Letter to the Central Bank of Nigeria and the Central Bank of Kenya on Payment‑Fraud Recall Times

Letter | Status: Circulated

Letter to the Central Bank of Nigeria and the Central Bank of Kenya on Payment-Fraud Recall Times

To the Governor and relevant officials of the Central Bank of Nigeria, and to the Governor and relevant officials of the Central Bank of Kenya:

We write on behalf of the Fair Play Council of Reseated’s Founders Assembly. We ask you to consider a practical question for small businesses that report payment fraud: when a business contacts its bank or payment provider after a suspected fraudulent transfer, what steps follow, how quickly can a recall be attempted, and what information is given to the business while the case is being handled?

We do not presume that the two countries have identical payment systems, laws, institutional arrangements or supervisory powers. Nor do we claim that our evidence measures the performance of any bank, payment provider or public authority. We invite each Central Bank to assess the question within its own mandate and, where another authority is responsible for a particular issue, to identify the appropriate route for engagement.

1. Who we are and why we are writing

Reseated is a global assembly of small-business owners, organized in seven councils. It launched on 10 February 2026 and is a nonprofit. The Fair Play Council addresses patterns of fraud and payment-related harm reported by members. It gathers reports, tests whether a reported problem is recurrent and consistent, consults on proposed fixes, and, where an Assembly process supports action, communicates recommendations to institutions able to consider them.

The Council’s current work includes FP-001, a proposed Business Fraud Standard. Its central request is that banks and payment providers verify payee names, act promptly to attempt recalls of fraud payments, and provide appropriate reimbursement to small businesses harmed by authorised push payment fraud or business email compromise, including in cross-border situations. FP-001 had not yet passed the pattern test; it did so on 8 September 2026, and consultation opened on 13 October 2026. It is not a claim that any particular legal duty already applies in Nigeria or Kenya.

Small and medium-sized enterprises are central to employment and economic activity. The United Nations estimates that MSMEs account for about 90 per cent of businesses, 60–70 per cent of employment and around 50 per cent of GDP worldwide.¹ The International Labour Organization estimates that MSMEs account for about 70 per cent of employment worldwide and that around 80 per cent operate in the informal economy.² These global figures do not describe the specific business population of either country, but they help explain why accessible fraud-response processes matter to businesses with limited financial and administrative capacity.

2. Evidence available to the Council

As of 22 July 2026, Reseated had 1,178 seated members in 49 countries and had received 3,349 reports from 50 countries. The Fair Play Council had 146 members in 41 countries and had received 328 fraud reports from 45 countries. These are member-submitted reports, not a census of businesses, verified police records, a representative survey or a count of unique criminal incidents. A report may describe a business’s experience; the aggregate does not establish the identity or conduct of a particular institution.

The median amount at stake in the Fair Play Council’s reports was approximately US$4,498. This is the median reported amount, not an estimate of total losses, the amount ultimately unrecovered, or the amount any payment provider should necessarily reimburse. The Council has not supplied a separate median for Nigeria or Kenya, and this letter does not infer one.

The leading countries by number of Fair Play Council reports were the United Kingdom, 48; the United States, 40; Nigeria, 18; Kenya, 16; South Africa, 15; India, 15; Germany, 13; and the United Arab Emirates, 13. These country counts total 178; the remaining reports came from other countries represented in the 45-country reporting base. The figures identify where reporting members said they were based or where their report was associated. They do not show the location of every sending or receiving account, the location of a suspected perpetrator, or the jurisdiction governing a particular transfer.

The Council also records the reported size of the affected member’s team. Among Fair Play Council reports, 43 per cent were from businesses reporting that they were just one person; 38 per cent reported a team of 2–9; 13 per cent reported 10–49; and 6 per cent reported 50–249. These categories reflect the Council’s report data. They are not estimates of the distribution of business sizes in Nigeria, Kenya or the wider economy.

The supplied aggregate does not contain a verified industry or economic-sector breakdown. We therefore do not attribute the 18 Nigeria reports or 16 Kenya reports to particular sectors, and we do not present sector counts. We would welcome a safe

way to collect sector information in future, with clear definitions and protection against identification of an individual business.

3. What the evidence can and cannot tell us about recall times

The available aggregate supports a finding that payment fraud is a recurring concern among participating small businesses, and that reports include members in Nigeria and Kenya. It does not include a reliable, country-specific measure of the time between a business discovering a suspected fraud, notifying its payment provider, the provider attempting a recall, the receiving provider responding, and the case reaching an outcome. It does not establish how many transfers were recalled, how much was recovered, or the reasons for any delay.

We are making this limitation explicit because a high report count is not, on its own, evidence of slow handling by a bank or payment provider. The Council has not applied a statistical sampling method that would allow it to estimate prevalence across all businesses. The 18 Nigeria reports and 16 Kenya reports are not a basis for ranking either country, comparing either country with the other, or drawing conclusions about a specific institution. The number of reports is a reason to ask a question and invite structured evidence, not a finding of institutional failure.

For the same reason, we do not represent that all reports concern the same fraud method or transfer type. FP-001 addresses authorised push payment fraud and business email compromise, including cross-border cases, but the aggregate figures above are not disaggregated by fraud method, payment rail, currency, transfer destination or recall outcome. A structured record of those fields would allow supervisors, providers and business representatives to distinguish between different operational problems.

4. Relevant policy context and limits of this letter

The materials available to the Council for this letter do not contain verified descriptions of the current Nigerian or Kenyan statutory framework for payment-fraud reimbursement, recall procedures, payee-name verification, complaint handling or cross-border transfers. We therefore do not cite or interpret domestic legislation, regulations, circulars or supervisory guidance in either jurisdiction. We respectfully

ask each Central Bank to confirm which rules and institutions are relevant to the questions in this letter, and to correct any misunderstanding that may arise from our general framing.

There is a documented international policy case that may be useful for comparison, without suggesting that it should be copied or that it governs either recipient. In the United Kingdom, the Payment Systems Regulator’s APP reimbursement protections have applied since 7 October 2024. The scheme described by the regulator provides for reimbursement up to £85,000 per claim for eligible consumers, micro-enterprises and charities, with costs split equally between sending and receiving payment service providers; international payments are excluded.³ A first-year evaluation reported that APP fraud fell by 21 per cent and reimbursement rose from 54 per cent to 65 per cent.⁴ Those findings concern the UK framework and its evaluation; they do not establish what would be legally suitable or operationally feasible in Nigeria or Kenya.

Our purpose in citing that case is limited. It shows that a regulator can define a process and publish outcome measures that permit subsequent review. We invite each Central Bank to consider, in its own legal and institutional context, whether better-defined reporting, recall, escalation and outcome data would help identify where small businesses need clearer protection.

5. Requests to the Central Bank of Nigeria and the Central Bank of Kenya

We respectfully ask each Central Bank, separately and within its lawful remit, to consider the following steps:

1. Identify the applicable framework. Please indicate which laws, regulations, supervisory directions or complaint processes address payment-fraud reporting, attempted recalls, payee verification, reimbursement and cross-border cases affecting businesses. Where responsibility lies with another public body, payment-system operator or ombudsman, please identify the appropriate office or route for referral.

2. Map the customer-facing process. Please consider publishing, or inviting relevant providers to publish, a plain-language description of what a small business should do after discovering a suspected fraudulent payment: which channel to use, what information to provide, how the report is acknowledged, how the provider communicates with other institutions, and how the business can seek an update or escalate an unresolved case.

3. Set or clarify expectations for urgent action. Please consider whether providers should have clear operational expectations for recording a fraud report and promptly assessing whether a payment can be stopped, recalled or otherwise restricted. A recall request cannot guarantee that funds remain available or will be recovered. Even so, clear expectations about prompt assessment, escalation and communication can make the process more understandable and permit later review.

4. Consider proportionate payee-name checks. Please assess whether, and under what safeguards, a business initiating a transfer should be able to check whether the entered payee name corresponds to the account information held by the receiving provider. The design should account for legitimate name variations, business trading names, privacy, accessibility and the risk that a warning could be misunderstood as a guarantee. We do not assume that a particular technical model is appropriate in either jurisdiction.

5. Improve case and outcome recording. Please consider common, privacy-conscious fields for recording the time a report is received, the time a recall or stop request is sent, responses from relevant providers, the amount sought and recovered, the final outcome, and any reason recorded for an unsuccessful or delayed step. Where practicable, records could distinguish domestic from cross-border transfers and different payment methods without disclosing customer identities in public reporting.

6. Make complaint routes visible to small businesses. Please consider whether current complaint and escalation routes are sufficiently clear to a one-person business or a small team without specialist legal or compliance staff. If a business is not eligible for a particular process, the eligibility boundary and alternative route should be stated plainly.

7. Publish aggregate indicators. Subject to legal authority, confidentiality and data-quality safeguards, please consider periodic aggregate reporting on fraud complaints involving businesses, response intervals, recall attempts, recovered amounts and outcomes. Definitions should be stated, and data should be separated where necessary so that differences in payment type or case mix are not mistaken for differences in performance.

8. Convene a focused discussion. We invite each Central Bank to convene or designate a suitable discussion with relevant providers, payment-system participants, small-business representatives and other responsible public offices. The aim would be to identify which parts of the process can be improved immediately and which require policy or legal review.

6. An offer to provide anonymized evidence

The Fair Play Council can offer anonymized, aggregate information about the reports supporting its work, subject to member consent, confidentiality safeguards and a clear purpose for the exchange. We would be glad to discuss a format that helps officials test the practical questions raised here without exposing a member’s identity, business name, account details, transaction reference or other identifying information.

Before any transfer of case-level material, we would seek agreement on the questions to be examined, the minimum data fields needed, permitted use, retention, access controls and whether any summary may be published. We would not provide identifying information about a member or their business as part of an ordinary evidence exchange. The Council would also distinguish member accounts from independently verified records and would not ask a recipient to treat an unverified report as a finding of fact about a provider.

Potential areas for a jointly scoped analysis include the sequence of events reported by a business, the kind of contact channel used, whether the business received an acknowledgement, whether a recall was attempted, how the result was communicated, and which points in the process were unclear to the business. The current aggregate does not answer those questions. A carefully designed exchange could help determine whether

the Council can contribute useful evidence and what additional information would be required.

7. Closing

Small businesses often have little capacity to absorb a loss or pursue a complex case while continuing to trade. A prompt, comprehensible process does not guarantee recovery, and no reporting framework can prevent every fraud. It can, however, make responsibilities and next steps clearer, support consistent handling, and allow institutions to identify where a process is failing or where the evidence is insufficient.

We offer this letter in that constructive spirit. We ask neither Central Bank to accept our reports as a complete measure of national conditions. We ask that the reported experiences be treated as a reason to examine the practical path from a business’s first fraud report to the final outcome, and to make that path more visible to small businesses.

Annex: Sources and evidential basis

1. Reseated internal Fair Play Council figures as of 22 July 2026: membership, reporting countries, report counts, reported team-size categories, median amount at stake, recent report volume and country counts. These figures are member-submitted aggregates and are described with their limitations in this letter.

2. Reseated, FP-001 Business Fraud Standard and consultation materials current as of 22 July 2026. The standard was under consultation on the date of this letter.

3. United Nations, Micro-, Small and Medium-sized Enterprises Day: global MSME estimates and the annual observance on 27 June.¹

4. International Labour Organization, Micro, Small and Medium Enterprises: global estimates on employment and informal-economy participation.²

5. UK Payment Systems Regulator, APP fraud reimbursement protections for consumers: scheme scope and protections.³

6. Grant Thornton, first-year evaluation of the UK APP fraud reimbursement requirement.⁴

Notes and sources

Sources

1. United Nations, Micro-, Small and Medium-sized Enterprises Day
2. International Labour Organization, Micro, Small and Medium Enterprises
3. Payment Systems Regulator, APP fraud reimbursement protections
4. Grant Thornton, APP fraud reimbursement requirement: were industry's concerns justified?