Compliance

Niimbu System Limited builds software. Niimbu gives a business one place to invoice, collect, pay out, run payroll and keep its records.

Niimbu is not a licensed deposit taking institution. Where the service involves holding, moving or settling funds, those activities are carried out by licensed financial institutions we work with, under their licences and their regulatory supervision. Your funds sit with those institutions rather than with Niimbu.

We say this plainly because it changes what you can expect. It means the obligations described on this page are partly ours and partly our partners', and it means some decisions about a transaction are not ours alone to make or to explain.

Our obligations, and those of our partners, come from Nigerian law and from the rules that apply to the licensed institutions in the chain. The main ones that shape how the product behaves are:

• The Money Laundering (Prevention and Prohibition) Act and the regulations made under it
• The Terrorism (Prevention and Prohibition) Act
• Central Bank of Nigeria regulations applying to the licensed institutions that hold and move funds
• The Nigeria Data Protection Act and the rules of the Nigeria Data Protection Commission
• Companies and tax legislation governing the records a business must keep

Where a rule requires something of our partners, it reaches you through us, which is why a check can sometimes appear without an obvious reason on our side.

Before an account can use the full service, and periodically afterwards, we verify the business and the people behind it. Depending on the account and the volume, that can involve:

• Confirming the identity of directors, owners and anyone who controls the business, which may require BVN or NIN
• Confirming the business exists and is registered, through CAC records
• Identifying beneficial owners, meaning the people who ultimately own or control the business rather than only those named on the account
• Understanding what the business does, who it sells to, and where its money comes from
• Confirming the business address

Checks are proportionate. A sole trader on a free plan is not asked what a multi branch business processing large volumes is asked. Where risk is higher, the checks go further, and we may ask for information about a specific transaction.

If verification cannot be completed, we may limit or close the account. That is not a judgement about your character. It is that we are not permitted to carry an account we cannot verify.

We maintain policies and procedures designed to keep Niimbu from being used to launder money or finance terrorism. In practice that means a risk based approach: assessing each account, applying checks in proportion to that assessment, and reviewing it as the account changes.

Staff in relevant roles receive training on how money laundering is actually attempted, because the point of training is recognition rather than paperwork. Responsibility for the programme sits with a named officer accountable to management.

Where we are required to report a suspicion to the authorities, we do. The law prohibits us from telling you that a report has been made, and that restriction is on us rather than a choice we are making.

Customers, beneficial owners and, where required, counterparties are screened against applicable sanctions lists and against politically exposed person lists. Screening runs when an account is opened and again as lists are updated, because a name that was clear last year may not be clear today.

A match does not automatically mean a problem. Names are often shared, so a hit is reviewed by a person before any action is taken. Where a genuine match is confirmed, we are required to act on it and may be prohibited from processing a transaction.

Transactions are monitored for patterns that suggest fraud, money laundering or account takeover. Some monitoring runs automatically because volume makes manual review impossible, and unusual activity is escalated to a person.

The practical consequence is that a payment may occasionally be held while it is reviewed. We try to make this rare and short. When it happens we will tell you what we can, and if we cannot explain the reason it is because the law restricts what may be said.

You can reduce false positives considerably by keeping your business profile accurate. An account that says it sells clothing and then starts making large payments to fuel suppliers will attract a question that a correctly described account would not.

Personal data is handled in line with the Nigeria Data Protection Act. Our Privacy Policy sets out what we collect, why, who it goes to and how long it is kept, and it explains the rights you and the people in your records have.

The division of responsibility matters for a vendor review. For data about you and your business, we are the controller. For data about your customers, suppliers and staff that you put into Niimbu, you are the controller and we act as your processor on your instructions.

Financial services law requires records of transactions, verification documents and screening results to be kept for a set period after a transaction or after the relationship ends. Those periods are long, and they override a request to delete the records they cover.

This has an upside for you. The audit trail Niimbu keeps is the same one that answers an auditor, a tax query or a dispute with a supplier, and it is available to you in the product rather than something you have to ask us to produce.

If something has gone wrong, tell us. Write to [email protected] with what happened, when, and any transaction reference. Say clearly that you are making a complaint, so it is treated as one rather than as a question.

We will acknowledge it, investigate, and come back to you with a decision and the reasoning behind it. Where we got it wrong we will say so and put it right. Where the outcome depends on a licensed partner or a payment network, we will tell you that and pursue it on your behalf.

If you are not satisfied with our answer, you can escalate. Where a transaction was carried out by a licensed institution, that institution's regulator has a complaints route, and we will tell you which one applies to your case and how to reach it.

If you believe Niimbu is being used for something it should not be, or that we have failed an obligation described on this page, write to [email protected] with "Compliance" in the subject line.

Reports are taken seriously and reviewed by the person responsible for the programme. You can report anonymously, though a way to reach you helps us investigate properly. We will not retaliate against anyone who raises a concern in good faith.