NigeriaBanks and Other Financial Institutions Act, 2020, Cybersecurity Regulation by the Central Bank
Banks and Other Financial Institutions Act, 2020 (Act No. 5 of 2020), s. 68
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://archive.gazettes.africa/archive/ng/2020/ng-government-gazette-supplement-dated-2020-11-17-no-183.pdfIn force since .
A sector security regimes rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security
As of .
What it requires
- This binds a bank, specialised bank or other financial institution licensed under the Act, a class that includes a payment service provider licensed by the Central Bank of Nigeria, a finance company, a bureau de change and a financial holding company (reached by declaring that you provide financial services).
- Comply strictly with the cybersecurity regulations and guidelines that the Central Bank of Nigeria makes or issues under section 68(1) to address cybersecurity issues in the delivery of financial or banking services (section 68(2)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 68(3) fixes a penalty of not less than N2,000,000 on an officer of the institution, plus N50,000 for each day on which the failure to comply continues; the section states no ceiling.
- Rule
- Per violation only
- As of
- Minimum
- 2,000,000
- Currency
- NGN
- Per violation unit
- Day
- Per violation amount
- 50,000
Over one month of continuous breach, NGN 1,522,000.
Who enforces it
Enforcement body
The Central Bank of Nigeria, which makes the cybersecurity regulations and guidelines and imposes the penalty in section 68(3) on the officer of a bank, specialised bank or other financial institution that fails to comply with them.
Settledness
- As of
- Open questions
- Which Central Bank of Nigeria issuances were made under section 68(1) rather than under its earlier guideline power?
What this law does
Section 68(1) of the Banks and Other Financial Institutions Act, 2020 lets the Central Bank of Nigeria make regulations and issue guidelines to banks, specialised banks and other financial institutions to address cybersecurity issues in the delivery of financial or banking services.
Section 68(2) of the Act requires all banks, specialised banks and other financial institutions to comply strictly with the cybersecurity regulations and guidelines the Central Bank of Nigeria makes or issues under section 68(1).
Section 68(3) of the Act makes an officer of a bank, specialised bank or other financial institution who through an action or omission fails to comply with section 68(2) liable to a penalty of not less than N2,000,000 and an additional penalty of N50,000 for each day during which the offence continues.
The Act defines an other financial institution to include a discount house, bureau de change, finance company, money brokerage, international money transfer service, financial holding company and payment service provider. The Act defines a payment service provider as an entity licensed by the Central Bank of Nigeria to provide payment service. The date line of the Act reads .
When LexLint raises it
When your app profile says your app provides financial services.