CBN orders banks to assess their own cybersecurity within 21 days

The Central Bank of Nigeria has directed all deposit money banks, microfinance banks, payment service providers, and other regulated financial institutions to complete a new Cybersecurity Self-Assessment Tool (CSAT) and submit it through a dedicated portal.

The directive, dated March 30, 2026, takes immediate effect.

Deposit money banks have three weeks to comply. All other institutions—payment service banks, microfinance banks, payment service providers, finance companies, and development finance institutions have five weeks.

The CSAT asks institutions to report on five areas: cybersecurity governance, risk management, technology and third-party risk controls, incident response, and operational resilience. The CBN said it will use the results to guide risk-based supervision of the financial sector.

Access credentials to the submission portal will be sent to each institution’s chief information security officer. All data submitted must reflect the state of operations as of December 31, 2025.

The CBN was direct about accuracy: institutions that submit false, incomplete, or misleading information will face sanctions under BOFIA 2020. The regulator said it will run off-site reviews and supervisory checks to verify what banks report.

The move comes as cyberattacks on Nigerian financial institutions have increased. According to Check Point Software Technologies, the sector recorded 4,718 weekly attacks in 2024, well above global averages for banking. Fraud losses in Q1 2025 reached ₦3.29 billion, a 603% rise year-on-year, per data from the Financial Institutions Training Centre.

Instant payment volumes have grown alongside the threat. NIBSS data shows NIP transactions hit ₦284.99 trillion in Q1 2025 alone, expanding the attack surface across web, mobile, and agent banking channels.

Last updated: April 1, 2026