CBN Sets Tough Cybersecurity Timeline for Nigerian Banks

The Central Bank of Nigeria (CBN) has directed banks to complete a mandatory cybersecurity self-assessment within three weeks as part of efforts to strengthen resilience across the financial system. The initiative, announced in a letter dated March 30, 2026, compels banks and other regulated entities to evaluate their exposure to digital threats using a newly deployed Cybersecurity Self-Assessment Tool. This move is a notable tightening of regulatory oversight as the nation’s financial sector grapples with an increasingly hostile digital environment.

The regulatory timeline for compliance is strict, forcing firms to act quickly to avoid sanctions:

Media additions

• Three weeks: Deadline for Deposit Money Banks to submit their completed assessments.
• Five weeks: Deadline for all other regulated financial institutions, including payment service providers and microfinance banks.

The CBN warned that the submission of false or incomplete data will be treated as a regulatory breach. To ensure the integrity of the process, the regulator intends to conduct off-site reviews and supervisory engagements to validate the information provided by firms regarding their status as of December 31, 2025.

The urgency of this directive reflects a broader, industry-wide recognition that cybersecurity is no longer merely an IT concern, but a core pillar of operational stability. Babatunde Ogunsipe, a financial expert, noted that investment in privacy governance and consumer protection is now a critical business strategy rather than just a requirement. According to reports, failure to manage these risks during organizational changes or mergers can lead to significant data breaches and loss of customer trust.

The Evolving Threat Landscape

The shift toward stricter regulation coincides with reports of increasingly sophisticated attacks. Financial institutions are facing risks from ransomware, social engineering, and vulnerabilities in third-party supply chains. Deloitte’s analysis highlights that the integration of artificial intelligence is creating a paradox: while companies use AI to automate threat detection, cybercriminals are simultaneously utilizing the same technology to launch more precise phishing campaigns and deepfake-based scams.

These dangers were a focal point at a recent cyber resilience workshop hosted by the Chartered Institute of Bankers of Nigeria in collaboration with Digital Jewels Africa. Experts at the event described data as the Digital Crown Jewels, emphasizing that minimizing rewards for attackers is essential to maintaining the stability of the digital economy.

The reliance on third-party partners and cloud-based applications further complicates the security architecture. Poorly secured APIs have become entry points for unauthorized access, necessitating continuous monitoring rather than infrequent, manual audits. Furthermore, the industry faces a significant talent shortage, as many experienced professionals have left the country, leaving local firms to focus on internal mentorship and capacity-building to bridge the skills gap.

Strategic Imperatives for Banks

As the sector moves to comply with the CBN’s latest assessment tool, industry leaders are shifting their focus toward several key areas:

Strategy Area	Objective
Governance	Ensuring accountability and ethical risk management are measurable.
Data Protection	Aligning with mandates from the Nigeria Data Protection Commission.
Insurance	Utilizing cyber insurance to mitigate the financial fallout of breaches.
Talent	Building sustainable pipelines through local training and recruitment.

Regulators are moving beyond simple policy enforcement to a model of risk-based supervision that prioritizes incident response capacity and technological resilience. As cyber incidents remain an issue of when, not if, the ability of these institutions to demonstrate transparency and robust security will be the primary factor in maintaining consumer confidence throughout the year.