Banks, OFIs must adhere to minimum cybersecurity standards says CBN

By Editor

The Central  Bank of Nigeria, CBN  new guidelines for the 2024-2025 fiscal year has insisted on broader commitment to ensuring that banks, Other Financial Institutions (OFIs), and Payment Service Providers (PSPs) adhere to minimum cybersecurity standards.

This was part of the recently released Monetary, Credit, Foreign Trade, and Exchange Policy Guidelines for Fiscal Years 2024-2025.

These include the appointment of Chief Information Security Officers (CISOs) to oversee cybersecurity issues in compliance with the 2022 risk-based cybersecurity framework and cybercrime levy.

“The CBN shall continue to enforce the payment of the mandatory levy of 0.005 per cent on all electronic transactions by banks and other financial institutions, in accordance with the Cybercrime (Prohibition, Prevention, etc.) Act, 2015.”

“Pursuant to the circular titled ‘Issuance of Risk-based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Providers referenced BSD/DIR/GEN/LAB/11/25, and dated October 10, 2018, issued by the CBN to combat the increasing cyber security threat in the banking industry, banks and Payment Service Providers (PSPs) are mandated to adhere to the guidelines on the risk-based cyber security framework. And cybercrime levy at 0.005% on all electronic transactions under its new guidelines for the 2024-2025 fiscal year.

“Similarly, another framework titled ‘Issuance of Risk-based Cybersecurity Framework and Guidelines for Other Financial Institutions (OFIs)’, referenced OFI/DOA/CON/ACT/004/155, was issued on June 29, 2022. The guidelines specified the minimum cyber-security baseline to be implemented by banks, OFIs and PSPs, and mandated the appointment of a Chief Information Security Officer (CISO) to oversee cyber-security issues.”

It would be recalled that in May this year, the Central Bank of Nigeria (CBN) had ordered banks to enact the process of deduction of cyber security levy to be administered by the office of the National Security Adviser (NSA).

The apex banks warned that the penalty for defaulting is as prescribed in the amended Cyber Crime Prohibition and Prevention Act which is liable to a fine amounting to no less than 2% of the turnover of the defaulting business and others.

However, the levy mandated by the Cybercrime (Prohibition, Prevention, etc.) Act of 2015, aimed at bolstering the nation’s cyber security infrastructure.