NigeriaNAICOM Guidelines for Insurtech Operations, August 2025, Technology Security and Access Controls
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds an insurtech registered or authorized by the National Insurance Commission to carry on insurtech business, whether it stands alone or partners with an insurer (reached by declaring that you are an insurer or insurance producer). Insurance institutions and insurtech firms had to comply within thirty days of the Guidelines taking effect on 1st August 2025.
- Have and implement a secure technology framework with proper access controls, and make evidence of it known at the verification stage and on request by the Commission (section 9.1).
- Develop and implement a robust technology security policy approved by your Board in line with the Commission's Technology Guidelines, and submit it for the Commission's approval (section 9.1.2).
- Subject updates of critical information on your website or other channels to dual verification and 2-step authentication, and keep your software and security protocols regularly updated (section 9.1.3).
- Require a minimum two-factor authentication process for all users to have access to your services, and uniquely identify all users of critical devices on your networks (section 9.1.4).
- Introduce logical access controls in your technology infrastructure and test them using periodic penetration testing (section 9.1.5).
- Establish a resilient framework for periodic data backup and recovery, business continuity and data and software management, so that critical information stays available and intact (section 9.1.6).
- If you distribute or market insurance products, deploy an independent technology firm to audit your lead management system, domain and entire operations at least once a year, and submit the audit report to the Commission not later than three months from 31st December of every year (section 9.2).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The National Insurance Commission, which imposes administrative sanctions on an insurtech and may cancel its licence for non-compliance with the Guidelines.
Settledness
- As of
- Open questions
- What do the Commission's Technology Guidelines, which section 9.1.2 of the Guidelines names, require of the technology security policy?
What this law does
The National Insurance Commission issued the Guidelines for Insurtech Operations in Nigeria in exercise of the powers conferred by the National Insurance Commission Act 1997 and the Insurance Act 2003. Section 1.2 of the Guidelines provides that no person shall commence or carry on any class of insurtech business without being registered or authorized by the Commission.
Section 9.1(i) of the Guidelines requires an insurtech to have and implement a secure technology framework with proper access controls. Section 9.1.2 of the Guidelines requires an insurtech to develop and implement a robust technology security policy approved by its Board in line with the Commission's Technology Guidelines, subject to the Commission's approval.
Section 9.1.3.1 of the Guidelines makes updates of critical information on an insurtech's website or other channels subject to dual verification and 2-step authentication. Section 9.1.4 of the Guidelines requires a minimum two-factor authentication process for all users to have access to the services provided by an insurtech.
Section 9.1.5 of the Guidelines requires an insurtech to introduce logical access controls in its technology infrastructure and to test them using periodic penetration testing. Section 9.1.6 of the Guidelines requires an insurtech to establish a resilient framework for periodic data backup and recovery, business continuity and data and software management.
Section 9.2 of the Guidelines requires an insurtech that distributes or markets insurance products to deploy an independent technology firm to audit its lead management system, domain and entire operations at least once a year, and to submit the audit report to the Commission within three months from 31st December of every year. Section 19 of the Guidelines makes them effective from 1st August 2025.
Section 18.2.1(ii) of the Guidelines provides that the Commission shall impose administrative sanctions on an insurtech for identified inappropriate actions or inactions or corporate misconduct. Section 18.2.1(i) of the Guidelines lets the Commission cancel an insurtech's licence or take any other action it considers appropriate on observing any infraction or non-compliance with the Guidelines.
When LexLint raises it
When your app profile says your app is an insurer.