The Central Bank of Nigeria has directed banks and other financial institutions to submit detailed reports on their cybersecurity frameworks within three weeks, as part of efforts to strengthen oversight and protect the financial system from growing digital threats.
In a circular to Deposit Money Banks, Payment Service Banks, Microfinance Banks, fintechs, and other regulated entities, the apex bank introduced a Cybersecurity Self-Assessment Tool (CSAT) to evaluate how well institutions can withstand cyber risks.
Under the directive, Deposit Money Banks are required to complete and submit the assessment within three weeks, while other financial institutions have up to five weeks.
The CBN explained that the tool will capture key details on institutions’ cybersecurity posture, including governance structures, risk management processes, technology controls, third-party risks, incident response, and overall operational resilience.
According to the regulator, insights from the CSAT will support risk-based supervision and enhance oversight of cybersecurity risks across the financial system.
Access to the submission portal and guidelines will be provided to Chief Information Security Officers and relevant officials of affected institutions.
All submissions must reflect data as of December 31, 2025, and include supporting documentation where necessary. The CBN warned that any false or misleading information would be considered a breach under the Banks and Other Financial Institutions Act 2020 and could attract sanctions.
The bank also revealed plans to carry out validation checks, including off-site reviews and supervisory engagements, to ensure accuracy.
The directive takes immediate effect, highlighting the urgency of strengthening cybersecurity resilience across Nigeria’s financial sector.
