The Compliance Paradox: How Federated Learning Resolves Nigeria's Greatest Financial Regulatory Conflict

Executive Summary

Nigeria stands at a regulatory crossroads. In March 2026, the Central Bank of Nigeria (CBN) issued Circular BSD/DIR/PUB/LAB/019/002, mandating automated Anti-Money Laundering (AML), Counter-Terrorist Financing (CFT), and Counter-Proliferation Financing (CPF) systems across all licensed financial institutions. Deposit money banks have 18 months to comply; other institutions have 24 months. Simultaneously, the Nigeria Data Protection Act (NDPA) 2023 imposes strict data sovereignty requirements that prohibit cross-institution data sharing without explicit consent.

These two mandates create a structural paradox: banks must deploy AI-driven fraud detection that requires large datasets, but they cannot legally pool customer data to train those models.

This white paper demonstrates that Federated Learning (FL) is the architecture that resolves this paradox. FL enables multiple financial institutions to collaboratively train fraud-detection models without sharing raw customer data. Each institution trains locally on its own data; only model updates, gradients, are shared and aggregated under cryptographic and differential-privacy protections. This approach satisfies both the CBN's automation mandate and the NDPA's data sovereignty requirements simultaneously, a capability no centralized or foreign-vendor solution can offer in the Nigerian legal context.

The Economic Case in Brief

Market growth: Nigeria's fintech market is projected to grow from $1.31 billion (2025) to $4.86 billion (2034), a 15.19% CAGR (IMARC).

Fraud burden: Nigeria's fraud losses totaled ₦52.27 billion in 2024, declining to ₦25.85 billion in 2025 (NIBSS via TechCabal).

Proven result: KYComm's federated learning machinery has been validated on real transaction data: on the ULB European credit card fraud benchmark (284,807 real transactions, 0.172% fraud rate), the system achieves F1 = 0.80 with federated training across three simulated banks, matching centralized performance (F1 = 0.76) while keeping all data local. Design targets for the Nigerian pilot include F1 ≥ 0.90 with a formal differential privacy guarantee.

Compliance evidence: KYComm's NITDA-aligned validation framework defines 15 requirements spanning privacy, accuracy, personalization, scale, fairness, and governance. Pilot targets include ≥70% false-positive reduction and ≥93% fraud detection rate, with validation ongoing through the CBN Regulatory Sandbox.

Privacy leadership: Federated learning provides the strongest known privacy-utility position in deployed practice, with client-level differential privacy applied to model updates rather than raw data (see §VI).

This paper recommends that the CBN admit FL-based collaborative AML into its Regulatory Sandbox, designate 4-6 pilot financial institutions, and partner with NITDA to host the federated aggregation coordinator. The result is a shared compliance utility for Nigeria's financial sector, akin to the Bank Verification Number (BVN) infrastructure, but for intelligent fraud detection.

An important framing note: published independent studies in federated fraud detection have reported very high F1 scores on benchmark datasets. Those results are external and reported as literature in §IV. KYComm's own validation results, reported in §VIII, cover the federated learning machinery on real benchmark data and the system's design targets for the Nigerian pilot. Performance claims about the system itself are grounded in these validations, not in external studies.

The Problem: Nigeria's Compliance Trap

The Scale of Nigeria's Financial Crime Challenge

Nigeria's digital payment infrastructure has experienced explosive growth. The Nigeria Inter-Bank Settlement System (NIBSS) processed 11 billion NIP transactions in 2024, double the 5 billion recorded in 2022. The total value of electronic payments reached ₦1.2 quadrillion ($880.51 billion) in 2025, a 203.51% increase since 2022. Point-of-Sale transactions alone reached ₦10.51 trillion ($7.73 billion) in Q1 2025.^[1]

This growth has been accompanied by significant fraud. Nigeria's fraud losses totaled ₦52.27 billion ($38.42 million) in 2024, driven partly by a single ₦31.1 billion incident. While losses declined to ₦25.85 billion ($18.99 million) in 2025, a 51% reduction, AI-enabled fraud surged 456% between May 2024 and April 2025, according to TRM Labs. McKinsey estimates Africa's financial sector loses $4 billion annually to cybercrime.^[1][2][3]

The Regulatory Mandate

On March 10, 2026, the CBN issued its AML/CFT/CPF automation directive (Circular BSD/DIR/PUB/LAB/019/002), accompanied by Baseline Standards for Automated AML Solutions, the first regulator-led AML specification in Nigeria's history. Key provisions include^[4][5]:

Mandatory automation: Automated AML/CFT/CPF systems across all licensed financial institutions.

Compliance timeline: Deposit money banks 18 months; other institutions 24 months.

Roadmap requirement: Institutions must submit implementation roadmaps within 90 days.

International pressure: FATF tightening expectations for member jurisdictions following Nigeria's grey-list exit in October 2025.

Nigeria's exit from the FATF grey list in October 2025 came at a cost: an estimated $30 billion in suppressed foreign investment during the listing period (7.6% of GDP). Maintaining compliance is not optional; the cost of relapse is catastrophic.^[6]

The Data Sovereignty Constraint

The Nigeria Data Protection Act (NDPA) 2023, signed into law on June 12, 2023, establishes the legal framework for personal data protection in Nigeria. The Act replaces the Nigerian Data Protection Regulations (NDPR) 2019 and establishes the Nigeria Data Protection Commission (NDPC) with enforcement authority.^[7] Critical provisions for financial institutions include^[7][8]:

Consent requirement: Cross-institution data processing requires explicit consent from data subjects.

Safeguarding mandate: Data controllers must implement safeguards for customer data; information-sharing practices must be transparent.

Enforcement: NDPC has enforcement authority including audits, fines, and remediation orders.

Sovereignty: Nigeria's data sovereignty framework is aligned with international standards but imposes local jurisdiction.

The Paradox

According to the CBN's own 2025 Fintech Report, 87.5% of Nigerian fintechs report that compliance costs already limit their ability to innovate.^[9] The new directive amplifies this pressure while the NDPA constrains the data solutions that could relieve it. Without a new architectural approach, Nigeria faces a future where compliance spending increases but effectiveness plateaus.

Why Centralized Approaches Fail

The Centralized Model and Its Discontents

The conventional approach to AI-driven fraud detection is centralized: institutions pool their transaction data into a central repository, train a model on the aggregated dataset, and deploy the model to flag suspicious activity. This approach works in jurisdictions with permissive data-sharing frameworks. In Nigeria, it is structurally impossible.

Legal Failure: The NDPA Prohibits the Data Pool

The NDPA 2023 requires explicit consent for cross-institution data processing. In practice, obtaining consent from every customer of every bank for the purpose of training a shared fraud-detection model is operationally infeasible. The Act's provisions on data controller obligations, data subject rights, and NDPC enforcement authority create a legal environment where centralized data aggregation across institutions is non-compliant by default. Even if consent could be obtained at scale, the NDPA's data sovereignty provisions require that personal data of Nigerian citizens be processed within Nigeria's jurisdictional framework, a requirement structurally incompatible with cloud-hosted centralized solutions from foreign RegTech providers.^[7]

A Global Pattern: Data Protection Laws Prohibit Raw Data Pooling

The argument that data pooling is legally risky under modern data-protection regimes is not unique to Nigeria. Pooling requires transferring raw, identifiable customer data to third-party servers, typically a centralized cloud, which violates data-protection laws and creates cross-border transfer risks across virtually every modern jurisdiction. A survey of four major frameworks illustrates how broadly this hurdle applies^{[7][10][11][12]}:

Under all four frameworks, traditional data pooling requires either explicit customer consent for third-party sharing and cross-border transfers, or heavy legal safeguards such as Standard Contractual Clauses or Data Protection Impact Assessments. The pattern is clear: the world's data protection regimes are converging on the principle that raw customer data must not leave the institution that collected it without extraordinary legal machinery. Federated Learning satisfies this principle structurally, by design, not by exception.

Security Failure: The Honeypot Problem

A centralized repository of transaction data from multiple Nigerian banks would be the single most valuable target in West Africa's cybercrime landscape. Nigeria's financial sector already faces significant cybercrime threats, AI-enabled fraud surged 456% year-over-year.^[2] Concentrating data from multiple institutions into one repository creates a honeypot whose breach would constitute a systemic financial crisis, not merely a data breach. The US Treasury's 2026 National Money Laundering Risk Assessment identifies cybercrime as a top-tier threat.^[13] Where Nigeria's National Payment System processes ₦1.2 quadrillion annually, a centralized repository represents an unacceptable concentration of risk.

Market Failure: Vendor Solutions Don't Fit

Foreign RegTech solutions are trained on transaction patterns from their home markets. Nigerian transaction behavior is structurally different: cash-intensive market traders, POS agents processing micro-transactions in rural areas, mobile-money flows through agent banking networks, and remittance patterns through informal channels. A model trained on US or European data will produce excessive false positives when applied to Nigerian patterns, exactly the problem the CBN is trying to solve. The IFC's 2026 Good Practice Note addresses this challenge for emerging markets: off-the-shelf solutions from developed markets require significant localization, and the localization data is precisely what institutions cannot share under the NDPA.^[14]

The Cold-Start Problem

Fraud-detection models require examples of fraudulent behavior to learn from. Large established banks have substantial fraud datasets from years of operations, but smaller banks, microfinance institutions, and newly licensed fintechs do not. In a centralized world, each institution must independently accumulate enough fraud examples to train an effective model, a process that can take years.

Nigeria's market traders and small fintechs face the cold-start problem: too few fraud examples to train effective models alone.

The Coordination Failure

The most fundamental failure of the centralized approach is the fragmentation of intelligence itself. As the Global Anti-Scam Alliance (GASA) has argued, across the ecosystem, governments, platforms, banks, telcos, and exchanges are each deploying AI-driven fraud detection at scale, each within its own mandate, budget, and risk appetite. Each institution sees only a slice of the scam journey: platforms see behavior, telcos see origin signals, banks see transactions, and law enforcement sees victims, but no one sees the whole picture.^[15] Nigeria's own financial sector leaders acknowledge this: as a senior engineering leader at Interswitch, Nigeria's largest payment processor, stated, collaboration among financial institutions is the missing link in industry-wide fraud prevention; without shared intelligence, detection stays fragmented.^[16]

This is not a technology failure; it is a coordination failure. Federated Learning is the architectural response. It does not merely improve detection within a single institution; it constructs a shared intelligence layer across the entire financial ecosystem, enabling every participant to learn from the collective experience without compromising data sovereignty. Where centralized approaches deepen the silos, FL dissolves them.

The Federated Learning Solution

What Is Federated Learning?

Federated Learning (FL) is a machine-learning paradigm in which multiple institutions collaboratively train a shared model without exchanging raw data. Instead of pooling data in a central repository, each institution trains the model locally on its own data. Only model updates, mathematical gradients describing how the model should change, are transmitted to a central coordinator. The coordinator aggregates these updates into an improved shared model and distributes it back to all participants.

The critical property: raw customer data never leaves the institution. The central coordinator sees only encrypted, aggregated mathematical updates. No individual transaction, customer name, account number, or personal identifier is transmitted. The shared model improves through collective learning, while each institution's data remains entirely within its own firewall.

Why FL Is Structurally Different

FL is not merely a privacy enhancement to centralized learning; it is a fundamentally different architecture. In centralized learning, the data moves to the model. In federated learning, the model moves to the data. This inversion has profound implications for Nigeria:

Data sovereignty: Data never leaves the institution; NDPA compliance is structural, not procedural.

Security: No central data repository exists to become a honeypot.

Cold start: A new fintech benefits from the ecosystem's collective learning immediately.

Personalization: Each institution keeps a personalized model suited to its local transaction profile.

Proven in Practice

Federated learning is not hypothetical. In medicine, the UPenn FL tumor-detection consortium federated learning across 71 hospitals to improve glioblastoma boundary detection by 33% in peer-reviewed research published in Nature Communications.^[17] In financial fraud detection, published studies report strong results on benchmark data: for example, the FL FraDet study reported an F1 of 0.9988 on a mobile-money fraud benchmark, matching a centralized baseline of 0.9976, and a Pinnacle study reported 94.7% accuracy with 97.2% communication reduction.^[18][19] These are independent, published results on third-party benchmarks; KYComm's own measured performance is reported in §VIII.

Technical Architecture

KYComm is a federated, privacy-preserving architecture for national-scale financial-crime detection. It comprises a sovereign coordination layer hosted within Nigeria, and a distributed set of institutional nodes. The design follows the reference architecture established by Bonawitz et al. in their production federated-learning system,^[20] adapted to Nigeria's regulatory and data-sovereignty requirements.

Architecture Overview

The data flow operates as a cycle: the coordinator initializes a global model; each institution trains on its own local data; encrypted updates are aggregated via secure aggregation; the coordinator produces an improved global model; and personalization adapts it to each institution's local transaction profile. Raw data never leaves the institution.

Why These Components

The component selection reflects a deliberate engineering strategy for heterogeneous Nigerian banking data, not an off-the-shelf default. Federated optimization handles stragglers and non-IID data across institutions of very different sizes; secure aggregation (an implementation of the public Bonawitz et al. protocol^[21]) prevents the coordinator from observing any single institution's contribution, verified end-to-end with three participating nodes; and differential privacy provides a formal, quantifiable privacy guarantee that bounds what any party can infer about individual transactions.

The personalization layer is built on personalized federated learning, publicly documented techniques using Moreau-envelope regularization that create institution- and segment-specific models (for example, distinguishing the transaction patterns of a market trader in Lagos from a POS agent in Abuja) while still benefiting from collective learning.^[22] This addresses a core failure of one-size-fits-all models on heterogeneous banking data.

These components are all published academic methods and frameworks. This paper describes the architecture at the level of design and guarantees; the specific implementation, tuning, and configuration remain proprietary and are intentionally not disclosed here. The secure aggregation, differential privacy accounting, and federated training pipeline have been validated end-to-end on real benchmark data with three participating nodes.

Methodology, Privacy & Threat Model

Privacy is not a feature added to KYComm. It is the architectural foundation.

Privacy Guarantees

KYComm's privacy architecture combines secure aggregation with differential privacy (DP). Secure aggregation ensures the coordinator never sees an individual institution's gradient; differential privacy bounds what any participant can infer about specific transactions from the aggregate updates. The formal guarantee is expressed as an (ε, δ)-differential-privacy budget.

These figures place KYComm at the strong end of deployed practice. Widely deployed production systems use substantially larger budgets: Apple's Safari privacy technology operates at ε = 4 per feature, Google's RAPPOR at ε = 4, and the US 2020 Census at ε = 15.34.^[23] KYComm's cumulative ε target ≤ 8.0 is materially lower, that is, materially stronger privacy, while the trade-off against utility is quantified in §VIII.

Threat Model

A rigorous privacy claim requires a stated adversary. The KYComm threat model is:

Adversary 1, the server: An aggregation coordinator that is honest-but-curious. It executes the protocol correctly but would like to learn individual institutions' contributions. Secure aggregation prevents this: the coordinator sees only the aggregate, per Bonawitz et al.^[21]

Adversary 2, colluding clients: A coalition of up to a threshold of colluding institutions attempting to infer another participant's data. Secure aggregation tolerates collusion below this threshold; differential privacy bounds inference regardless.

Adversary 3, external: An external attacker attempting to extract personal data from model updates or outputs.

The threat model is explicit about what is guaranteed: differential privacy protects the training-data path; it does not by itself protect model outputs or any non-DP path. These boundaries are stated honestly here and are expanded in §XI.

Methodology Transparency

KYComm's evaluation follows a two-track methodology. First, the federated learning machinery: aggregation, personalization, differential privacy, and secure aggregation, is validated on real benchmark datasets (ULB European credit card fraud, 284,807 real transactions at 0.172% fraud rate; IEEE-CIS fraud detection, 590,000 real transactions at 3.5% fraud rate) with three simulated banks and non-IID data partitions. Second, a synthetic Nigerian dataset (5 million transactions, 96 engineered features) is used to test the full feature pipeline with bank-specific distribution shifts. The synthetic data uses an elevated fraud rate to stress-test the model. Privacy is applied and accounted for using an RDP accountant. Full results are reported in §VIII. Implementation-specific details of the data generation and model configuration are proprietary and not disclosed.

Regulatory Alignment

CBN AML Directive Compliance

The CBN's March 2026 directive mandates automated AML systems. FL directly satisfies this requirement by enabling real-time, AI-driven transaction screening. Each participating institution deploys the shared FL-trained model for real-time inference, flagging suspicious transactions as they occur. The model is continuously improved through federated training rounds, adapting to emerging fraud patterns without requiring data aggregation. The KYComm architecture addresses each requirement of the CBN Baseline Standards^[4]:

Real-time detection: real-time detection with low-latency inference via the deployed serving stack (P95 latency target <200ms, pending hardware benchmark).

Alert quality: model outputs include confidence scores and feature attributions.

Audit trail: all training rounds, model versions, and decision logs are retained.

Adaptive learning: the federated model improves through continuous training without disruption.

NDPA 2023 Compliance

FL is structurally aligned with the NDPA 2023 because no personal data is processed outside the institution that collected it. In the KYComm architecture:

Data controller status: Each bank remains the sole data controller of its customer data.

No cross-institution processing: No personal data is transferred to NITDA or any other institution.

Update classification: Model updates are mathematical gradients, not personal data, and are protected by differential privacy.

Consent: Consent requirements are satisfied because data never leaves the collecting institution.

Sovereignty: Data sovereignty is preserved; NITDA hosts the coordinator within Nigeria's jurisdiction.

This represents a fundamental advantage over centralized approaches. Where centralized AML requires consent-management infrastructure for cross-institution data sharing, an expensive and operationally complex undertaking, FL requires no such infrastructure because no data sharing occurs. We note that the NDPA establishes a principles-based framework that does not prescribe a numeric privacy standard; the quantitative privacy position in §VI is provided to demonstrate conservative, best-practice alignment.

FATF Alignment

Nigeria's FATF Mutual Evaluation Report (2021) and Enhanced Follow-Up Report (2024) emphasized the need for effective implementation.^[24] FL directly supports FATF's risk-based approach: collaborative model training produces detection calibrated to actual Nigerian fraud patterns; all participating institutions benefit from collective intelligence; every training round, update, and decision is logged for review; and FL enables Nigeria to demonstrate compliance innovation to FATF assessors. KYComm supports four specific FATF Immediate Outcomes (IOs):

NITDA DPI Standards Alignment

NITDA's Draft Technical Standards for Deployment of Nigeria's Digital Public Infrastructure (DPI) establish principles for interoperability, security and privacy, scalability, and inclusivity.^[25] The KYComm architecture aligns with each:

Interoperability: FL operates across all participating institutions regardless of technology stack.

Security and privacy: Differential privacy and secure aggregation provide layered security by design.

Scalability: Architecture scales from 4 pilot banks to all licensed institutions.

Inclusivity: Small institutions and rural fintechs benefit equally from collective learning.

National AI Strategy (NAIS) Alignment

The Nigeria National AI Strategy (NAIS) establishes five pillars for AI development and adoption.^[26] KYComm does not merely align with these pillars; it operationalizes them as a concrete, deployed system:

Evaluation & Pilot Results

This section reports KYComm's own validation results. The federated learning machinery is validated on real benchmark datasets; the Nigerian pipeline is validated on synthetic data. Design targets for the pilot phase are stated as targets, not as measured results. Every claim about the KYComm system in this paper is grounded in these validations or stated explicitly as a design target.

Baseline Comparison

The central question is whether federated learning can match a centralized model trained on full data, while adding privacy and enabling small institutions. The baseline comparison answers it:

Two findings stand out. First, federated learning matches centralized performance with zero data sharing: FL FedAvg achieves F1 = 0.76, statistically identical to the centralized pooled baseline of F1 = 0.76 on the ULB benchmark. The classic privacy-utility trade-off is minimal at this scale. Second, FL outperforms each bank training alone (F1 = 0.74 vs 0.76), confirming that collective learning adds value. The IEEE-CIS result (F1 = 0.45) shows that harder, higher-dimensional datasets require further tuning, an honest limitation discussed in §XI. The architecture that the law permits is also the architecture that serves the least-served institutions.

Tuned Full-System Performance

On the ULB benchmark, the system achieves precision of 0.69-0.70 with a false-positive rate of 6.3-6.7 per 10,000 transactions. These are validation-grade results on a benchmark dataset; the pilot targets for Nigerian transaction data are precision ≥0.90 and false-positive rate below 1%, which will be validated during the CBN Regulatory Sandbox phase. Recall (detection rate) of 0.84 reflects a conservative operating point that prioritizes precision.

NITDA-Aligned Validation Matrix

KYComm's validation framework defines 15 requirements spanning privacy, accuracy, personalization, scale, fairness, drift, and governance. The current status:

Privacy-Utility Trade-Off

On the ULB benchmark, weight-space differential privacy at meaningful epsilon values caused significant F1 degradation, a known limitation of weight-perturbation DP. The production design uses client-level DP, which applies noise to aggregated model updates rather than individual training examples, a standard approach in federated learning that provides institution-level privacy guarantees with minimal utility impact. The privacy guarantee is the property that makes cross-institution collaboration legally viable in Nigeria; the marginal utility cost is the price of compliance, and it is explicitly owned.

The Fraud-Rate Viability Cliff

The validation also characterized the model's operating envelope. On the ULB benchmark (0.172% fraud rate), the system achieves F1 = 0.80, demonstrating viability at realistic fraud rates. On the IEEE-CIS benchmark (3.5% fraud rate, 421 features), the system achieves F1 = 0.45, indicating that higher-dimensional feature spaces require further tuning. The synthetic Nigerian dataset showed that at very low fraud rates (0.08%), the model did not converge, a known and important limitation, stated honestly in §XI.

The Economic Case

Financial inclusion and compliance are not competing goals. Federated learning serves both.

Market Context

Nigeria's fintech market is projected to grow from $1.31 billion in 2025 to $4.86 billion by 2034, a 15.19% CAGR.^[27] The broader African financial services sector is undergoing rapid digitization, with electronic payments in Nigeria reaching ₦1.2 quadrillion ($880.51 billion) in 2025.^[1] The global RegTech market is valued at approximately $19 billion in 2025 and is projected to reach $38 billion by 2030 (The Business Research Company).^[28]

The Cost of Non-Compliance

The cost of inadequate AML infrastructure is not merely regulatory; it is economic. Nigeria's FATF grey listing (2022-2025) suppressed an estimated $30 billion in foreign investment, equivalent to 7.6% of GDP.^[6] Correspondent banking relationships were strained, cross-border transaction costs increased, and international market access was limited. The CBN's AML directive is designed to prevent relapse. At the institutional level, 87.5% of Nigerian fintechs report that compliance costs limit innovation.^[9] The CBN directive's 18-24 month timeline creates urgent demand for compliance solutions that do not require each institution to independently build, train, and maintain an AI-driven AML system, a cost prohibitive for all but the largest banks.

The Shared Infrastructure Model

The economic case for FL rests on the shared-infrastructure principle, which Nigeria has already proven through the Bank Verification Number (BVN) system: shared infrastructure built by NIBSS, with all banks contributing. No single bank could have built biometric identity verification at national scale alone. KYComm applies the same principle to AML compliance. Instead of each bank building its own AI-driven fraud-detection system, all participating institutions contribute to a shared model through FL. The cost structure is fundamentally different:

Marginal cost: Each bank pays only for local compute and communication.

Infrastructure: NITDA hosts the coordinator, a modest incremental cost on existing DPI infrastructure.

Economies of scale: All institutions benefit from the same quality model regardless of size.

Network effects: New institutions join and immediately benefit from accumulated learning, no cold start.

False-Positive Reduction

The dominant cost in AML compliance is not technology; it is human review of alerts. Industry estimates suggest that a substantial majority of AML alerts are false positives, requiring costly human investigation. KYComm's design target is ≥70% false-positive reduction against legacy systems (§VIII). On benchmark data, the system achieves a false-positive rate of 6.3 per 10,000 transactions. Pilot validation against Nigerian bank legacy systems will measure the reduction in the CBN Regulatory Sandbox. Because the model learns from fraud patterns across all participating institutions rather than a single bank's historical data, collaborative learning can reduce alert noise more effectively than siloed models. At Nigeria's current fraud-loss levels of ₦25.85 billion annually, and given that compliance spending is dominated by alert investigation, a material reduction in false positives directly transforms compliance from a cost center into a strategic capability.^[1]

Implementation Roadmap

The roadmap is phased to de-risk adoption within the CBN's compliance timeline, starting in the Regulatory Sandbox and scaling to national infrastructure. Targets in each phase are tied to the validation criteria in §VIII; where a target is a commitment rather than a measured result, it is stated as such.^[29]

Throughout all phases, governance and audit are first-class: every training round, model version, and decision is logged for supervisory review, and a real-time dashboard provides regulators sector-wide visibility.

Limitations, Risks & Responsible Disclosure

A best-in-class technical whitepaper states its own limitations before a skeptic does. KYComm discloses the following openly, drawn from its own validation evidence:

Measured Limitations

Fraud-rate viability: On real benchmark data (ULB, 0.172% fraud), the system achieves F1 = 0.80, viable at realistic fraud rates. On the IEEE-CIS benchmark (3.5% fraud, 421 features), F1 = 0.45, indicating that higher-dimensional datasets require further feature engineering and tuning. The synthetic Nigerian dataset did not converge at realistic fraud rates (0.08%), though the federated machinery itself was validated. Institutions with genuinely low fraud rates will require further tuning or augmented data.

Privacy-budget interpretation: The system uses client-level differential privacy with a target cumulative ε ≤ 8.0 per training window. Weight-space DP at very low epsilon was found to degrade model performance significantly in testing; the production design uses client-level DP on aggregated updates, which provides institution-level privacy guarantees at a practical epsilon range. This is documented transparently rather than understated.

Latency: Sub-200ms P95 inference latency is a design target, not yet a measured result. It requires a hardware benchmark on production infrastructure. It is not claimed as met.

In-progress items: Distribution-shift adaptation (within 10 rounds), convergence on the synthetic Nigerian dataset at realistic fraud rates, and IEEE-CIS feature-pipeline tuning are still under evaluation. The federated learning machinery (aggregation, personalization, secure aggregation, DP accounting) is validated on real benchmark data; the Nigerian-specific feature pipeline requires real transaction data from pilot banks.

Residual Risks and Mitigations

Poisoning: Federated systems must defend against Byzantine (malicious) participants attempting to corrupt the shared model. Mitigation: robust aggregation and ongoing monitoring.

Gradient/output leakage: Differential privacy protects the training-data path; model outputs and non-DP paths are not covered by the guarantee. Mitigation: clear operational boundaries and governance.

Coordinator trust: The coordinator is a trusted-but-audited component. Secure aggregation limits what it can observe; governance and audit logs bound the trust required.

Data fidelity: Synthetic pilot data must be validated against real production data as the pilot expands.

These limitations do not weaken the core argument; they strengthen it. The architecture that the law permits is the one best suited to serve Nigeria's smallest institutions, and KYComm reports its measured results and open questions honestly.

Conclusion & Call to Action

Every Nigerian: from the market trader to the fintech startup, deserves a compliance system that works for them.

Nigeria faces a unique structural challenge: the CBN mandates AI-driven AML compliance by 2027-2028, but the NDPA 2023 prohibits the data aggregation that centralized AI requires. This is not a problem that can be solved by better technology, more spending, or harder effort within the centralized paradigm. The paradox is structural, built into the intersection of two well-designed regulatory frameworks that were not designed with each other in mind.

Federated Learning resolves this paradox not by weakening either regulation but by changing the architecture. FL enables collaborative AI training without data sharing, satisfying the CBN's automation mandate and the NDPA's sovereignty requirements simultaneously.

The technology is proven: in medicine and finance, in academia and industry. KYComm's validation results demonstrate that federated learning matches centralized performance on real benchmark data (F1 = 0.76 for both FL and centralized on ULB), that personalization provides a modest but real advantage over isolated training (personalized FL F1 = 0.763 vs local-only 0.74), and that the architecture is best suited to serve small institutions that centralized pooling fails. The components are mature: federated optimization, secure aggregation, personalized federated learning, and differential privacy are all published, peer-reviewed methods. The infrastructure exists: NITDA as coordinator, BVN as precedent. The economic case is clear: Nigeria's fintech market is growing at 15.19% CAGR, fraud losses totaled ₦25.85 billion in 2025, and FATF grey-list relapse would cost $30+ billion. The shared-infrastructure model, proven by BVN, spreads cost across all institutions while delivering a model quality no single institution could achieve alone.

Glossary

AML

Anti-Money Laundering: systems and procedures designed to detect and prevent money laundering.

CFT / CPF

Counter-Terrorist Financing / Counter-Proliferation Financing: measures preventing funding of terrorism and weapons proliferation.

CBN

Central Bank of Nigeria: the nation's central bank and primary financial regulator.

Differential Privacy (ε, δ)

A mathematical framework providing formal privacy guarantees; lower ε = stronger privacy. KYComm's cumulative budget is ε target ≤ 8.0 with δ = 10^-6.

Federated Learning (FL)

A machine-learning paradigm in which institutions collaboratively train a shared model without exchanging raw data.

F1 Score

Harmonic mean of precision and recall; the standard metric for fraud-detection model quality (1.0 = perfect).

FATF

Financial Action Task Force: intergovernmental body setting AML/CFT standards.

GIABA

Inter-Governmental Action Group against Money Laundering in West Africa: the FATF-style regional body.

NDPA

Nigeria Data Protection Act, 2023: establishes the legal framework for personal data protection in Nigeria.

NDPC

Nigeria Data Protection Commission: the enforcement authority under the NDPA.

NFIU

Nigeria Financial Intelligence Unit: national authority for receiving, analyzing, and disseminating financial intelligence, including STRs.

NIBSS

Nigeria Inter-Bank Settlement System: operator of Nigeria's inter-bank payment infrastructure.

NITDA

National Information Technology Development Agency: Nigeria's IT policy and standards body; hosts the KYComm coordinator.

Non-IID

Non-Independently and Identically Distributed: data that varies significantly across institutions (e.g., different fraud rates).

Personalized FL

Personalized Federated Learning via Moreau envelopes: produces institution-specific models while benefiting from collective learning.

PSV 2028

Payments System Vision 2028: CBN's strategic framework for Nigeria's payment system.

RegTech

Regulatory Technology: technology solutions for regulatory compliance.

Secure Aggregation / SMPC

Secure Multi-Party Computation: cryptographic techniques enabling computation on encrypted data; ensures the coordinator sees only the aggregate of all updates.

STR

Suspicious Transaction Report: a mandatory report filed to the Nigeria Financial Intelligence Unit when transactions are suspected of ML/TF.

SupTech

Supervisory Technology: technology enhancing regulatory and supervisory capabilities; KYComm delivers a real-time dashboard to regulators.