NigeriaSecurities and Exchange Commission Rule on Robo-Advisory Services, governance, testing, audit and disclosure duties for firms that give automated investment advice
Rule on Robo-Advisory Services
In force.
An AI sector rules rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Licensing, Governance, DPIA, Disclosure, Reporting
- Audit expectation
- periodic
- Who audits it
- Independent third party
- Where the report goes
- Filed with regulator
As of .
What it requires
- It reaches you if you are a Capital Market Operator, or any person, individual or corporate, that offers or seeks to offer Digital (Robo) Advisory Services in the Nigerian capital market: investment advice that uses automated, algorithm-based tools which are client-facing, with little or no human adviser interaction in the advisory process (preamble and rule 1). Register under the Commission's Rule on Corporate and Individual Advisers, with all necessary modifications (rule 2). Where you also provide portfolio or fund management, apply to be registered as a Fund or Portfolio Manager (rule 3(v)).
- Put in place adequate governance and supervisory arrangements to effectively mitigate against fault or bias in the algorithms. The Board and Senior Management must oversee the client-facing tool, approve its design and methodology and the policies that apply to it, designate personnel to approve changes to the algorithms, keep security arrangements that identify and prevent unauthorized access to the algorithms, and maintain documentation on their design and development. They remain ultimately responsible even where day-to-day oversight is delegated (rule 6).
- Make the methodology of the algorithms sufficiently robust, collect and analyze all the information needed to make a suitable recommendation, resolve contradictory or inconsistent client responses, and use controls such as knock-out questions to eliminate clients who are unsuitable for investing (rule 7(a) to (c)). Before launch and when the tool changes, test the algorithms to detect any error or bias, including back-testing with hypothetical inputs to confirm that the risk profiles and the intended asset allocation follow your risk profiling methodology (rule 7(d)).
- Monitor and test the algorithms regularly, with strict change management controls, controls to detect any error or bias, and controls to suspend the provision of advice if an error or bias within the algorithms is detected, advance notice to clients of scheduled maintenance or upgrades, and compliance checks on the quality of advice, including post-transaction sample testing, reviewed by an independent and qualified human adviser regularly and when the algorithms change (rule 8).
- Undergo a post-authorization technology audit by an independent third party at the end of each operational year and file a report with the Commission within three months of the date of the close of the audit (rule 5(d)(iii)). Meet the Commission's Guidelines on Technology Risk Management, file a quarterly report to the Commission on your compliance, and perform a gap analysis against those Guidelines before launch and when the tools change (rule 9).
- Disclose in writing to your clients the assumptions, limitations and risks of the algorithms, the circumstances under which you may override the algorithms or temporarily halt the service, and any material adjustments to the algorithms (rule 12). Disclose in writing any actual or potential conflict of interest, and where the algorithms are designed to direct clients to products managed by your affiliates, say so (rule 13).
- Have a reasonable basis for recommending any investment product to a person who may reasonably be expected to rely on the recommendation, and take reasonable steps to collect and document the client's financial objectives, risk tolerance, employment status, financial situation, regular income, financial commitments, current portfolio and the other items rule 15(b) lists. A fully automated Robo Adviser may omit part of that collection only when every condition in rule 16(a) is met, and must still collect information on the client's financial objectives and risk tolerance (rules 15 and 16).
- Employ additional checks to mitigate the risk of impersonation when on-boarding clients through non-face-to-face means (rule 10(b)). Where you outsource the development and maintenance of client-facing tools to a third party provider, subject the provider to appropriate due diligence to assess the risks of the outsourcing arrangement (rule 3(iii)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Operating in the Nigerian capital market or carrying on investments and securities business without being registered is an offence under section 61(4) of the Investment and Securities Act, 2025, punishable on conviction by a fine of not less than N5,000,000 or imprisonment for a term of not less than five years or both.
Who enforces it
Enforcement body
The Securities and Exchange Commission, which may suspend or revoke a certificate of registration for a violation of the Investment and Securities Act, 2025 or regulations made under it
What this law does
The Securities and Exchange Commission's Rule on Robo-Advisory Services applies to all Capital Market Operators and persons, individual and corporate, offering or seeking to offer Digital (Robo) Advisory Services in the Nigerian Capital Market.
The Securities and Exchange Commission's Rule on Robo-Advisory Services defines Digital Advisory Services as the provision of investment advice using automated, algorithm-based tools which are client-facing, with little or no human adviser interaction in the advisory process. The Securities and Exchange Commission's rules index records the Rule on Robo-Advisory Services as released on .
The provisions of the Securities and Exchange Commission's Rule on Corporate and Individual Advisers apply to the registration of a Robo Adviser with all necessary modifications. A Robo Adviser must put in place adequate governance and supervisory arrangements to effectively mitigate against fault or bias in the algorithms. The Board and Senior Management of a Robo Adviser remain ultimately responsible and accountable for the proper development, monitoring and testing of the client-facing tools.
A Robo Adviser must perform sufficient testing, prior to the launch of the tool and when changes are made to the tool, to detect any error or bias in the algorithms. A Robo Adviser's testing of its algorithms includes back-testing using hypothetical inputs to ensure that the risk profiles generated by the algorithms are in line with the Robo Adviser's risk profiling methodology.
A Robo Adviser must have controls to detect any error or bias in the algorithms and controls to suspend the provision of advice if an error or bias within the algorithms is detected. A Robo Adviser must run compliance checks on the quality of advice regularly and when there are changes to the algorithms, including post-transaction sample testing reviewed by an independent and qualified human adviser.
A Robo Adviser must undergo a post-authorization technology audit conducted by an independent third party at the end of each operational year and file a report with the Commission within three months of the date of the close of the audit. A Robo Adviser must meet the requirements of the Commission's Guidelines on Technology Risk Management and file a quarterly report to the Commission on its compliance.
A Robo Adviser must perform a gap analysis against the requirements of those Guidelines to ensure that all gaps are adequately mitigated prior to the launch of the client-facing tools and also when changes are made to them. A Robo Adviser must disclose in writing to its clients the assumptions, limitations and risks of the algorithms, the circumstances under which it may override the algorithms or temporarily halt the robo advisory service, and any material adjustments to the algorithms.
A Robo Adviser must have a reasonable basis for recommending any investment product to a person who may reasonably be expected to rely on the recommendation. A Robo Adviser must employ additional checks to mitigate the risk of impersonation when on-boarding clients through a non-face-to-face means.
A Robo Adviser that outsources development and maintenance of its client-facing tools to a third party provider must subject that provider to appropriate due diligence processes to assess the risks associated with the outsourcing arrangement. The Investment and Securities Act, 2025 provides that the Commission shall make rules and regulations for the purpose of giving effect to the provisions of the Act.
The Investment and Securities Act, 2025 also provides that rules or regulations made under the Act may where appropriate prescribe penalties for default. An order, requirement, notice, circular, direction, decision or other thing made, issued, given or done under the repealed Investments and Securities Act, 2007 continues in effect, if in effect at the commencement of the 2025 Act, as if made under the corresponding provisions of the 2025 Act.
Under section 61(6) of the Investment and Securities Act, 2025 the Securities and Exchange Commission may suspend or revoke a certificate of registration for a violation of any provision of the Act or regulations made under it, provided that the person concerned has been given a reasonable opportunity of being heard.
Section 61(1) of the Investment and Securities Act, 2025 bars a person from operating in the Nigerian capital market or carrying on investments and securities business unless the person is registered in accordance with the Act and the rules and regulations made under it. A person who violates that registration requirement commits an offence and is liable on conviction to a fine of not less than N5,000,000 or imprisonment for a term of not less than five years or both.
When LexLint raises it
When your app profile says your app is a securities firm.