payments. When the Nigeria Inter-Bank Settlement System (NIBSS) presented its 2025 fraud data in June 2026, the headline was a fall: digital payment fraud losses dropped 51% to ₦25.85 billion from ₦52.26 billion in 2024, a year distorted by a single ₦31.1 billion incident involving one entity.

But the same report singled out social engineering, particularly insider abuse, as the most prevalent technique, and its chief executive was direct about it. Premier Oiwoh, NIBSS Managing Director and CEO, said “Insider involvement is high, and recent investigations have confirmed this.” The report counted 67,518 fraud incidents in 2025 and found Lagos accounted for 63.43% of fraud activity.

Public cases show what the risk looks like in practice. Techpoint Africa’s review of major fraud cases between 2023 and 2024 describes a First Bank case in which an employee allegedly moved about ₦40 billion into various accounts, and reports that it was discovered after a customer complained about unauthorised transfers. These are allegations as reported, not findings, and the case is used here only to show how insider risk surfaces: through a customer complaint, not through an internal control. Scale also matters at the other end.

A TechCabal analysis of audited 2025 financial statements found that Access Holdings, GTCO and UBA together lost about ₦2.13 billion ($1.56 million) to fraud and forgery in 2025, with total incidents down 15.03% and most incidents electronic, which suggests that large institutions are catching much of the volume but that each incident still costs money.

Training cannot prevent insider fraud on its own, and no honest guide should claim it can. Segregation of duties, access controls and monitoring do most of the work. What training does is set clear expectations for conduct, make the reporting channel real, and make sure every employee knows what a conflict of interest, an inducement or a dual-control breach looks like. Three things belong in a conduct programme:

• Code of conduct and conflicts of interest, with an annual attestation recorded per employee.
• Dual control and segregation of duties, taught with scenarios rooted in actual branch and operations tasks rather than abstract policy.
• Speak-up and reporting, so staff know how to report concerns safely. Learnep’s guide to whistleblower policy training explains why this is a gap in many organisations.

What Does the CBN Require on Cybersecurity and Awareness?

The CBN’s Risk-Based Cybersecurity Framework for deposit money banks and payment service banks was issued on 31 May 2024, with compliance required from 1 July 2024. According to a Mondaq summary of the framework, institutions must carry out at least an annual cybersecurity awareness programme to inform stakeholders, and the CBN enforces the framework through annual supervisory reviews, risk-based examinations, annual compliance audits and periodic spot checks. The summary does not detail staff-specific training requirements, so check the full text of the framework, which the CBN publishes, for the exact obligations that apply to your licence category.

The practical meaning is simple: cybersecurity awareness is not optional or occasional, and it needs to be evidenced. For a bank or fintech, a credible programme includes:

• Phishing and vishing simulations and the training that follows them, with results recorded by individual and by department.
• Social engineering scenarios specific to financial services, such as fake internal IT requests, fraudulent customer calls and account-takeover pretexts. Learnep’s guide to social engineering and the human factor covers the principles, and scenario-based learning design explains how to build realistic exercises.
• Role-specific content for privileged users such as system administrators, treasury staff and anyone with payment-release authority.
• Third-party and agent awareness, since the weakest link is often outside the institution.

Fintechs sit outside the framework if they are not licensed as banks, but face the same threat. Public reporting on Flutterwave, for example, describes unauthorised transfers of about ₦11 billion in April 2024 and a separate ₦2.9 billion incident in early 2023, and records the company’s statement that no customer funds were lost. Public reports do not say how access was gained in those cases, so they should not be read as training failures. They show that the loss events fintechs plan for are large, and that regulators, partners and customers will ask what controls, including staff awareness, were in place.

What Do the CBN Consumer Protection Regulations Expect From Staff?

For customer-facing staff, the most explicit training obligations in the CBN’s rulebook sit in the Consumer Protection Regulations. The version dated December 2019 requires institutions to “train their staff to promote competence, efficiency and professionalism in the discharge of their duties” (section 5.1.2). It also requires sales and marketing staff to be properly trained and competent (5.3.3), requires a process to monitor their competence and conduct periodically (5.3.4), and says complaints should be handled by “skilled and well-trained members of staff” (6.1.2). The CBN has published a revised exposure draft of these regulations, so confirm which version is current before building your compliance matrix.

The consequences of poor complaint handling are specific. Under the 2019 regulations, complaints must be acknowledged within 24 hours with a tracking number, and resolved within category-specific timelines, with penalties of ₦500,000 per complaint per week while a breach continues. The volume is not trivial. According to a report on the CBN’s 2025 annual report, the CBN received 23,129 consumer complaints in 2025, up 10.53% from 2024, and imposed ₦430 million in penalties across 21 sanctions for complaints management and other consumer-protection breaches. The report could not identify the banks involved.

That data points to a clear training priority: complaint handling is a skill, with a regulatory clock attached, that can be taught, assessed and tracked. A good programme teaches staff the 24-hour acknowledgement rule, the resolution timelines by complaint type, how to escalate, and how to record each step so the institution can prove compliance.

How Do Frontline Realities Change the Training Design?

Banks and fintechs differ from many industries in four ways that shape how training must be delivered.

Large, spread-out workforces. A bank may have thousands of employees across hundreds of branches, plus agents, so central tracking and consistent content matter. Learnep’s guide to role-based learning paths explains how to structure content by job function.

Shift and queue pressure. Tellers and customer-service staff cannot leave a counter for an hour. Short modules, such as the microlearning approach in Learnep’s microlearning design principles, fit the working day better than long courses.

Fast-changing products and rules. New fees, transfer limits and CBN circulars arrive often. Content has to be updated quickly and employees have to re-acknowledge changes, not just see an email.

Professional qualifications. Many roles carry credentials and continuing professional development requirements. LMS-based certification and credentialing covers how renewals are tracked.

Fintechs add distributed and remote teams, rapid hiring and engineering staff who handle sensitive data, which places extra weight on onboarding speed and role-specific security training.

What Should an LMS for Banks or Fintech Do?

An LMS for a bank or fintech needs to assign training by role and risk, assess understanding rather than attendance, track certificates and attestations with expiry dates, and produce audit-ready records on request. Ask any vendor, including Learnep, to show the following with your own sample data:

1. Role-based assignment that adds and removes requirements automatically when someone changes role, branch or licence status.
2. Assessment with pass marks, attempt limits and question banks, so a completion means something.
3. Scenario-based modules for phishing, vishing, complaint handling and conduct dilemmas.
4. Attestations for code of conduct and policy acknowledgement, recorded per person with a date and version.
5. Expiry tracking and escalation for certifications, annual refreshers and overdue training.
6. Reporting by branch, department and role that a compliance officer can run without help.
7. Audit trail and exportable records that answer the question, “Show me this person’s training history.”
8. Data protection controls, since employee training records are personal data under the NDPA. See Learnep’s guides to NDPA training for HR teams and what L&D leaders should know about the NDPC.
9. Low-bandwidth and mobile delivery for branch and agent staff, covered in the guide to low-bandwidth eLearning in Nigeria.

How Do You Roll It Out in Four Steps?

Step 1: Map obligations to roles. List every regulatory training obligation and the roles it applies to, starting with the CBN consumer protection and cybersecurity rules and the NDPA. This matrix is your foundation.

Step 2: Start with the highest-risk roles. Complaint handlers, payment-release authorities, privileged IT users, sales staff and new joiners usually carry the most risk. Cover them first and extend outward.

Step 3: Build content from real incidents. Use anonymised internal cases and public ones, such as the fraud patterns NIBSS describes, to make scenarios believable. Staff learn more from the realistic than from the generic.

Step 4: Measure outcomes, not just completion. Track the metrics the training is meant to move: time to acknowledge and resolve complaints, simulated-phishing click rates, policy-attestation completion, and incident trends. As Learnep’s guide to data-driven decisions in L&D argues, completion alone proves very little.

Common Pitfalls to Avoid

Treating AML as the whole compliance programme. AML is essential, but conduct, cyber and consumer protection carry their own regulatory clocks and their own sanctions.

Running annual awareness as a once-a-year tick-box. The CBN’s cybersecurity expectations are about a programme, with evidence. Short, repeated, role-specific exercises are more defensible and more effective.

Training branches and ignoring agents and third parties. The agent, vendor or contractor who touches customer data is part of your risk surface and needs equivalent coverage.

Collecting attestations without version control. A signature on a policy that has since changed proves little. Record which version each person acknowledged.

Forgetting the compliance team’s own development. The people who oversee the programme need continuing training too, and their records should be as complete as everyone else’s.

Frequently Asked Questions

Does the CBN require specific training for bank staff? The CBN’s Consumer Protection Regulations require institutions to train staff to be competent and professional, to ensure sales staff are properly trained, and to monitor their competence and conduct. Its cybersecurity framework requires at least an annual awareness programme. Check the current text for your licence category, since the CBN has published a revised draft of the consumer rules.

Do fintechs face the same training obligations as banks? It depends on licence type. Banks are subject to frameworks such as the CBN’s cybersecurity framework for deposit money banks and payment service banks, while other fintechs follow the rules attached to their own licence, plus cross-cutting laws such as the NDPA. Whatever the licence, regulators, partners and customers will expect documented training.

Can training reduce insider fraud? It can set expectations, improve reporting and teach staff to recognise red flags, but it works alongside access controls, segregation of duties and monitoring, not instead of them. Reports from NIBSS highlight insider involvement as a continuing concern.

What should we measure to show training works? Complaint acknowledgement and resolution times, simulated phishing results, attestation completion by version, assessment pass rates and incident trends. Completion alone does not show that behaviour changed.

Where This Fits in Your Training Strategy

Financial services training is a regulated system, not a course catalogue. Learnep’s compliance training LMS guide covers the shared regulatory foundation, and the insurance sector guide covers a neighbouring regulated industry. You can see how this fits alongside other sectors on the LMS solutions by industry page.

If you are responsible for training at a Nigerian bank or fintech and want to see how role-based assignment, attestations and audit-ready records work in practice, book a demo and bring a sample of your own role matrix. You can also explore the Learnep features or read the FAQ page.