CBN Requires Banks and Fintechs to Conduct Cybersecurity Self-Assessment

The Central Bank of Nigeria (CBN) has issued a directive for banks and financial institutions to utilize a new cybersecurity self-assessment tool (CSAT) as part of a strategy to enhance the robustness of the nation's financial system.

In a circular dated March 30, the bank explained that the tool is in line with its responsibilities under the Banks and Other Financial Institutions Act (BOFIA) 2020 and will be utilized to assess the cybersecurity readiness of regulated institutions.

The CBN noted that the outcomes of the CSAT would facilitate risk-based supervision and strengthen regulatory oversight concerning cybersecurity risks within the financial framework.

"Hence, all implicated institutions are expected to accurately complete and submit the CSAT via a specified portal," the circular highlighted.

Furthermore, the regulator indicated that access to the submission portal, along with necessary guidance, would be provided to chief information security officers and other pertinent personnel within the affected institutions.

According to the CBN's requirements, all submissions should reflect data as of December 31, 2025, and must include any necessary supporting documents.

The apex bank warned that the provision of false, misleading, or incorrect data would be deemed a regulatory violation, with consequences as stipulated by BOFIA 2020.

Additionally, the CBN mentioned that validation processes, including off-site evaluations and supervisory engagements, will be carried out to ensure the authenticity of submissions.