BVN, NIN and KYC: why every lender asks for your ID
Nearly 70 million BVNs and 137 million NINs: why a lender must know who you are, what each KYC tier unlocks, and the rights the Data Protection Act gives you.
Every plan, loan or wallet in Nigeria starts the same way: your BVN, your NIN, a photo of your ID, a selfie. It feels like a lot to hand over to get a laptop. It is also the thing that separates a lender from a scammer, and the law gives you more say over it than most people know.
This article explains what the two numbers are and how many people have them, why a lender is required to ask, what each level of verification unlocks, what a company may and may not do with your data under the Nigeria Data Protection Act 2023, and the one situation in which you should refuse.
The two numbers, in numbers
The Bank Verification Number ties you to every bank account you hold. Nigeria's BVN database reached 69,972,475 as of 23 August 2026, by NIBSS's count (Ibemere, 2026). The National Identification Number is the civil identity behind it: NIMC had enrolled 137,371,080 Nigerians by July 2026 (Onyemachi, 2026).
The two were welded together in 2024. From 1 March 2024, the Central Bank required that any funded account or wallet without both a BVN and a NIN be placed on "Post No Debit or Credit", with "no further transactions permitted" until the numbers were supplied (Moses-Ashike, 2023). If you have a working bank account today, you have already done most of the KYC any lender will ask for.
Why a lender is required to ask
Paying later is credit, and credit is regulated. A lender that does not know who it is lending to cannot report to the credit bureaus, cannot collect, and cannot tell a student from a stolen identity. The Central Bank's tiered framework sets what each level of verification allows, as reported when it was last revised:
| Tier | What you provide | What it allows |
|---|---|---|
| Tier 1 | Basic details; BVN not required | Small limits: a single deposit up to ₦50,000 and a balance up to ₦300,000 |
| Tier 2 | BVN and NIN, verified against NIBSS and NIMC | Daily limits up to ₦200,000 and a balance up to ₦500,000 |
| Tier 3 | Everything above plus a verified address and full due diligence | Up to ₦5,000,000 a day, with no cap on balance |
Sources: BusinessDay, 2016; Investdata, 2017; Lawal, 2022. The reporting dates from the framework's last revision and sources differ on whether some limits are per deposit or per day, so treat the figures as the shape of the rules rather than a current rate card.
The shape is what matters. A limit worth having, which is what a laptop plan is, sits in the tiers that require BVN, NIN and an address. That is not a lender being nosy. It is the price of the limit.
What KYC actually involves
Know Your Customer is three checks. Who you are: a government-issued ID. That you are the person on it: a short liveness check, a selfie or a few seconds of video. Where you live: address verification. A student-only lender adds a fourth, that you are enrolled: your institution, course, matriculation number, institutional email and a photo of your student ID. None of it should take more than a few minutes, and none of it should happen anywhere but inside the lender's own app.
What they may do with it, and may not
The Nigeria Data Protection Act 2023 gives you rights over everything you hand over. The regulator lists them under sections 34 to 38 of the Act: the right to be informed, to access, to rectification, to object to processing, to restrict processing, to data portability, to be forgotten, to report to the supervisory authority, and the right "not to be subjected to automated decision making" (NDPC, n.d.). If a company loses your data, the Act requires it to notify the Commission "within 72 hours of becoming aware of a breach which is likely to result in a risk to the rights and freedoms of individuals" (NDPC, 2024; Udo Udoma & Belo-Osagie, 2023).
For lenders specifically, the FCCPC's 2025 regulations draw a hard line: apps may not access your contacts, call logs or photos, with fines of up to ₦50 million for individuals and ₦100 million or 1% of turnover for companies (Nwokoma, 2025). Google Play will not list a Nigerian loan app without "a verifiable approval letter from the FCCPC" (Google, 2026).
| What you hand over | Why a lender needs it | Your right |
|---|---|---|
| BVN and NIN | To know you are one person with one identity, and to report to the credit bureaus | To know what is held, and to correct it |
| ID photo and liveness check | To prove the person applying is the person on the ID | To access and to erase, within legal retention limits |
| Address | The tier of verification a real limit requires | To correct it |
| Student record | To confirm enrolment, for a student-only plan | To correct it, and to have a human review an automated credit decision |
| Contacts, call logs, photos | Nothing. Lenders are prohibited from accessing them | To refuse, and to report the app |
The one time to refuse
Never give your BVN, NIN or ID to someone who contacted you. The fake bank loan pages found in January 2026 used the absence of checks as the lure, promising that "a bank verification number (BVN) is not required" (Balogun, 2026). The scam is not that they ask for your ID. It is that they ask for it in a chat, or do not ask at all. Legitimate KYC happens inside an app you downloaded from the store, for a company on the FCCPC register, and nobody from that company will ever ask you to read a code back to them.
How Pody approaches it
- What we ask for, and why. A government-issued ID, a short liveness check and address verification, because Nigerian regulation requires us to know who you are before we approve a limit. Completing KYC also gets you your own account number for bank top-ups. What verification involves.
- What we never access. Your contacts, call logs or photos. We never sell your data or your academic records.
- How long we keep it. Identity records for five years or more after you close your account, your student record for three years, device data for twelve months, and credit records for up to seven years under the Credit Reporting Act 2017. See the full retention timeline.
- Your rights, with a person to write to. See your data, correct it, delete it within the legal limits, take it with you, object, withdraw consent, or have a human review an automated credit decision: dpo@pody.network.
- If something goes wrong. Breaches are reported to the NDPC within 72 hours, and to you if you are at high risk.
Your BVN and NIN are not the price of being doubted. They are the proof that lets a lender say yes to a student with no payslip. Hand them over inside the app, to a company on the register, and keep the rights the law gives you over what happens next.
For the full list of what we collect and how it is protected, read the security page.
Sources
- Balogun, M. (2026, January 19). Beware of Facebook pages impersonating First Bank of Nigeria and offering bogus loans. Africa Check, via AllAfrica. Read the article
- BusinessDay. (2016, July 5). CBN seeks to expand banking net in new tiered KYC requirements. Read the article
- Google. (2026). Financial services: Personal loans. Google Play Developer Policy Center. Checked 19 October 2026. Read the policy
- Ibemere, D. (2026, August 27). BVN enrolments in Nigeria hit 69.9m, CBN announces new rules. Legit.ng. Read the article
- Investdata. (2017, September 12). Mobile money: CBN raises limits on three-tiered KYC requirements. Read the article
- Lawal, T. (2022, November 2). 3 tiered know your client (KYC) requirements. Youverify. Read the article
- Moses-Ashike, H. (2023, December 1). CBN declares no transactions on accounts without BVN, NIN from March 2024. BusinessDay. Read the article
- Nigeria Data Protection Commission. (n.d.). Your rights as a data subject. Checked 19 October 2026. Visit the site
- Nigeria Data Protection Commission. (2024, December 19). Nigeria Data Protection Act General Application and Implementation Directive (GAID) 2025. Read the directive
- Nwokoma, C. (2025, August 20). What the FCCPC's digital lending regulations mean for lenders and borrowers. Techpoint Africa. Read the article
- Onyemachi, F. (2026, July 13). NIN enrolment crosses 137 million. Techeconomy. Read the article
- Udo Udoma & Belo-Osagie. (2023, September 29). Data breaches: Compliance obligations under the Nigerian Data Protection Act 2023. Mondaq. Read the article