PoS Recertification 2025
Sept 1st – Oct 20th
The Central Bank of Nigeria (CBN) in it’s circular on mandatory geo-tagging of Payment Terminals , directed for the recertification of all Terminals nationwide with the National Central Switch.
In line with this, NIBSS has introduced the NCS SDK to monitor and enforce compliance, while enhancing transaction security and improving operational efficiency of payment terminals nationwide.
Why Recertification?
Secures payments, strengthens compliance, and builds trust across Nigeria’s payment ecosystem
- Ensures full regulatory compliance with CBN directives on geo-tagging and payment terminal operations.
- Enables geofencing and real-time alerts to detect violations and prevent unauthorized use.
- Provides accurate location tracking for PoS devices, improving accountability and transparency.
- Boosts institutional efficiency and enhances customer trust through secure, location-aware services.
Responsibilities
NIBSS
- Certify all terminals meet new criteria.
- Ensure SDK integration across PoS software.
- Enforce 10m geo-fencing with real-time alerts.
- Re-enable terminals upon compliance restoration
PTSPs
- Apply for recertification on NIBSS Sandbox.
- Integrate SDK into PoS applications.
- Deploy updated SDK nationwide.
- Test and validate geofencing features.
Acquirers
- Register terminals with merchant details.
- Provide serial numbers, TIN/BVN, and coordinates.
- Update terminals with required data regularly.
Merchants
- Operate only certified PoS terminals.
- Maintain compliance with 10m geo-fencing.
- Adopt best practices for secure transactions.
Recertification Process
- Apply for Recertification: Log on to NIBSS Sandbox and provide required terminal details.
- Receive Terminal ID (TID): Upon approval, a TID is generated and linked to your institution’s profile.
- Download & Integrate SDK: Test PoS Application embedded with NCS SDK’
- Test SDK: Conduct UAT with NIBSS to validate permissible activities and geo-fencing rules.
- Complete Certification: NIBSS approves recertification once all criteria are met.
Next Steps After Certification
- Acquirers: Update all existing and new terminals with merchant details via to Geolocation APIs or fileshare via NIBSS Contact Centre.
- PTSPs: Initialize SDK on all deployed terminals within the approved 10m geo-coordinates. Include terminal location in the transaction payload using feild 127.13 – Refer to NUS API Documentation for detailed spec
- Merchants: Ensure strict adherence to certified terminal usage guidelines.
FAQ
Is the SDK open source?
No, the SDK is currently not open source.
How frequent is the ‘heartbeat’ of the terminal sent?
The terminal heartbeat interval is configurable. For certification purposes, the heartbeat is set to 30 seconds.
Is the blockade temporary or permanent?
The blockade is temporary. The blockade is removed once the Terminal is within its registered geofence (10m radius around its geocoordinates)
Is there an SDK for other Operating Systems such as Linux or RT-OS?
No. In line with the regulatory directive, the SDK is currently supported only on Android Version 10 and above. SDKs for other operating systems such as Linux or RT-OS are not supported at this time.
What exactly should the PTSP build?
A token retrieval service. This service will be used to initialize the SDK.
What will this token retrieval service do?
The service will invoke the NIBSS reset endpoint provided. The PTSP is responsible for caching the response returned by NIBSS for subsequent use.
What should I do with the cached response?
Develop a service that exposes the same endpoint used for SDK initialization. When this endpoint is invoked, the service should return the cached response previously received from NIBSS.
Who will be calling the service built by the PTSP?
All deployed terminals tied to the PTSP will call this service, since the terminals are initialized with it.
How can I ensure that calls are actually coming from my terminals?
During initialization, the PTSP must also pass a secret unique to each PTSP. Your service should validate this secret. If the secret does not match, the request should fail.
If it matches, return the token.
How long does a token received from the Token retrieval service last?
The token expiry time is provided in the response from NIBSS under the parameter expires in. The value represents the token’s lifetime in milliseconds.
It is recommended to request a new token shortly before the current token expires to ensure uninterrupted operation.
What is the rate limit?
3 Token generation per hour. The NIBSS API enforces this rate limit to prevent abuse. Tokens should generally be renewed close to their expires in time
At what point does initialization happen? Can PTSP call it at any point in the App?
Once the SDK has been implemented and there is network connectivity on the device, the pinging starts
Is re-initialisation of the SDK possible if the terminal needs to change location?
Yes, re-initialization of the SDK is possible if the terminal changes location. As long as the same terminal ID is used during re-initialization, the process will be successful. However, the terminal will only be operative in the location where it has been registered.
If the location is violated at initialization, what happens?
If the terminal is initialized outside its registered location, the terminal screen will be locked and will only become operative when it is back in the registered location.
How do I deal with 'Lock Task' Error?
Factory reset the device and assign device ownership while profiling the device for use.
How do I deal with '401 Unauthorized' Error?
If you encounter a ‘401 Unauthorized’ error, please share your Client ID with NIBSS contact for further review.
How do I deal with '404 No Route Matched' Error?
If you encounter a ‘404 Unauthorized’ error, please share your Client ID with NIBSS contact for further review.
At which business stage does the SDK currently check the location? Before the transaction or during the transaction?
SDK location checking and transaction location are independent activities.
Is the terminal address update API available?
The Integration guide is available on: https://devportal.nibss-plc.com.ng/default/documentation/terminalmanagement
Is there a limit to the number terminal location updates/changes with the PTSA?
No, this is a limitless process. Location can be updated as many times as required.
What is the format for sending field 120 during transaction?
Refer to the updated NUS Specification for the format.
What will happen if field 120 is not populated during transaction?
The transaction will be allowed to proceed. However, any non-compliance with regulatory reporting guidelines will be logged and reported as required
When the application is updated with new features, Does the PTSP have to request for recertification again?
Yes
Does a new TID being assigned to a terminal constitute a violation?
Yes
Our Partners
