NigeriaCBN Nigerian Payments System Risk and Information Security Management Framework, Information Security Duties of Operators, Participants and Payment Service Providers
Nigerian Payments System Risk and Information Security Management Framework, ss. 8.6, 9.1 and 13
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://www.cbn.gov.ng/Out/2020/PSMD/Nigerian%20Payments%20System%20Risk%20and%20Information%20Security%20Management%20Framework.pdfIn force.
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds a payment system operator, a participant in a payment system and a payment service provider, whether or not it is a bank (reached by declaring that you are a bank or a payment provider).
- Establish and implement information security policies that are in line with ISO 27001 standards or subsequent standards (section 8.6(i)(a)).
- Ensure the confidentiality, integrity and availability of all information, systems and networks that are critical to the success of the payment scheme, and deploy the resources required to do so for those you own (section 8.6(i)(b)).
- Conduct an annual information security assessment that includes penetration and vulnerability tests (section 8.6(iii)).
- Require a minimum of 2 factor authentication for every card-not-present transaction on a Nigerian issued card from a Nigerian acquired merchant, except a card on file transaction where the initial transaction used 2 factor authentication (section 9.1(vii)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Central Bank of Nigeria, which monitors and enforces compliance with the Framework.
Settledness
- As of
- Open questions
- Does the fine in section 33(5)(a) of the Central Bank of Nigeria (Establishment) Act, 2007, or the penalty in section 68(3) of the Banks and Other Financial Institutions Act, 2020, sanction a breach of this Framework, which names neither provision?
What this law does
The Nigerian Payments System Risk and Information Security Management Framework applies to payment systems based or operated in Nigeria, along with their infrastructure providers and the payment service providers that make up those systems. Section 8.6(i) of the Framework requires system operators, participants and payment service providers to establish and implement information security policies in line with ISO 27001 standards or subsequent standards.
Section 8.6(i) of the Framework also requires them to ensure the confidentiality, integrity and availability of all information, systems and networks that are critical to the success of the scheme. Section 8.6(iii) of the Framework requires participants and payment service providers to conduct an annual information security assessment including penetration and vulnerability tests.
Section 9.1(vii) of the Framework requires every card-not-present transaction on a Nigerian issued card from a Nigerian acquired merchant to use a minimum of 2 factor authentication, except a card on file transaction whose initial transaction used 2 factor authentication. Section 13 of the Framework provides that the Central Bank of Nigeria shall monitor and enforce compliance with it.
The Central Bank of Nigeria lists the Framework in its Payments System Guidelines under the reference PSM/PSI/GEN/CWD/01/028 as published on . Section 33(1)(b) of the Central Bank of Nigeria (Establishment) Act, 2007 empowers the Bank to issue guidelines to any person and any institution under its supervision. Section 33(5)(a) of that Act makes an institution that fails to comply with such a guideline liable on conviction to a fine not exceeding N10,000,000.
When LexLint raises it
When your app profile says your app is a bank or is a payment provider.