Is a bank, in Nigeria

Access to Registered Information in the National Identity Database Regulations, 2017 (S.I. No. 16 of 2017) · Read the law's page

• Where you are a person other than a security, Government or licensed private agency, obtain an application made by or with the authority of the registered individual, or the individual's consent given by submitting the National Identification Number or biometrics, before you receive that individual's registered information, and do not seek fingerprint or other biometric information through such an application (regulation 4(1) and (2)).
• Where you are a private agency verifying or authenticating a registered individual's identity against the National Identity Database, hold the licence the Commission grants, obtain the registered individual's consent and pay the applicable fees (regulation 7(1) and (2)).
• Where you are a Government agency, make a prior written request to the Commission from an official not below the rank of a Permanent Secretary or Director-General, and comply with the procedures, processes and guidelines the Commission prescribes (regulation 6(2)).for a public body
• Use devices that conform to the specifications and standards in the Commission's guidelines when obtaining registered information (regulation 8(2)).
• Do not use or disclose registered information obtained by the grant of access without authority, and do not access data or information contained in the National Identity Database without authority (regulation 9(2)(d) and (h)).

Mandatory Use of the National Identification Number Regulations, 2017 (S.I. No. 15 of 2017) · Read the law's page

• Treat the National Identification Number as mandatory for each transaction regulation 1(1) lists beyond the Act's own list, among them operating a bank account, cashing in on financial instruments, the purchase and sale of foreign currency in banks and bureau de change, documentation for loans, the purchase of insurance policies, the acquisition, sale or transfer of shares, the purchase and registration of telephone SIM cards and other communication devices, tenancy agreements, and executing any contract or business agreement (regulation 1(1)).
• Where you are a government agency listed in the First Schedule that offers a service regulation 1(1) lists, require any person transacting with you to produce a National Identification Number, and verify and authenticate the person or number in the National Identity Database through real-time online verification from the NIMC Verification Service Platform, a Card Acceptance Device, a Card Reading Device, or a combination of them (regulation 1(2)).when it serves a public body
• Give the Commission evidence of compliance when it demands it (regulation 5(a)), and allow it to audit the state of affairs and operations of your transactions or services on written notice of not less than 24 hours (regulation 6(a)).

Banks and Other Financial Institutions Act, 2020 (Act No. 5 of 2020), s. 68 · Read the law's page

• This binds a bank, specialised bank or other financial institution licensed under the Act, a class that includes a payment service provider licensed by the Central Bank of Nigeria, a finance company, a bureau de change and a financial holding company (reached by declaring that you provide financial services).
• Comply strictly with the cybersecurity regulations and guidelines that the Central Bank of Nigeria makes or issues under section 68(1) to address cybersecurity issues in the delivery of financial or banking services (section 68(2)).

Central Bank of Nigeria, Revised Regulatory Framework for Bank Verification Number (BVN) Operations and Watch-list for the Nigerian Banking Industry (October 2021) · Read the law's page

• Capture BVN data properly, including data captured by your agents, and validate it before you link it to a customer's account or wallet, except Tier 1; link every operated account or wallet, except Tier 1, to the signatories' BVNs within 24 hours of NIBSS making the BVN available, and link the BVNs of all signatories, Directors and beneficial owners to non-individual accounts or wallets (clause 1.5.3(i), (ii) and (iv)).
• Let no new account or wallet, except Tier 1, operate without a BVN, except for inflows, and close any account or wallet, except Tier 1, that has no BVN within 30 days (clause 1.6(v)).
• Require a BVN or a NIN for each individual Tier 1 account or wallet, and a BVN and a NIN for each individual Tier 2 and Tier 3 account or wallet, as the Central Bank's December 2023 circular directs (Central Bank BVN page).
• Report the BVNs of individuals in breach to NIBSS for update on the Watch-list within 1 business day of breach, and report the BVNs of confirmed deceased customers to NIBSS for designation as "DECEASED" within 24 hours of confirmation (clause 1.5.3(vi) and (vii)).
• Investigate an alleged breach within one month, place the customer's account on Post-No-Debit once a breach is established, notify the customer through verifiable means within five business days, and give the customer three business days to present documentary evidence before a decision to watch-list the BVN (clauses 2.1 and 2.2).
• Integrate your banking application with the Watch-list for online identification and verification of watch-listed individuals as transactions occur, and enforce the sanctions in the Framework on customers' accounts or wallets, except Tier 1 (clause 1.5.3(xiii) and (xiv)).
• Use the BVN API only for account or wallet opening, maintenance and validation, and do not use a BVN to sanction an individual for a non-financial offence or for identification outside the banking system (clauses 1.5.3(xvi) and 1.9).
• Allow access to the BVN database only as clause 1.7 provides: other financial institutions, excluding payment service providers, and payment service providers through NIBSS need the customer's consent, and foreign entities are not allowed access (clause 1.7).
• Store BVN data within Nigeria and do not route it across borders without the consent of the Central Bank, treat BVN information as confidential, put in place secure hardware, software and encryption of messages transmitted through a secured network, and comply with the Nigeria Data Protection Regulation or any Central Bank regulation on data protection (clause 1.11).

Money Laundering (Prevention and Prohibition) Act, 2022, s. 11 · Read the law's page

• It reaches you if you are a financial institution as section 30 of the Act defines the term, or a designated non-financial business or profession. Report in writing, within seven days, any single transaction, lodgment or transfer of funds in excess of N5,000,000 or its equivalent in the case of an individual, or N10,000,000 or its equivalent in the case of a body corporate (section 11(1)(a) and (b)).
• A financial institution makes the report to the Nigerian Financial Intelligence Unit, and a designated non-financial business and profession makes it to the Special Control Unit Against Money Laundering (section 11(1)).
• Do not conduct two or more transactions separately with one or more financial institutions or designated non-financial businesses and professions with intent to avoid the duty to report a transaction that should be reported under the Act (section 2(2)(a)).

Money Laundering (Prevention and Prohibition) Act, 2022, ss. 4, 8 and 13 · Read the law's page

• It reaches you if you are a financial institution as section 30 of the Act defines the term, or a designated non-financial business or profession. Identify each customer, whether permanent or occasional, natural or legal person or any other form of legal arrangement, using the identification documents prescribed in any relevant regulation, and verify the customer's identity using reliable, independent source documents, data or information (section 4(1)(a) and (b)).
• Identify the beneficial owner using relevant information or data from a reliable source so that you are satisfied you know who the beneficial owner is, and take reasonable measures to verify that any person purporting to act on behalf of the customer is so authorised, identified and verified (section 4(1)(c) and (d)).
• Undertake customer due diligence when establishing business relationships, when carrying out occasional transactions above the applicable designated threshold prescribed by relevant regulations (including transactions carried out in a single operation or in several operations that appear to be linked), when carrying out occasional wire transfers, when there is a suspicion of money laundering or terrorist financing regardless of any exemption or threshold, and when you doubt the veracity or adequacy of previously obtained customer identification data (section 4(2)).
• Conduct ongoing due diligence on each business relationship, scrutinise transactions undertaken during the relationship to ensure they are consistent with your knowledge of the customer, their business and risk profile and, where necessary, the source of funds, and keep customer due diligence documents, data and information up to date by reviewing existing records, particularly for higher risk customers and relationships (section 4(3)).
• Apply enhanced measures where higher risks are identified, and simplified measures only where lower risks are identified and never where there is suspicion of money laundering or terrorist financing (section 4(4)(a) and (b)). Put in place appropriate risk management systems and procedures to determine whether a customer or beneficial owner is a politically exposed person (section 4(7)).
• Preserve records on transactions, both domestic and international, for at least five years following completion of the transaction, and all records obtained under section 4, including account files and business correspondence and the results of any analysis, for at least five years following the termination of the business relationship or after the date of the occasional transaction. Keep the records sufficient to permit individual transactions to be readily reconstructed at any time and make them swiftly available to the competent authorities (section 8).
• Identify and assess the money laundering and terrorism financing risks that may arise from new products, new business practices, new delivery mechanisms and new or developing technologies, undertake the risk assessment prior to launch or use, and take appropriate measures to manage and mitigate the risks (section 13).

Money Laundering (Prevention and Prohibition) Act, 2022, ss. 7 and 19(1)(a) · Read the law's page

• It reaches you if you are a financial institution as section 30 of the Act defines the term, which includes banks, investment and securities businesses, virtual asset service providers, discount houses, insurance institutions, bureaux de change, finance companies and fund, investment and pension fund managers, or if you are a designated non-financial business or profession (section 7(1)). Treat a transaction as suspicious where it involves an unjustifiable or unreasonable frequency, is surrounded by unusual or unjustified complexity, appears to have no economic justification or lawful objective, is inconsistent with the known transaction pattern of the account or business relationship, or in your opinion involves the proceeds of a criminal activity, an unlawful act, money laundering or terrorist financing (section 7(1)(a) to (e)).
• Report a suspicious transaction to the Nigerian Financial Intelligence Unit immediately (section 7(1)). Within 24 hours after the transaction, draw up a written report containing all relevant information, the reasons and the identity of the principal and, where applicable, of the beneficiary or beneficiaries, take appropriate action to prevent the laundering of the proceeds of a crime or an illegal act, and report the suspicious transaction and the actions taken to the Unit (section 7(2)).
• Apply the reporting duty whether or not the transaction is complete (section 7(3)).
• Where the Unit's acknowledgement of a report is accompanied by a notice deferring the transaction, hold the transaction for the period stated, which may not exceed 72 hours (section 7(5)). Where the acknowledgement carries no stop notice, or the stop notice has expired and no order of the Federal High Court to block the transaction has reached you, you may carry out the transaction (section 7(7)).
• Do not warn or in any other way intimate the owner of the funds involved in the transaction about the report you are required to make or the action taken on it, and do not refrain from making the report (section 19(1)(a)).

Terrorism (Prevention and Prohibition) Act, 2022, ss. 54 and 61 · Read the law's page

• It reaches you if you are a financial institution, a designated non-financial business or profession or any other entity in Nigeria: the freezing duty falls on all natural and legal persons in Nigeria (section 54(1) and section 61(1)). On publication of the UN Consolidated List of persons and entities designated under UNSCR 1267(1999) and its successor resolutions, and of the Nigeria Sanctions List, immediately identify and freeze, without prior notice, all funds, assets and any other economic resources belonging to the designated person or entity in your possession, and report the freeze to the Sanctions Committee (section 54(1)(a)). "Immediately" means not later than 24 hours (section 54(5)).
• Report to the Sanctions Committee any assets frozen or actions taken in compliance with the prohibition requirements of the relevant UNSCRs, including attempted transactions (section 54(1)(b)). Immediately file a Suspicious Transactions Report with the Nigerian Financial Intelligence Unit on the financial activities of the designated person or entity, and report as a Suspicious Transactions Report all cases of name matching in financial transactions prior to or after receipt of the Nigerian Sanctions List (section 54(1)(c) and (d)).
• Extend the freeze to all funds or other assets owned or controlled by the designated person or entity and not just those tied to a particular act, plot or threat, to funds or assets wholly or jointly owned or controlled directly or indirectly by designated persons or entities, to funds or assets derived or generated from them, and to funds or assets of persons and entities acting on behalf of or at the direction of designated persons or entities (section 54(2)).
• Monitor your accounts and transactions against the UN Consolidated List and the Nigeria Sanctions List (section 54(6)).
• On publication of the UN Consolidated List of persons and entities designated under UNSCRs that relate to the financing of proliferation of weapons of mass destruction, immediately identify and freeze all funds, assets and any other economic resources belonging to a designated person or entity in your possession and report the freeze to the Nigeria Sanctions Committee, immediately file a Suspicious Transactions Report with the Nigerian Financial Intelligence Unit, report as a Suspicious Transactions Report all cases of name matching in financial transactions prior to or after receipt of the list, and monitor your accounts and transactions against the UN Consolidated List (section 61(1), (4), (5) and (6)).

Terrorism (Prevention and Prohibition) Act, 2022, ss. 83 and 84 · Read the law's page

• It reaches you if you are a financial institution or a designated non-financial institution (section 83(1) and section 84(1)). Develop and implement programmes and strategies for combating the financing of terrorism, and keep a record of any complex, unusual large and unusual pattern of transaction which has no apparent economic or visible lawful source or purpose (section 83(1)).
• Keep a report detailing all the parties involved in such transactions, and make it available on request by the relevant agency (section 83(2)).
• Within 24 hours, forward to the Nigerian Financial Intelligence Unit reports of suspicious transactions relating to terrorism, terrorism financing or proliferation financing where there are sufficient reasons to suspect that the funds are derived from legal or illegal sources and are intended to be used for an act of terrorism, terrorism financing or proliferation financing, are proceeds of a crime related to terrorism, terrorism financing or proliferation financing, or belong to a person, entity or organisation considered as terrorist (section 84(1)).

Central Bank of Nigeria (Customer Due Diligence) Regulations, 2023 (S.I. No. 25 of 2023), regulation 35(f) · Read the law's page

• It reaches you if you are a financial institution under the regulatory purview of the Central Bank of Nigeria (regulation 3).
• Conduct regular monitoring of internet-based business or customers (regulation 35(f)).
• Where a significant proportion of your business is operated electronically, put in place computerized monitoring systems or solutions designed to recognize unusual transactions and related patterns of transactions, so as to recognize suspicious transactions (regulation 35(f)).

Risk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Banks, 2024, s. 5 and Appendices I and VII · Read the law's page

• This binds a commercial bank, merchant bank, non-interest bank or payment service bank supervised by the Central Bank of Nigeria's Banking Supervision Department, which the Framework calls a Supervised Financial Institution (reached by declaring that you are a bank). Full compliance was due on July 1, 2024.
• Report every cyber incident to the Director, Banking Supervision, Central Bank of Nigeria not later than 24 hours after you detect it, using the report format in Appendix VII or any other format the Central Bank advises (section 5).
• Treat as a cyber incident any event which may result in a financial loss above 0.01% of shareholders' funds unimpaired by losses, a data breach or data destruction, an unplanned outage in the Core Banking Application, website defacement, any glitch that results in financial losses, or another event the Central Bank determines from time to time (Appendix I).
• Provide additional information to the Central Bank afterwards where necessary, and provide an update where your earlier report was incomplete (section 5 and Appendix VII).

Risk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Banks, 2024, ss. 1 to 3 and Appendices III and IV · Read the law's page

• This binds a commercial bank, merchant bank, non-interest bank or payment service bank supervised by the Central Bank of Nigeria's Banking Supervision Department, which the Framework calls a Supervised Financial Institution (reached by declaring that you are a bank). Full compliance was due on July 1, 2024.
• Implement a cybersecurity programme that includes, at a minimum, risk assessment, security policy development, incident response planning, vulnerability management, log monitoring, a data backup and recovery plan, security awareness and training, initiatives to attain target maturity level and metrics to assess the effectiveness of the programme (section 1.1.2).
• Have a vulnerability assessment and threat analysis done every year, have a third party conduct a penetration test at least annually, and run internal vulnerability scans quarterly (section 2.2).
• Maintain ongoing (24/7) monitoring of your IT systems, infrastructure, applications and services to detect anomalies and cyber incidents promptly (section 3.3).
• Secure employee, customer and third-party access to your network, systems and applications with multifactor authentication, role based access control and layered controls, and use multi-factor authentication on critical systems (Appendix III, item 1.1).
• For any emerging technology you adopt, which the Framework says includes contactless payments, voice-initiated services, USSD codes, open banking, distributed ledger technology, artificial intelligence, cloud computing, the Internet of Things and fintech connections, establish strong authentication systems, encrypt sensitive data in transit and at rest, and run regular vulnerability assessments and penetration tests (section 4 and Appendix IV, item 2).
• Appoint a Chief Information Security Officer who meets the Framework's requirements, subject to Central Bank of Nigeria approval (section 1.4).
• Submit the annual cybersecurity self-assessment for January to December of the previous year to the Director, Banking Supervision Department of the Central Bank of Nigeria not later than February 28 (section 2.5).

National Identity Management Commission (Establishment) Act, 2026 (Act No. 3 of 2026), ss. 24-27 · Read the law's page

• Do not access the data or information held in the National Identity Database for a registered person unless the registered person has given and not withdrawn consent to the disclosure, or the disclosure is necessary for compliance with a legal obligation you are subject to, for a task carried out in the public interest or in the exercise of official authority vested in you, for the prevention, detection, investigation, prosecution or punishment of an offence, or for the preparation or conduct of proceedings before a court (section 24(2)).
• Where you are provided with registered information in connection with a particular purpose, use it for that purpose only, unless the registered person consents to the other use, the other use is authorised or required by law, the other purpose is directly related to the purpose for which the information was collected, or the information is used in a form in which the registered person is not identified or for statistical or research purposes without being published in a form that can reasonably be expected to identify the person (section 24(6)).
• Where you use or disclose registered information, implement appropriate technical and organisational measures to ensure that the use or disclosure does not harm the rights and freedom of the relevant registered person (section 24(7)).
• State in each request for access to registered information the purpose for which it is required, the period of retention of the information, the recipient, and the security and confidential modalities for disposing of the information once it is no longer required (section 24(9)).
• Where you are an agent the Commission licenses to carry out authentication and verification on its behalf, store any registered information securely and perform only the services the Act and the Commission's directions provide for (section 25(1)).
• Where you facilitate, or provide the service for, a transaction listed in section 26(1), among them financial transactions, the opening of bank accounts, the purchase of insurance policies, registration for telecommunications services, consumer credit transactions and the payment of taxes, verify the identity of the parties involved in the transaction using the National Identity Number provided (section 26(4)).
• Do not, without lawful authorisation by the Commission, intentionally access or secure access to the National Identity Database, download, copy or extract data from it, reveal, share, use or display information contained within it, or use or tamper with its data to modify information relating to a registered person or to discover any information (section 27(1)).

Cybercrimes (Prohibition, Prevention, etc.) Act, 2015, section 21, Reporting of Cyber Threats, as amended by the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act, 2024 · Read the law's page

• This binds any person or institution, whether public or private, that operates a computer system or a network in Nigeria; there is no sector or size gate.
• Immediately inform the National Computer Emergency Response Team (CERT) Coordination Center, through your sectoral CERT or sectoral Security Operations Centre, of any attack, intrusion, or other disruption liable to hinder the functioning of another computer system or network.
• Report the incident to the National CERT within 72 hours of its detection. Failing to do so is itself an offence, punishable by denial of internet services and a mandatory fine of N2,000,000 payable into the National Cyber Security Fund.

Guidelines for the Operations of Agent Banking in Nigeria, October 2025, ss. 9.1.2 and 12 and Appendix I · Read the law's page

• This binds a financial institution licensed by the Central Bank of Nigeria to act as a Principal in agent banking, meaning a commercial bank, non-interest bank, payment service bank, microfinance bank or mobile money operator (reached by declaring that you are a bank or a payment provider), and places duties on a Super Agent and on a Payments Terminal Service Aggregator where a section below names one.
• Render monthly returns to the Director, Payments System Supervision Department of the Central Bank of Nigeria, not later than the 10th day of the following month, that include the incidents of fraud, theft or robbery at any Agent location (sections 12.1 and 12.3).
• Have each return signed by the Managing Director or Chief Executive Officer and the Chief Compliance Officer (section 12.4).
• Continuously monitor each Agent's compliance with transaction limits and report any suspicious or fraudulent activity of the Agent (section 9.1.2, item xi).

Guidelines for the Operations of Agent Banking in Nigeria, October 2025, ss. 9.3, 9.4 and 10.5 to 11 · Read the law's page

• This binds a financial institution licensed by the Central Bank of Nigeria to act as a Principal in agent banking, meaning a commercial bank, non-interest bank, payment service bank, microfinance bank or mobile money operator (reached by declaring that you are a bank or a payment provider), and places duties on a Super Agent and on a Payments Terminal Service Aggregator where a section below names one.
• Make the technology you use for Agent banking transmit transaction information in a secure manner, reject suspicious transactions automatically, prevent an Agent automatically from exceeding the daily limit allowed or performing unauthorized transactions, and apply a minimum of Two-Factor Authentication per customer, per transaction (section 10.5).
• Put in place systems that address, at the minimum, physical and logical security of infrastructure, availability of services, data confidentiality and integrity, encryption of PIN and electronic transactions, customer accountability and non-repudiation of transactions, and error messaging and exception handling (section 10.6).
• Institute systems and personnel to monitor and control Agent banking operations on an ongoing basis, and maintain an incidence register with resolution timelines for reported incidents (section 10.7).
• Geo-fence or tag every device deployed to an Agent or used by an Agent so that it operates only within the agreed registered Agent premises or location (section 11).
• As a Payments Terminal Service Aggregator, register each PoS terminal deployed for Agent banking on your platform, facilitate its geo-fencing or geo-location, and integrate your Terminal Management System with the CBN Automated Regulatory Data Solutions (section 9.4).
• As a Super Agent, implement appropriate technologies for monitoring the online real time activities of Agents (section 9.3.2).

Guidelines on Operations of Electronic Payment Channels in Nigeria, ss. 1.5, 2.3, 3.2 and 4.3 · Read the law's page

• This binds a bank or independent organization that deploys an ATM, a CBN licensed merchant acquirer, a Payment Terminal Services Provider, the Payments Terminal Service Aggregator, an issuer and a switch, for the channel each section names (reached by declaring that you are a bank or a payment provider); the Guidelines also place duties on merchants and cardholders that no declaration here reaches.
• If you deploy or acquire for ATMs, comply with the Payment Card Industry Data Security Standards (section 1.1.1).
• Fit every ATM with cameras that view and record all persons using the machine and every activity at the ATM without recording customers' key strokes, and with anti-skimming devices (section 1.5).
• Change ATM keys regularly, every year, never use the same keys at multiple ATMs, and demonstrate that the networks carrying ATM transactions have data confidentiality and integrity (section 1.5).
• Monitor suspicious ATM transactions and report them to the CBN in the agreed format and timeframe (section 1.3).
• Ensure that the terminals, applications and processing systems you use to process or store cardholder information comply with the minimum requirements of PA DSS, PCI PED, PCI DSS, Triple DES, which is the minimum standard for data transmitted and authenticated between parties, and EMV (sections 2.3 and 2.3.4).
• Connect all your PoS terminals or other acquiring devices directly to a Payments Terminal Service Aggregator, and do not deploy POS terminals other than through a CBN licensed Payment Terminal Services Provider (sections 2.4.1.5 and 2.4.2.4).
• Ensure, with your Payment Terminal Services Providers, that merchants are trained and put in place reasonable processes and systems for confirming cardholder identity and detecting suspicious or unauthorized usage of electronic payment instruments where the customer and card are physically present (section 2.4.1.9).
• Provide mobile POS solutions that use PCI PIN Transaction Security in accordance with the PCI Point-to-Point Encryption Solution Requirements (section 3.2.2).
• Use only gateway providers that comply with PCI DSS, PA DSS, Triple DES and second factor authentication for web acquiring, and implement a fraud management system that detects customer usage pattern and declines or accepts transactions based on its rules (sections 4.3 and 4.5.1.13).

Nigerian Payments System Risk and Information Security Management Framework, ss. 8.6, 9.1 and 13 · Read the law's page

• This binds a payment system operator, a participant in a payment system and a payment service provider, whether or not it is a bank (reached by declaring that you are a bank or a payment provider).
• Establish and implement information security policies that are in line with ISO 27001 standards or subsequent standards (section 8.6(i)(a)).
• Ensure the confidentiality, integrity and availability of all information, systems and networks that are critical to the success of the payment scheme, and deploy the resources required to do so for those you own (section 8.6(i)(b)).
• Conduct an annual information security assessment that includes penetration and vulnerability tests (section 8.6(iii)).
• Require a minimum of 2 factor authentication for every card-not-present transaction on a Nigerian issued card from a Nigerian acquired merchant, except a card on file transaction where the initial transaction used 2 factor authentication (section 9.1(vii)).

Regulatory Framework for the Use of Unstructured Supplementary Service Data (USSD) for Financial Services in Nigeria, ss. 6 and 10 · Read the law's page

• This binds a bank, other financial institution or payment service provider that provides financial services through the USSD channel, and a mobile money operator licensed by the Central Bank of Nigeria (reached by declaring that you provide financial services); the Framework also names mobile network operators and value added service providers licensed by the Nigerian Communications Commission as participants.
• Put in place a message authentication mechanism that validates that requests and responses are generated through authenticated users, using a minimum combination of any of the IMSI, the date of SIM swaps, the date of MSISDN recycle, the IMEI, the date of device change and similar data (section 6.1).
• Ensure that the customer receives notification on the status of every transaction conducted through the channel (section 6.2).
• Ensure encryption of USSD information within your environment by an auditable process, at least radio encryption between the user's SIM-enabled device and base stations, and secure transmission of USSD signals between the network operator and the USSD aggregators and between the aggregators and the bank (sections 6.4 to 6.6).
• Encrypt the data the USSD application stores at your institution (section 6.7).
• Mandate an effective second factor of authentication for every customer transaction above N20,000, in addition to the PIN used for all transaction amounts, and do not send the second factor to the customer's registered GSM number or device or generate or display it on the USSD menu (sections 6.10 and 6.11).
• Install a behavioural monitoring system with capability to detect SIM-swap or churn status, user location and unusual transactions at weekends (section 6.12).

Supervisory Framework for Payment Service Banks, July 2021, s. 9.0 · Read the law's page

• This binds a payment service bank licensed by the Central Bank of Nigeria (reached by declaring that you are a bank).
• Comply with the Nigerian Financial Services Industry IT Standard Blueprint and the Risk Based Cyber Security Framework, and with all other regulations the Central Bank issues regarding ICT infrastructure for banks (section 9.0).
• Comply with PCI DSS and ISO 27001/27002 as the standards for information and technology security (section 9.0).
• Put in place a cybersecurity programme that meets the minimum requirement laid out in the Risk Based Cybersecurity Framework (section 9.0).