CBN orders banks, fintechs to submit Cybersecurity report in 3 weeks

n n

CBN

n

By Elizabeth Adegbesan

n

The Central Bank of Nigeria has directed banks and other financial institutions to submit detailed reports on their cybersecurity frameworks within three weeks, in a move to strengthen oversight and safeguard the financial system against rising digital threats.

n

In a circular to Deposit Money Banks (DMBs), Payment Service Banks, Microfinance Banks, fintechs and other regulated entities, the apex bank announced the deployment of a Cybersecurity Self-Assessment Tool (CSAT) to evaluate institutions’ resilience to cyber risks.

n

Under the directive, DMBs are required to complete and submit the assessment within three weeks, while all other financial institutions have a five-week deadline.

n

The CBN said the tool is designed to obtain comprehensive information on the cybersecurity posture of regulated institutions, covering governance structures, risk management processes, technology controls, third-party risks, incident response capabilities and overall operational resilience.

n

“The insights derived from the CSAT will support risk-based supervision and enhance regulatory oversight of cybersecurity risks across the financial system,” the bank stated.

n

The regulator added that access to the submission portal and detailed guidelines would be provided to Chief Information Security Officers and relevant officials of the affected institutions.

n

The directive requires that all submissions reflect data as at December 31, 2025, and must be accompanied by supporting documentation where applicable.

n

The CBN warned that all information provided must be accurate, complete and verifiable, stressing that submission of false or misleading data would constitute a regulatory breach under the Banks and Other Financial Institutions Act (BOFIA) 2020 and attract sanctions.

n

It also disclosed plans to conduct validation exercises, including off-site reviews and supervisory engagements, to confirm the accuracy of submissions.

n

The circular takes immediate effect, underscoring the urgency of the apex bank’s push to reinforce cybersecurity resilience across Nigeria’s financial sector.

n n