NigeriaCBN Regulatory Framework for USSD Financial Services, Security and Authentication Controls
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2023. Publisher's page: https://www.cbn.gov.ng/Out/2018/BPSD/USSD%20Regulatory%20Framework.pdfIn force.
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds a bank, other financial institution or payment service provider that provides financial services through the USSD channel, and a mobile money operator licensed by the Central Bank of Nigeria (reached by declaring that you provide financial services); the Framework also names mobile network operators and value added service providers licensed by the Nigerian Communications Commission as participants.
- Put in place a message authentication mechanism that validates that requests and responses are generated through authenticated users, using a minimum combination of any of the IMSI, the date of SIM swaps, the date of MSISDN recycle, the IMEI, the date of device change and similar data (section 6.1).
- Ensure that the customer receives notification on the status of every transaction conducted through the channel (section 6.2).
- Ensure encryption of USSD information within your environment by an auditable process, at least radio encryption between the user's SIM-enabled device and base stations, and secure transmission of USSD signals between the network operator and the USSD aggregators and between the aggregators and the bank (sections 6.4 to 6.6).
- Encrypt the data the USSD application stores at your institution (section 6.7).
- Mandate an effective second factor of authentication for every customer transaction above N20,000, in addition to the PIN used for all transaction amounts, and do not send the second factor to the customer's registered GSM number or device or generate or display it on the USSD menu (sections 6.10 and 6.11).
- Install a behavioural monitoring system with capability to detect SIM-swap or churn status, user location and unusual transactions at weekends (section 6.12).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Central Bank of Nigeria or the Nigerian Communications Commission, as applicable, which shall impose appropriate sanctions for any contravention by a participant that fails to comply with the Framework.
Settledness
- As of
- Open questions
- Does the Central Bank of Nigeria's circular extending the Framework change the dates of any of its requirements?
What this law does
The Central Bank of Nigeria issued the Regulatory Framework for the Use of Unstructured Supplementary Service Data for Financial Services in Nigeria in exercise of the powers conferred on it by section 47(2) of the CBN Act, 2007. The Framework lists banks, other financial institutions and payment service providers among the service providers that provide financial services through the use of USSD.
Section 6.1 of the Framework requires a financial institution providing use of the USSD channel to put in place a message authentication mechanism that validates that requests and responses are generated through authenticated users. Section 6.2 of the Framework requires the institution to ensure that the customer receives notification on the status of every transaction conducted through the channel.
Section 6.4 of the Framework requires the institution to ensure encryption of USSD information within its environment by an auditable process. Section 6.7 of the Framework requires the data stored by the USSD application at a financial institution to be encrypted. Section 6.7 of the Framework provides that customer information logged by the USSD application as part of financial transactions should not include sensitive information such as the customer PIN.
Section 6.10 of the Framework requires the institution to mandate the use of an effective second factor authentication by customers for all transactions above N20,000, in addition to the PIN. Section 6.11 of the Framework requires that the second factor not be sent to the customer's registered GSM number or device and not be generated or displayed on the USSD menu.
Section 6.12 of the Framework requires the institution to install a behavioural monitoring system with capability to detect SIM-swap or churn status, user location and unusual transactions at weekends. Section 10 of the Framework provides that the appropriate regulator, the CBN or the NCC as applicable, shall impose appropriate sanctions for any contravention on any participant that fails to comply with the Framework.
Section 47(3) of the Central Bank of Nigeria (Establishment) Act, 2007 gives the Bank power to prescribe rules and regulations for the efficient operation of all clearing and settlement systems.
When LexLint raises it
When your app profile says your app provides financial services.