Where this sits
This illustrative example is a payments company in Yaba that is licensed to hold customer files. New users cannot transact until identity checks clear, and Lagos volume comes in bursts around payday, campus intake, and merchant onboarding weeks.
The problem
Manual KYC review still lives in inboxes. One officer sees a utility bill, another sees a mismatch and waits, and a third is on leave, so files age while good customers retry and a tired queue still lets risky files through.
Delays run to days rather than minutes, decisions are inconsistent, and there is no single trail a CBN examiner or an NDPA request can follow without a hunt.
What we would agree in writing
The statement of work covers one process: new-user onboarding, from document in to decision out. In comes the identity document, proof of address, a selfie or liveness check if they already capture it, and the fields their stack already stores. Out goes a pass, a fail, or a hold for a named officer, with a reason code, a timestamp, and who looked. Credit decisioning, card issuing, wallet ledgers, and marketing messages stay out of scope unless the paper says otherwise.
How the work runs
In week 1 we sit with operations and compliance, map the real queue rather than the deck, and name the officer who can stop the path. In weeks 2-3 we build the review path in a test lane using the same documents they already collect. Holds go to a human. There is no silent pass. Week 4 is a parallel run: the old queue still decides, we compare results, and we do not cut over on a Friday payday. Cut-over happens under the agreement. The officer keeps a stop, and we stay for the first busy week.
Standards this kind of job has to meet
CBN expects a trail, not a slogan. Under NDPA 2023 the customer can ask what you hold, so you must know. Files stay the client's. We do not sell them, and we do not use them to train a third-party model. Access is by role, so one staff body does not see another institution's rows, with encryption in transit and at rest at the database. A human signs off before this path goes live, and a human can pause it. We do not borrow a CBN licence. The client holds the licence, and the statement of work says that.
ISO/IEC 27001 is a target for us as a firm. It is not a certificate you can put on this job.
What the client brings
They bring a named compliance owner, a sample of real files they have a right to use in a test lane, the list of reason codes they already use, who escalates on a hold, and whether they can pay USD.
What we deliver
We deliver a written scope, a working review path, a stop, a trail an examiner can read, and a short operations note for the officer on duty. Invoices match the legal name on Privacy.
How we measure
We track time from file-in to decision for standard cases, the share of files that still need a human, and the number of times the stop was used. These are measures. They are not a promised close rate and not a promised minute count.