Federal Gazette
4notify Nigeria · Federal Republic notices
OFFICIAL · CBN · NIBSS NIP
Gazette No
FG-NG-001
Date
2026-05-27
Status
In force
Category
Banking & payments

Two-factor authentication and NIBSS Instant Payments: OTP delivery to GTBank, Zenith, Access, UBA and First Bank

The Central Bank of Nigeria (CBN) oversees NIBSS Instant Payments (NIP), the rail that settles hundreds of millions of naira transfers a day. Every transfer and mobile-banking confirmation demands a second factor, and the Bank Verification Number (BVN) anchors the customer's identity. 4notify delivers one-time codes with P50 under 4 seconds across MTN Nigeria, Airtel, Glo and 9mobile through international tier-1 A2P gateways. The code lands before the window closes.

SMSPushEmail
Preamble

Section 1 — In exercise of the powers conferred by the Central Bank of Nigeria Act 2007 and the CBN Guidelines on Electronic Payments and the Risk-Based Cybersecurity Framework, this Gazette is issued concerning the delivery of strong-authentication one-time codes over the Nigerian mobile networks.

Statutory basis
Central Bank of Nigeria Act 2007

Statutory mandate of the CBN over the National Payments System and the NIBSS instant-payment rail.

CBN Risk-Based Cybersecurity Framework

Obligation on deposit money banks to apply multi-factor authentication on digital channels.

BVN Operational Guidelines (CBN/NIBSS)

Bank Verification Number as the identity anchor for customer authentication and fraud control.

Implementation
01

Registered A2P route + sender ID

4notify maintains tier-1 international A2P gateways into MTN, Airtel, Glo and 9mobile and a registered alphanumeric sender ID for authentication traffic.

02

OTP generated in the bank HSM

The one-time code is generated inside the bank's hardware security module; 4notify receives only the hash and the MSISDN, never the cleartext code.

03

Sixty-second window + fallback chain

The SMS is delivered in under 60 seconds; if the DLR fails, push follows and then email. Grey-route delays are avoided on the authentication path.

04

Five-year audit custody

Every delivery is signed and retained for five years, in line with CBN record-keeping and anti-money-laundering expectations.

Delivery envelope
json
{
  "event": "bank.nip.otp",
  "bank_id": "NG-XXXX",
  "transaction_id": "TX-2026-05-27-948210",
  "amount": 45000.00,
  "currency": "NGN",
  "bvn_hash": "sha256:salt:7f2a9b...",
  "delivery": {
    "channel": "sms",
    "fallback": ["push", "email"],
    "window_seconds": 60,
    "template": "nip_otp_ng_v3"
  },
  "audit_signature": "https://4notify.net/sig/bank/948210"
}
Sample message
SMS

GTBank: your code to confirm NIP transfer of NGN45,000 to A. Okafor is 482193. Valid 5 min. Do not share it with anyone.

Compliance checklist
  • Registered A2P delivery route into all four MNOs active
  • Alphanumeric sender ID approved for authentication traffic
  • OTP P50 ≤ 4 seconds measured per quarter
  • Five-year signed audit custody documented
The 4notify difference

4notify is the only A2P provider delivering NIBSS NIP authentication codes across MTN, Airtel, Glo and 9mobile under one BVN-anchored, five-year signed audit envelope aligned to the CBN cybersecurity framework.

Frequently asked questions
Does 4notify route directly to Nigerian banks or via an aggregator?

We route over tier-1 international A2P gateways into MTN, Airtel, Glo and 9mobile. We do not use grey-route aggregation for authentication traffic, which is where fraud and latency creep in.

Do push notifications count as a second factor?

Yes — an app-bound push is a recognised possession factor. But because the app cannot guarantee a durable channel, we always pair it with SMS or email so the OTP still lands if the app is offline.

Published by authority
4notify Operations Department
2026-05-27 · FG-NG-001

Start free

14 days, no card. English support on weekdays. Built for Nigerian business.

Other notices in this issue