Nigeria

The Central Bank of Nigeria (Customer Due Diligence) Regulations, 2023 apply to all financial institutions under the regulatory purview of the Central Bank of Nigeria. A financial institution must conduct regular monitoring of internet-based business or customers.

Where a significant proportion of a financial institution's business is operated electronically, computerized monitoring systems or solutions designed to recognize unusual transactions and related patterns of transactions must be put in place to recognize suspicious transactions. The administrative sanctions and penalties for non-compliance with the Regulations are those specified in the Banks and Other Financial Institutions Act, 2020 and in the Schedule to the Regulations.

The Regulations were made at Abuja on May 31, 2023. Under section 2(2)(b) of the Interpretation Act, an enactment for which no other provision is made as to its commencement comes into force, in any case other than an Act of the National Assembly, on the day when the enactment is made. The Interpretation Act defines an enactment to include a provision of a subsidiary instrument, and a subsidiary instrument to include regulations made in exercise of powers conferred by an Act.

A financial institution and a designated non-financial business and profession must identify a customer, whether permanent or occasional, natural or legal person or any other form of legal arrangement, using identification documents prescribed in any relevant regulation, and verify the identity of that customer using reliable, independent source documents, data or information.

A financial institution and a designated non-financial business and profession must also identify the beneficial owner, and take reasonable measures to verify that any person purporting to act on behalf of the customer is so authorised, identified and verified.

Customer due diligence measures are also required when carrying out occasional transactions above the applicable designated threshold prescribed by relevant regulations, including transactions carried out in a single operation or in several operations that appear to be linked, when carrying out occasional wire transfers, when there is a suspicion of money laundering or terrorist financing regardless of any exemptions or thresholds, and when the institution has doubts about the veracity or adequacy of previously obtained customer identification data.

A financial institution and a designated non-financial business and profession must scrutinise transactions undertaken during the course of the relationship to ensure that the transactions are consistent with the institution's knowledge of the customer, the customer's business and risk profile and, where necessary, the source of funds, and keep customer due diligence documents, data and information up to date and relevant.

Where higher risks are identified a financial institution and a designated non-financial business and profession must apply enhanced measures, and simplified customer due diligence measures are not permitted whenever there is suspicion of money laundering or terrorist financing.

A financial institution and a designated non-financial business and profession must put in place appropriate risk management systems and procedures to determine whether a customer or the beneficial owner of a customer is a politically exposed person.

A financial institution and a designated non-financial business and profession must preserve records on transactions, both domestic and international, for at least five years following completion of the transaction, and all records obtained under section 4, including account files, business correspondence and the results of any analysis, for at least five years following the termination of the business relationship or after the date of the occasional transaction.

Records preserved under section 8 must be sufficient to permit individual transactions to be readily reconstructed at any time by the competent authorities and be made swiftly available to the competent authorities.

Financial institutions and designated non-financial businesses and professions must identify and assess the money laundering and terrorism financing risks that may arise in relation to new products, new business practices, new delivery mechanisms and the use of new or developing technologies for both new and pre-existing products.

Financial institutions and designated non-financial businesses and professions must undertake the section 13 risk assessments prior to the launch or use of the products, business practices and technologies, and take appropriate measures to manage and mitigate the risks. A director or an employee of a financial institution or designated non-financial business and profession who contravenes sections 3, 4, 5, 6, 7, 8, 10, 11, 13, 14 or 15 of the Act commits an offence under section 19.

An offence under section 19(1)(f) of the Act is punishable on conviction by a fine of N10,000,000 or imprisonment for a term of at least three years or both in the case of an individual, and by a fine of N25,000,000 in the case of a body corporate.

A financial institution must report to the Nigerian Financial Intelligence Unit, and a designated non-financial business and profession to the Special Control Unit Against Money Laundering, in writing within seven days, any single transaction, lodgment or transfer of funds in excess of N5,000,000 or its equivalent in the case of an individual, or N10,000,000 or its equivalent in the case of a body corporate.

A person other than a financial institution may voluntarily give information on any transaction, lodgement or transfer of funds in excess of N1,000,000 or its equivalent in the case of an individual, or N5,000,000 or its equivalent in the case of a body corporate.

A financial institution or designated non-financial business and profession that contravenes section 11 commits an offence and is liable on conviction to a fine of at least N250,000 and not more than N1,000,000 for each day the contravention continues.

A person may not conduct two or more transactions separately with one or more financial institutions or designated non-financial businesses and professions with intent to avoid the duty to report a transaction which should be reported under the Act.

Section 7 of the Money Laundering (Prevention and Prohibition) Act, 2022 deems a transaction suspicious where it involves an unjustifiable or unreasonable frequency, is surrounded by unusual or unjustified complexity, appears to have no economic justification or lawful objective, is inconsistent with the known transaction pattern of the account or business relationship, or in the institution's opinion involves the proceeds of a criminal activity, an unlawful act, money laundering or terrorist financing.

A financial institution or designated non-financial business and profession involved in a suspicious transaction must report to the Nigerian Financial Intelligence Unit immediately.

Within 24 hours after the transaction, a financial institution or designated non-financial business and profession involved in a suspicious transaction must draw up a written report with all relevant information, the reasons and the identity of the principal and any beneficiary, take appropriate action to prevent the laundering of the proceeds of a crime or an illegal act, and report the transaction and the actions taken to the Unit.

Under section 7 of the Money Laundering (Prevention and Prohibition) Act, 2022 the duty to report a suspicious transaction applies whether the transaction is complete or not. The Nigerian Financial Intelligence Unit acknowledges receipt of each report made under section 7, and the acknowledgement may be accompanied by a notice deferring the transaction for a period not exceeding 72 hours.

Where the Unit's acknowledgement of a report made under section 7 carries no stop notice, or the stop notice has expired and no court order to block the transaction has reached the financial institution or designated non-financial business and profession, it may carry out the transaction.

A financial institution or designated non-financial business and profession that fails to comply with the reporting duty commits an offence and is liable on conviction to a fine of N1,000,000 for each day during which the offence continues. A director or employee of a financial institution who warns the owner of the funds involved in the transaction about the report, or the action taken on it, or who refrains from making the report as required, commits an offence under section 19 of the Act.

A person who commits the offence of warning the owner of the funds about a suspicious transaction report is liable on conviction to a fine of at least N10,000,000 or imprisonment for a term of at least two years.

The Act defines a financial institution to include banks, body corporates, associations or groups of persons carrying on the business of investment and securities, virtual asset service providers, discount houses, insurance institutions, bureaux de change, finance companies, fund management, investment management and pension funds management businesses, and such other businesses as the Central Bank or other appropriate regulatory authorities may designate.

The National Insurance Commission issued the Guidelines for Insurtech Operations in Nigeria in exercise of the powers conferred by the National Insurance Commission Act 1997 and the Insurance Act 2003, to establish a uniform set of rules, regulations and standards for the conduct of insurtech business in Nigeria. No person may commence or carry on any class of insurtech business without being registered or authorized by the Commission.

The Guidelines for Insurtech Operations in Nigeria are effective from August 1, 2025, and all insurance institutions and insurtech firms operating under any agreement must comply within thirty days of that date. An insurtech must have and implement a secure technology framework with proper access controls. A minimum two-factor authentication process is required for all users to have access to the services provided by an insurtech.

An insurtech must introduce logical access controls in the technology infrastructure deployed, and test them using periodic penetration testing. An insurtech must deploy an independent technology firm to audit its Lead Management System, domain and entire operations at least once a year, and submit the audit report to the Commission not later than three months from December 31 of every year.

An insurtech must maintain an effective Lead Management System and ensure that leads are recorded and monitored through it where required. Unsupervised automated claims rejections are a non-permissible activity for an insurtech, described as complete reliance on Artificial Intelligence systems to decline claims without human intervention.

Launching products or using dynamic pricing without actuarial support or prior approval from the National Insurance Commission is a non-permissible activity for an insurtech. Interface design tactics that mislead users into purchasing or renewing an insurance policy, described as dark patterns, are a non-permissible activity for an insurtech. An insurtech must not display ratings, rankings, endorsements or bestsellers of insurance products on its website.

An insurtech must obtain prior approval from the Commission before placing any advertisement on its website or other channels. Where an insurtech distributes or markets insurance products, it must disclose prominently on the home page that the visitor's particulars could be shared with insurers or other insurance operators, and provide an option for consent to disseminate user information to selected insurance operators.

An insurtech that distributes or markets insurance products must transmit the data of a client's KYC to the insurance institution immediately, but not later than three days of the visit to the website. The National Insurance Commission may cancel the licence granted to an insurtech or take any other action as deemed appropriate on the observation of any infraction or non-compliance with the Guidelines.

The National Insurance Commission shall impose administrative sanctions on an insurtech for identified inappropriate actions or inactions or corporate misconduct. Without prejudice to criminal proceedings against a person who acts as an insurtech without holding a valid licence, the National Insurance Commission may compound the offence by accepting such sums of money as it deems fit.

The text of the Nigerian Insurance Industry Reform Act, 2025 published by the National Insurance Commission provides that a person shall not commence or carry on web, internet or electronic based insurance or related business unless licensed by the Commission, and that the Commission shall issue regulations for such business in Nigeria.

The text of the Nigerian Insurance Industry Reform Act, 2025 published by the National Insurance Commission defines Regulations to mean regulations, guidelines and code of conduct.

The Securities and Exchange Commission's Rule on Robo-Advisory Services applies to all Capital Market Operators and persons, individual and corporate, offering or seeking to offer Digital (Robo) Advisory Services in the Nigerian Capital Market.

The Securities and Exchange Commission's Rule on Robo-Advisory Services defines Digital Advisory Services as the provision of investment advice using automated, algorithm-based tools which are client-facing, with little or no human adviser interaction in the advisory process. The Securities and Exchange Commission's rules index records the Rule on Robo-Advisory Services as released on August 30, 2021.

The provisions of the Securities and Exchange Commission's Rule on Corporate and Individual Advisers apply to the registration of a Robo Adviser with all necessary modifications. A Robo Adviser must put in place adequate governance and supervisory arrangements to effectively mitigate against fault or bias in the algorithms. The Board and Senior Management of a Robo Adviser remain ultimately responsible and accountable for the proper development, monitoring and testing of the client-facing tools.

A Robo Adviser must perform sufficient testing, prior to the launch of the tool and when changes are made to the tool, to detect any error or bias in the algorithms. A Robo Adviser's testing of its algorithms includes back-testing using hypothetical inputs to ensure that the risk profiles generated by the algorithms are in line with the Robo Adviser's risk profiling methodology.

A Robo Adviser must have controls to detect any error or bias in the algorithms and controls to suspend the provision of advice if an error or bias within the algorithms is detected. A Robo Adviser must run compliance checks on the quality of advice regularly and when there are changes to the algorithms, including post-transaction sample testing reviewed by an independent and qualified human adviser.

A Robo Adviser must undergo a post-authorization technology audit conducted by an independent third party at the end of each operational year and file a report with the Commission within three months of the date of the close of the audit. A Robo Adviser must meet the requirements of the Commission's Guidelines on Technology Risk Management and file a quarterly report to the Commission on its compliance.

A Robo Adviser must perform a gap analysis against the requirements of those Guidelines to ensure that all gaps are adequately mitigated prior to the launch of the client-facing tools and also when changes are made to them. A Robo Adviser must disclose in writing to its clients the assumptions, limitations and risks of the algorithms, the circumstances under which it may override the algorithms or temporarily halt the robo advisory service, and any material adjustments to the algorithms.

A Robo Adviser must have a reasonable basis for recommending any investment product to a person who may reasonably be expected to rely on the recommendation. A Robo Adviser must employ additional checks to mitigate the risk of impersonation when on-boarding clients through a non-face-to-face means.

A Robo Adviser that outsources development and maintenance of its client-facing tools to a third party provider must subject that provider to appropriate due diligence processes to assess the risks associated with the outsourcing arrangement. The Investment and Securities Act, 2025 provides that the Commission shall make rules and regulations for the purpose of giving effect to the provisions of the Act.

The Investment and Securities Act, 2025 also provides that rules or regulations made under the Act may where appropriate prescribe penalties for default. An order, requirement, notice, circular, direction, decision or other thing made, issued, given or done under the repealed Investments and Securities Act, 2007 continues in effect, if in effect at the commencement of the 2025 Act, as if made under the corresponding provisions of the 2025 Act.

Under section 61(6) of the Investment and Securities Act, 2025 the Securities and Exchange Commission may suspend or revoke a certificate of registration for a violation of any provision of the Act or regulations made under it, provided that the person concerned has been given a reasonable opportunity of being heard.

Section 61(1) of the Investment and Securities Act, 2025 bars a person from operating in the Nigerian capital market or carrying on investments and securities business unless the person is registered in accordance with the Act and the rules and regulations made under it. A person who violates that registration requirement commits an offence and is liable on conviction to a fine of not less than N5,000,000 or imprisonment for a term of not less than five years or both.

All financial institutions and designated non-financial institutions must develop and implement programmes and strategies for combating the financing of terrorism, and keep a record of any complex, unusual large and unusual pattern of transaction which has no apparent economic or visible lawful source or purpose.

A report detailing all the parties involved in a complex, unusual large or unusual pattern of transaction that has no apparent economic or visible lawful source or purpose must be kept and made available on request by the relevant agency.

A financial institution or designated non-financial institution must, within 24 hours, forward reports of suspicious transactions relating to terrorism, terrorism financing or proliferation financing to the Nigerian Financial Intelligence Unit, where there are sufficient reasons to suspect that the funds are intended to be used for an act of terrorism or terrorism financing, or proliferation financing, are proceeds of a related crime, or belong to a person, entity or organisation considered as terrorist.

A breach of the duty in section 84 of the Terrorism (Prevention and Prohibition) Act, 2022 to forward reports of suspicious transactions is an offence under the Act. A director, chief compliance officer or other employee in breach of section 84 is liable on conviction to imprisonment for a term of not more than five years, a fine of at least N5,000,000, or both fine and imprisonment.

A financial institution or non-financial institution in breach of section 84 is liable on conviction to a fine of at least N10,000,000 and N1,000,000 for every day the offence persists, the withdrawal of licence or forfeiture of assets of the institution, or all the prescribed penalties.

Where a breach of section 84(1) is shown not to have been intentional and adequate measures were in place to prevent it, the Nigerian Financial Intelligence Unit, in consultation with the regulator or the self-regulatory organisation responsible for the institution, imposes such administrative sanctions as it may consider necessary.

Upon the publication of the UN Consolidated List and the Nigeria Sanctions List, all natural and legal persons in Nigeria, including financial institutions, designated non-financial business and professions and other entities, must immediately identify and freeze, without prior notice, all funds, assets and any other economic resources belonging to the designated person or entity in their possession, and report the freeze to the Sanctions Committee.

In section 54 of the Terrorism (Prevention and Prohibition) Act, 2022 "immediately" means not later than 24 hours.

Financial institutions, designated non-financial businesses and professions and other entities in Nigeria must also immediately file a Suspicious Transactions Report with the Nigerian Financial Intelligence Unit on the financial activities of the designated individual or entity, and report to the Unit as a Suspicious Transactions Report all cases of name matching in financial transactions prior to or after receipt of the Nigeria Sanctions List.

The freezing obligation in section 54 of the Terrorism (Prevention and Prohibition) Act, 2022 extends to all funds or other assets owned or controlled by the designated person or entity, and not just those that can be tied to a particular act, plot or threat of terrorism or terrorism financing.

All financial institutions, designated non-financial businesses and professions and other entities are responsible for monitoring their accounts and transactions against the UN Consolidated List and the Nigeria Sanctions List. Sector regulators must impose administrative sanctions against a financial institution, designated non-financial business and profession or other entity in breach of the immediate freezing obligation and the rules against tipping off.

Upon publication of the UN Consolidated List of persons and entities designated under the United Nations Security Council resolutions that relate to the prevention and disruption of the financing of proliferation of weapons of mass destruction, all natural and legal persons in Nigeria, including financial institutions, designated non-financial businesses and professions and other entities, must immediately identify and freeze all funds, assets and any other economic resources belonging to a designated person or entity in their possession and report the freeze to the Nigeria Sanctions Committee.

Where a person or entity is designated in relation to proliferation financing, a financial institution, designated non-financial business and profession or other entity must also immediately file a Suspicious Transactions Report with the Unit and report as a Suspicious Transactions Report all cases of name matching in financial transactions prior to or after receipt of the list.

Financial institutions, designated non-financial businesses and professions and other entities must monitor their accounts and transactions against the UN Consolidated List of persons designated in relation to proliferation financing.

Section 3.4(a) of the Internet Code of Practice 2026 requires an Internet Access Service Provider to notify affected customers of any breach relating to the customer's information within 48 hours of becoming aware of the breach. Where full details are not immediately available, the provider issues a preliminary notification within the same 48 hours and a comprehensive update within 14 days after, or within a longer period the Commission approves.

The customer notification is made through email and text message, or by another effective means the Commission approves. Section 3.4(b) requires the provider to notify the Commission in writing of any breach no later than 48 hours after it reasonably determines that a breach has occurred. The Code defines a data breach as an incident in which sensitive or confidential data is viewed, stolen or used by an unauthorized party.

The Code applies to Internet Access Service Providers, which it defines as any entity licensed by the Nigerian Communications Commission that is engaged in the provision of an Internet Access Service. The Nigerian Communications Commission issued the Code as a Guidelines under section 70 of the Nigerian Communications Act 2003. The Commission published the Code as an amended edition of the Internet Code of Practice it first published in 2019. The Code's date line is February 13, 2026.

The Code states no commencement day of its own, and under section 2(2)(b) of the Interpretation Act an enactment with no provision on its commencement that is not contained in an Act of the National Assembly comes into force on the day it is made, so this row takes the Code's date line as its start. The Commission's Guidance Notes on the Code set a 90-day regulatory gestation period, running from the date of publication of the Code, before compliance monitoring and enforcement begin.

Article 33(1) quotes section 40(2) of the Act: a data controller shall, within 72 hours of becoming aware of a breach which is likely to result in a risk to the rights and freedoms of individuals, notify the Commission of the breach and, where feasible, describe its nature including the categories and approximate numbers of data subjects and personal data records concerned.

Article 33(2) fixes when a breach is likely to result in a high risk: where, considering its nature, the personal data involved and the probability of reaching the data subject's other personal data through it, the data subject may become a victim of fraud, identity theft or exposure of sensitive personal data. Article 33(3) requires the controller to notify affected data subjects immediately after becoming aware of the breach, so that they are not unlawfully targeted as a result of it.

Article 33(4) requires immediate information to the Commission and every other relevant authority, whatever the time otherwise allowed, where that may help contain an imminent breach on a national scale or where containment may be needed nationally, sectorally or individually, or where the breach may affect the general public.

Article 33(5) fixes the content of the notification: the circumstances of the loss or unauthorised access or disclosure, the date or time period it occurred over, a description of the personal information involved, an assessment of the risk of harm, an estimate of the number of individuals at real risk of significant harm, the steps taken to reduce that harm, the steps taken to notify individuals, and the name and contact details of a person who can answer for the organisation.

The General Application and Implementation Directive 2025, which carries the text quoted here, is made under section 37 of the 1999 Constitution and sections 1(a), 6(c), 61 and 62 of the Nigeria Data Protection Act 2023, an Act in force since 12 June 2023.

Article 7 of the Directive lists the general compliance measures the Act expects of every data controller and data processor: registering with the Commission as one of major importance where the Commission so determines, conducting a compliance audit within fifteen months of commencing business and annually thereafter, filing Compliance Audit Returns by 31 March each year in the Ultra-High and Extra-High Level categories, identifying every obligation under the Act and scheduling compliance with it, keeping semi-annual data protection reports, and following schedules for monitoring, evaluating and maintaining the data security system and for internal sensitisation and training.

Article 9 governs registration as a data controller or data processor of major importance, requires the Ultra-High and Extra-High Level categories to register once and file Returns annually, requires the Ordinary-High Level category to renew registration annually instead, and requires notice to the Commission of any significant change to registered information within sixty days.

Articles 11 to 14 govern the designation, position, semi-annual reporting and credential assessment of the Data Protection Officer that section 32 of the Act mandates. Articles 15 to 17 and 20 to 26 carry the principles of section 24 and the lawful bases of section 25, and article 19 governs consent to cookies and other tracking tools.

Article 28 carries the Data Privacy Impact Assessment that section 28 of the Act mandates where processing may result in high risk, article 29 the monitoring, evaluation and maintenance of the data security system that section 39 requires, article 31 the duties that attach to deploying data processing software, and article 34 the Data Processing Agreement that section 29(2) requires between a controller and its processor.

The General Application and Implementation Directive 2025, which carries the text quoted here, is made under section 37 of the 1999 Constitution and sections 1(a), 6(c), 61 and 62 of the Nigeria Data Protection Act 2023, an Act in force since 12 June 2023.

The National Information Technology Development Agency issued the Guidelines under section 6 of the NITDA Act of 2007, in consultation with the Nigerian Communications Commission. The Guidelines come into effect on the date of signature. Telecommunication companies must host all subscriber and consumer data within the country in line with existing legislation. Networking service companies must host all subscriber and consumer data within the country.

NITDA and the Nigerian Communications Commission enforce the Guidelines under the powers vested in them by their respective enabling laws. Any breach of the Guidelines is construed as a breach of the provisions of the NITDA Act of 2007 and other relevant laws or Federal Government directives in force in Nigeria.

Article 45 states that Part VIII of the Act provides for cross-border data transfer and, by section 63, is the overarching governing provision for every transfer of personal data out of Nigeria; pending any further regulatory instrument, the explanatory note in Schedule 5 is used to evaluate countries for adequacy and for the other grounds the Act recognises, and the Commission is to weigh the enforcement of fundamental rights and the decisions of courts advancing fundamental freedoms in a jurisdiction it considers.

Schedule 5 lists the grounds for transfer as an adequacy decision by the Commission, a Cross-Border Data Transfer Instrument the Commission approves, and other lawful bases, and sets out what the Commission weighs in adjudging a country adequate under section 42(2) of the Act: enforceable data subject rights with administrative or judicial redress and the rule of law, any instrument between the Commission and a competent authority in the recipient jurisdiction, the terms on which a public authority there reaches personal data, the existence of an effective data protection law that is in force and not subject to an overriding law, and a functioning independent supervisory authority with adequate enforcement powers.

The instruments the Commission may approve in the absence of an adequacy decision are codes of conduct, certifications, binding corporate rules and standard contractual clauses. Consent is separately required before personal data may be transferred to a country for which the Commission has made no adequacy decision.

The General Application and Implementation Directive 2025, which carries the text quoted here, is made under section 37 of the 1999 Constitution and sections 1(a), 6(c), 61 and 62 of the Nigeria Data Protection Act 2023, an Act in force since 12 June 2023.

Article 43 of the GAID requires a data controller or processor that deploys or intends to deploy Emerging Technologies, such as artificial intelligence, the Internet of Things or blockchain, to take the provisions of the Act into account when setting the technical and organisational parameters for that processing.

Those parameters must take into account a data subject's right not to be subject to a decision solely based on automated processes or algorithms, alongside the right to be forgotten, safeguards for sensitive and child data, cross-border transfer rules, and privacy by design. The parameters must be documented and filed with the Commission.

Article 27 requires the information given to a data subject under section 27 of the Act to be clear and to take the data subject's circumstances into account.

Article 36 makes the right to rectification part of the accuracy principle, requires the platform through which personal data is processed to give an effective opportunity to rectify, bars requiring an affidavit or a newspaper publication where the correction aligns the data with the data subject's National Identification Number, and bars charging a data subject to correct an error that was not their fault.

Article 37 gives a right to data portability where the data subject supplied the personal data on the basis of consent or where the processing is necessary to perform a contract, without prejudice to the rights of other data subjects in the same set or to the right of erasure.

Article 38 gives a right to be forgotten where the data is no longer necessary for the purpose it was collected for, where consent is withdrawn and was the lawful basis, where the data subject objects to processing founded on legitimate interest and no overriding ground exists, where the processing is for direct marketing and the data subject objects, where the processing was unlawful, or where erasure is needed to comply with a legal ruling or obligation.

Article 39 makes the right to lodge a complaint with the Commission a threshold right of redress under section 37 of the 1999 Constitution and section 46 of the Act, and requires every instrument about processing personal data to carry a clause on it. Article 40 provides the Standard Notice to Address Grievance in Schedule 9, which an aggrieved data subject may serve directly on a controller or processor without it being a condition of complaining to the Commission.

The General Application and Implementation Directive 2025, which carries the text quoted here, is made under section 37 of the 1999 Constitution and sections 1(a), 6(c), 61 and 62 of the Nigeria Data Protection Act 2023, an Act in force since 12 June 2023.

Article 39 makes the right to lodge a complaint with the Nigeria Data Protection Commission a threshold right of redress under section 37 of the 1999 Constitution and section 46 of the Act, requires the Commission to run an electronic platform for complaints and to acknowledge one within seven days while continuing to accept complaints by any reasonable means, and requires it to carry out a preliminary evaluation of each complaint; a Pre-Action Conference may be held as often as a complaint or an investigation under section 46(3) needs.

Article 47 confirms that a data subject may seek redress for a violation of their data privacy rights in court, and treats proximity and access to courts as part of what national adequacy means.

Article 48 governs how the Commission weighs evidence of compliance: registration, annual Compliance Audit Returns, a filed impact assessment and an approved cross-border transfer instrument show accountability and prima facie good faith, but do not replace concrete evidence in defence of a complaint about any other provision, and the Commission treats accountability as partial fulfilment of the cooperation section 48(6)(f) of the Act requires.

Article 49 makes the safeguarding of a data subject's constitutional privacy right the overriding consideration in judging whether an obligation was met in time. The General Application and Implementation Directive 2025, which carries the text quoted here, is made under section 37 of the 1999 Constitution and sections 1(a), 6(c), 61 and 62 of the Nigeria Data Protection Act 2023, an Act in force since 12 June 2023.

Regulation 1 states that the Regulations make provision for the granting of access to information of a registered individual in the National Identity Database to security agencies, public agencies and licensed private agencies.

Regulation 4(1) lets the Commission provide registered information to a person other than the designated security, Government and licensed private agencies where the registered individual, or someone with that individual's authority, applied for it, or the registered individual consents by submitting the National Identification Number or biometrics to the Commission. Regulation 4(2) puts fingerprint and other biometric information outside the purview of such an application.

Regulation 6(2) makes disclosure to a Government agency subject to a prior written request to the Commission from an official not below the rank of a Permanent Secretary or Director-General, and to the procedures, processes and guidelines the Commission prescribes. Regulation 7(1) lets the Commission, with the consent of a registered individual, grant licensed private sector agencies access for the purpose of verification and authentication of the identity of that individual.

Regulation 7(2) makes that disclosure subject to the payment of applicable fees and the grant of a licence to the agency by the Commission. Regulation 8(2) requires the devices used in obtaining information from the Commission to conform to the specifications and standards listed in the guidelines the Commission issues. Regulation 9(2)(d) makes the unauthorized use or disclosure of registered information obtained by the grant of access to the National Identity Database a contravention.

Regulation 9(2)(h) makes unauthorized access of data or information contained in the National Identity Database a contravention.

The Central Bank of Nigeria issued the revised Regulatory Framework for Bank Verification Number (BVN) Operations and Watch-list for the Nigerian Banking Industry in exercise of the powers conferred on it by the Central Bank of Nigeria Act, 2007 and the Banks and Other Financial Institutions Act 2020. The Central Bank's own BVN page states that it issued the revised Framework on October 12, 2021.

Banks and Other Financial Institutions must ensure that all operated accounts and wallets, except Tier 1, are linked with the signatories' BVNs within 24 hours of NIBSS making the BVN available. Banks and Other Financial Institutions must report the BVNs of individuals in breach to NIBSS for update on the Watch-list within 1 business day of breach.

Clause 1.9 restricts the use of the BVN to purposes specified by the Central Bank and treats use of the BVN to sanction individuals for non-financial offences, and use of it for identification outside the banking system, as abuse. Clause 1.7 requires the consent of customers for access to the BVN database by Other Financial Institutions, excluding payment service providers, and by payment service providers through NIBSS.

Clause 1.11 requires BVN data to be stored within the shores of Nigeria and not routed across borders without the consent of the Central Bank. Clause 3.1 provides that a participant who fails to perform its stipulated responsibilities is penalised by the Central Bank of Nigeria.

Table 3 penalises operating an account or wallet, except Tier 1, without a BVN at N2,000,000 per infraction per customer, 15% of the total amount credited into the account during the period the infraction exists, and N20,000 per infraction per customer per day after the infraction exists. The Central Bank's BVN page states that a December 2023 circular requires all individual Tier 2 and Tier 3 accounts and wallets to have a BVN and a NIN, while Tier 1 accounts and wallets shall have either.

Regulation 1(1) is made under section 27(1)(l) of the National Identity Management Commission Act, 2007 and makes the use of the National Identification Number mandatory for a list of additional transactions. The list includes operating a bank account, cashing in on financial instruments, and the purchase and sale of foreign currency in banks and bureau de change. The list also includes the purchase and registration of telephone SIM cards and other communication devices.

The list also includes executing any contract or business agreement, tenancy agreements and all transactions involving the acquisition, use or transfer of land. Regulation 1(2) makes it mandatory for a government agency listed in the First Schedule that offers a listed service to require any person transacting with it to produce a National Identification Number and to verify the person or number in the National Identity Database.

Regulation 7 makes a failure to comply with the Regulations punishable by administrative fines and sanctions imposed by the National Identity Management Commission, in addition to the penalties provided under the Act.

Article 18(1) makes consent a requirement, on top of anything else the Act demands, for any direct marketing activity, for processing sensitive personal data, for further processing incompatible with the original purpose, for processing the personal data of a child, before personal data may be transferred to a country the Commission has made no adequacy decision for, and before a data controller makes a decision based solely on automated processing that produces legal effects concerning or significantly affecting the data subject; article 18(2) makes the Compliance Audit Returns state whether the controller or processor relies on consent for any of those activities.

Article 20(2) bars consent from being sought, given or accepted in any circumstance that may propagate atrocities, hate, child rights violations or criminal acts.

Article 43 binds a controller or processor deploying an emerging technology such as artificial intelligence, the Internet of Things or blockchain to set technical and organisational parameters for the processing that take account of the data subject's right not to be subject to a solely automated decision, the right to be forgotten, safeguards for processing sensitive personal data, safeguards for child rights and other vulnerable groups, the regulation of cross-border data flows, and privacy by design and by default; those parameters are documented and filed with the Commission as part of the Returns, and an impact assessment must weigh disparate outcomes and the Data Subjects' Vulnerability Indexes in Schedule 6.

Section 65 of the Act defines sensitive personal data to include genetic and biometric data processed for the purpose of uniquely identifying a natural person, so the consent requirement for sensitive personal data reaches such data. The General Application and Implementation Directive 2025, which carries the text quoted here, is made under section 37 of the 1999 Constitution and sections 1(a), 6(c), 61 and 62 of the Nigeria Data Protection Act 2023, an Act in force since 12 June 2023.

Section 6(1) makes it an offence for any person, without authorisation, to intentionally access in whole or in part a computer system or network for a fraudulent purpose and to obtain data vital to national security, punishable by imprisonment for not more than five years or a fine of not more than N5,000,000, or both.

Section 6(2) raises the penalty to imprisonment for not more than seven years or a fine of not more than N7,000,000, or both, where the access is committed with the intent of obtaining computer data, securing access to a program, or obtaining commercial, industrial, or classified information.

Section 6(1)'s own text conditions the offence on a fraudulent purpose and on the data obtained being vital to national security, so a plain reading of that subsection does not reach ordinary scraping of a public, unauthenticated page absent both elements; section 6(2)'s aggravated form reaches a wider set of intents but is only reached once subsection (1)'s unauthorised-access element is made out. No reported Nigerian decision has applied section 6 to a scraper.

Section 2(2)(a) of the Interpretation Act provides that, where no other provision is made as to the time when an enactment is to come into force, an enactment contained in an Act of the National Assembly comes into force on the day when the Act is passed. Under section 2(1) of the Interpretation Act, an Act is passed when the President assents to the Bill for the Act.

Section 68(1) of the Banks and Other Financial Institutions Act, 2020 lets the Central Bank of Nigeria make regulations and issue guidelines to banks, specialised banks and other financial institutions to address cybersecurity issues in the delivery of financial or banking services.

Section 68(2) of the Act requires all banks, specialised banks and other financial institutions to comply strictly with the cybersecurity regulations and guidelines the Central Bank of Nigeria makes or issues under section 68(1).

Section 68(3) of the Act makes an officer of a bank, specialised bank or other financial institution who through an action or omission fails to comply with section 68(2) liable to a penalty of not less than N2,000,000 and an additional penalty of N50,000 for each day during which the offence continues.

The Act defines an other financial institution to include a discount house, bureau de change, finance company, money brokerage, international money transfer service, financial holding company and payment service provider. The Act defines a payment service provider as an entity licensed by the Central Bank of Nigeria to provide payment service. The date line of the Act reads 12 November 2020.

Section 10.5 of the Guidelines requires technology implemented by a Principal for Agent banking to include a minimum of Two-Factor Authentication per customer, per transaction. Section 10.5 of the Guidelines requires that technology to transmit transaction information in a secure manner. Section 10.5 of the Guidelines requires that technology to reject suspicious transactions automatically.

Section 10.5 of the Guidelines requires that technology to prevent an Agent automatically from exceeding the daily limit allowed or performing unauthorized transactions.

Section 10.6 of the Guidelines requires a Principal to put in place systems that address, at the minimum, physical and logical security of infrastructure, availability of services, data confidentiality and integrity, encryption of PIN and electronic transactions, customer accountability and non-repudiation of transactions, and error messaging and exception handling.

Section 10.7 of the Guidelines requires a Principal to institute systems and personnel to monitor and control Agent banking operations on an ongoing basis. Section 10.7 of the Guidelines requires a Principal to maintain an incidence register and provide resolution timelines for reported incidents.

Section 11 of the Guidelines requires any device deployed to an Agent or used by an Agent in carrying on Agent banking services to be geo-fenced or tagged to operate within the agreed registered Agent premises or location. Section 9.4 of the Guidelines requires a Payments Terminal Service Aggregator to register each PoS terminal deployed for Agent banking on its platform and to facilitate geo-fencing or geo-location of the terminal.

Section 9.4 of the Guidelines requires a Payments Terminal Service Aggregator to integrate its Terminal Management System with the CBN Automated Regulatory Data Solutions. Section 9.3.2 of the Guidelines requires a Super Agent to implement appropriate technologies for monitoring online real time activities of Agents.

Item 13 of Appendix I to the Guidelines sets a fine of not less than N5,000,000 for the offence and N300,000 for each day that the default persists, for the failure of a Principal or Super Agent to implement the control parameters for its Agent banking operation, such as geo-locking the equipment. The Guidelines apply to all Financial Institutions licensed by the CBN and authorised to engage in Agent banking activities.

The Guidelines define a Principal as any of the following entities, commercial banks, non-interest banks, payment service banks, microfinance banks, mobile money operators, and any other category of financial institution that the CBN shall authorize to accept deposit and carry out Agent banking activities. The Guidelines supersede all other CBN guidelines on Agent banking and Agent banking relationships. The Central Bank of Nigeria issued the Guidelines in October 2025.

Section 14 of the Guidelines provides that the CBN may, in the event of a breach of any provision of the Guidelines, invoke any or all of the sanctions in that section against any defaulting participant in the Agent banking system.

The Central Bank of Nigeria issued the Guidelines on Operations of Electronic Payment Channels in Nigeria in exercise of the powers conferred on it by sections 2(d) and 47(2) of the CBN Act, 2007. The Guidelines supersede the Guidelines on Operations of Electronic Payment Channels in Nigeria (2016) issued by the CBN. The CBN's Payments System Guidelines page lists the Guidelines under the reference PSMD/31/05/2020 as published on May 31, 2020.

Section 1.1.1 of the Guidelines requires all ATM deployers and acquirers to comply with the Payment Card Industry Data Security Standards. Section 1.5 of the Guidelines requires every ATM to have cameras that view and record all persons using the machine and every activity at the ATM, without recording the key strokes of customers.

Section 1.5 of the Guidelines requires ATM key management processes to ensure that keys are changed regularly, every year, and that the same keys are not used at multiple ATMs. Section 1.5 of the Guidelines requires ATMs to be installed with anti-skimming devices. Section 1.5 of the Guidelines requires networks used for the transmission of ATM transactions to be demonstrated to have data confidentiality and integrity.

Section 1.3 of the Guidelines requires a bank or independent organization that deploys an ATM to ensure that acquirers monitor suspicious transactions and report them to the CBN, based on the agreed format and timeframe. Section 2.3 of the Guidelines requires all industry stakeholders who process or store cardholder information to ensure that their terminals, applications and processing systems comply with the minimum requirements of PA DSS, PCI PED, PCI DSS, Triple DES and EMV.

Section 2.3.4 of the Guidelines provides that the Triple DES algorithm is the minimum standard for all data transmitted and authenticated between each party. Section 2.4.1.5 of the Guidelines requires every Merchant Acquirer to connect all its PoS terminals or other acquiring devices directly to a Payments Terminal Service Aggregator.

Section 2.4.2.4 of the Guidelines provides that only the Payment Terminal Services Providers shall be allowed to deploy POS terminals, and that any other party that deploys POS terminals shall be fined 50,000 Naira for each day that the terminal remains deployed.

Section 2.4.1.9 of the Guidelines requires Merchant Acquirers, in conjunction with their Payment Terminal Services Providers, to ensure that merchants are trained and put in place reasonable processes and systems for confirming cardholder identity and detecting suspicious or unauthorized usage of electronic payment instruments where the customer and card are physically present.

Section 3.2.2 of the Guidelines requires acquirers to provide mPOS solutions that use PCI PIN Transaction Security in accordance with the PCI Point-to-Point Encryption Solution Requirements. Section 4.3 of the Guidelines requires web acquirers to use only the services of gateway providers that comply with PCI DSS, PA DSS, Triple DES and second factor authentication.

Section 4.5.1.13 of the Guidelines requires acquirers to implement a fraud management system that will detect customer usage pattern and decline or accept transactions based on rules defined on the system. Section 1.8 of the Guidelines provides that sanctions, in the form of monetary penalties or suspension of the acquiring or processing services or both, would be imposed on erring institutions for failure to comply with any of the provisions of the Guidelines.

Section 2.10 of the Guidelines provides that non compliance with the Guidelines shall attract appropriate sanctions from the CBN.

The Nigerian Payments System Risk and Information Security Management Framework applies to payment systems based or operated in Nigeria, along with their infrastructure providers and the payment service providers that make up those systems. Section 8.6(i) of the Framework requires system operators, participants and payment service providers to establish and implement information security policies in line with ISO 27001 standards or subsequent standards.

Section 8.6(i) of the Framework also requires them to ensure the confidentiality, integrity and availability of all information, systems and networks that are critical to the success of the scheme. Section 8.6(iii) of the Framework requires participants and payment service providers to conduct an annual information security assessment including penetration and vulnerability tests.

Section 9.1(vii) of the Framework requires every card-not-present transaction on a Nigerian issued card from a Nigerian acquired merchant to use a minimum of 2 factor authentication, except a card on file transaction whose initial transaction used 2 factor authentication. Section 13 of the Framework provides that the Central Bank of Nigeria shall monitor and enforce compliance with it.

The Central Bank of Nigeria lists the Framework in its Payments System Guidelines under the reference PSM/PSI/GEN/CWD/01/028 as published on January 6, 2020. Section 33(1)(b) of the Central Bank of Nigeria (Establishment) Act, 2007 empowers the Bank to issue guidelines to any person and any institution under its supervision. Section 33(5)(a) of that Act makes an institution that fails to comply with such a guideline liable on conviction to a fine not exceeding N10,000,000.

The Central Bank of Nigeria issued the Regulatory Framework for the Use of Unstructured Supplementary Service Data for Financial Services in Nigeria in exercise of the powers conferred on it by section 47(2) of the CBN Act, 2007. The Framework lists banks, other financial institutions and payment service providers among the service providers that provide financial services through the use of USSD.

Section 6.1 of the Framework requires a financial institution providing use of the USSD channel to put in place a message authentication mechanism that validates that requests and responses are generated through authenticated users. Section 6.2 of the Framework requires the institution to ensure that the customer receives notification on the status of every transaction conducted through the channel.

Section 6.4 of the Framework requires the institution to ensure encryption of USSD information within its environment by an auditable process. Section 6.7 of the Framework requires the data stored by the USSD application at a financial institution to be encrypted. Section 6.7 of the Framework provides that customer information logged by the USSD application as part of financial transactions should not include sensitive information such as the customer PIN.

Section 6.10 of the Framework requires the institution to mandate the use of an effective second factor authentication by customers for all transactions above N20,000, in addition to the PIN. Section 6.11 of the Framework requires that the second factor not be sent to the customer's registered GSM number or device and not be generated or displayed on the USSD menu.

Section 6.12 of the Framework requires the institution to install a behavioural monitoring system with capability to detect SIM-swap or churn status, user location and unusual transactions at weekends. Section 10 of the Framework provides that the appropriate regulator, the CBN or the NCC as applicable, shall impose appropriate sanctions for any contravention on any participant that fails to comply with the Framework.

Section 47(3) of the Central Bank of Nigeria (Establishment) Act, 2007 gives the Bank power to prescribe rules and regulations for the efficient operation of all clearing and settlement systems.

Section 1.1.2 of the Framework requires a Supervised Financial Institution to implement a cybersecurity programme that includes, at a minimum, risk assessment, security policy development, incident response planning, vulnerability management, log monitoring, a data backup and recovery plan, security awareness and training, initiatives to attain target maturity level and metrics to assess the effectiveness of the programme.

Section 2.2 of the Framework requires yearly vulnerability assessments and threat analysis, a penetration test by a third party at least annually and quarterly internal vulnerability scans. Section 3.3 of the Framework requires an institution to establish a capability for ongoing 24/7 monitoring of its IT systems to detect anomalies or cyber incidents promptly.

Item 1.1 of Appendix III to the Framework requires multifactor authentication, role based access control and layered controls to secure employee, customer and third-party access, and requires critical systems to use multi-factor authentication. Item 2 of Appendix IV to the Framework requires an institution adopting an emerging technology to establish strong authentication systems and to encrypt sensitive data both in transit and at rest.

Section 4 of the Framework lists contactless payments and USSD codes among the payment methods it treats as emerging technologies. Section 1.4 of the Framework requires an institution to appoint a Chief Information Security Officer subject to Central Bank of Nigeria approval. Section 2.5 of the Framework requires the annual cybersecurity self-assessment to reach the Director, Banking Supervision not later than February 28.

The Central Bank of Nigeria issued the Framework by a letter of May 31, 2024 as the minimum requirements to be put in place by all banks and payment service banks in their cybersecurity programmes. The Framework's covering letter sets July 1, 2024 as the effective date for full compliance. The Framework applies to commercial banks, merchant banks, non-interest banks and payment service banks.

The Framework replaces the Risk-based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Providers issued in October 2018. Section 6 of the Framework provides that non-compliance with it shall attract appropriate sanctions as defined in section 68 of BOFIA, 2020. Section 7 of the Framework provides that the Central Bank of Nigeria shall monitor and enforce compliance.

Section 33(1)(b) of the Central Bank of Nigeria (Establishment) Act, 2007 empowers the Bank to issue guidelines to any person and any institution under its supervision. Section 33(5)(a) of that Act makes an institution that fails to comply with such a guideline liable on conviction to a fine not exceeding N10,000,000.

The CBN's Payments System Guidelines page lists the Supervisory Framework for Payment Service Banks under the reference PSM/DIR/CON/INM/011/077 as published on July 8, 2021. The Framework provides a set of regulations that are targeted at streamlining the operations of Payment Service Banks.

Section 9.0 of the Framework requires a payment service bank to comply with the Nigerian Financial Services Industry IT Standard Blueprint and the Risk Based Cyber Security Framework, as well as all other regulations the Bank may issue regarding ICT infrastructure for banks. Section 9.0 of the Framework requires a payment service bank to comply with PCI DSS and ISO 27001/27002 as the standards for information and technology security.

Section 9.0 of the Framework requires a payment service bank to put in place a cybersecurity programme that shall meet the minimum requirement laid out in the Risk Based Cybersecurity Framework. Section 16.0 of the Framework provides that appropriate financial and administrative sanctions shall be imposed on erring payment service banks and their principal officers, as provided for in relevant laws, regulations and guidelines.

Paragraph 2(1) of the Designation and Protection of Critical National Information Infrastructure Order, 2024 designates as Critical National Information Infrastructure the computer systems, networks and communication infrastructures acquired, installed, deployed and operated in the sectors listed in the Schedule to the Order.

The Order lists as sectors power and energy, water, information, communication, science and technology, banking, finance and insurance, health, public administration, education, defense and security, transport, food and agriculture, safety and emergency services, industrial and manufacturing, and mines and steel.

Paragraph 3 of the Order requires the Office of the National Security Adviser to develop, with the stakeholders in the infrastructure and for the approval of the President, a protection plan and guidelines specifying minimum standards, rules and procedures for the protection, preservation and general management of designated Critical National Information Infrastructure.

Paragraph 4 of the Order requires the Office of the National Security Adviser to establish a Trusted Information Sharing Network whose members include the owners and operators of Critical National Information Infrastructure. Members and entities within that Network must collaborate and share information on threats and vulnerabilities.

Paragraph 6 of the Order requires the Office of the National Security Adviser to periodically audit and inspect Critical National Information Infrastructure to ensure compliance with the Act and any guideline or rule made under the Order. Paragraph 7 of the Order makes it an offence to access or tamper with a Critical National Information Infrastructure without authorisation and for fraudulent purposes, or to hinder or interfere with its functioning, and leaves the penalty to the Act.

Section 3(1) of the Cybercrimes (Prohibition, Prevention, etc.) Act, 2015 lets the President, on the recommendation of the National Security Adviser, designate computer systems and networks as Critical National Information Infrastructure by an Order published in the Federal Gazette. Section 5(1) of the Act sets, for an offence committed against a designated Critical National Information Infrastructure, imprisonment for a term of not more than 10 years without an option of fine. The Order is dated 24 June 2024 and is made under section 3 of the Act.

The National Insurance Commission issued the Guidelines for Insurtech Operations in Nigeria in exercise of the powers conferred by the National Insurance Commission Act 1997 and the Insurance Act 2003. Section 1.2 of the Guidelines provides that no person shall commence or carry on any class of insurtech business without being registered or authorized by the Commission.

Section 9.1(i) of the Guidelines requires an insurtech to have and implement a secure technology framework with proper access controls. Section 9.1.2 of the Guidelines requires an insurtech to develop and implement a robust technology security policy approved by its Board in line with the Commission's Technology Guidelines, subject to the Commission's approval.

Section 9.1.3.1 of the Guidelines makes updates of critical information on an insurtech's website or other channels subject to dual verification and 2-step authentication. Section 9.1.4 of the Guidelines requires a minimum two-factor authentication process for all users to have access to the services provided by an insurtech.

Section 9.1.5 of the Guidelines requires an insurtech to introduce logical access controls in its technology infrastructure and to test them using periodic penetration testing. Section 9.1.6 of the Guidelines requires an insurtech to establish a resilient framework for periodic data backup and recovery, business continuity and data and software management.

Section 9.2 of the Guidelines requires an insurtech that distributes or markets insurance products to deploy an independent technology firm to audit its lead management system, domain and entire operations at least once a year, and to submit the audit report to the Commission within three months from 31st December of every year. Section 19 of the Guidelines makes them effective from 1st August 2025.

Section 18.2.1(ii) of the Guidelines provides that the Commission shall impose administrative sanctions on an insurtech for identified inappropriate actions or inactions or corporate misconduct. Section 18.2.1(i) of the Guidelines lets the Commission cancel an insurtech's licence or take any other action it considers appropriate on observing any infraction or non-compliance with the Guidelines.

The Nigerian Communications Commission issued the Cyber Resilience Framework for the Nigerian Communication Sector, Version 1.0, in February 2026. The Framework is applicable and enforceable on all communication service providers who provide services as defined in the Nigerian Communications Act, 2003. Section 8.4 of the Framework states that compliance with it takes effect on February 23, 2027, which is 12 months after the date of issuance.

Section 10.1 of the Framework requires all communication service providers across all tiers to achieve full compliance within 12 months from the effective date of the official release of the Framework, February 23, 2026. Section 4.4 of the Framework requires service providers to document and implement approved cybersecurity and cyber resilience policies and procedures.

Section 4.4 of the Framework requires service providers to implement technical and organizational measures to safeguard data at rest, in transit and in use. Section 4.4 of the Framework requires service providers to ensure that cybersecurity audits and vulnerability assessment and penetration testing are conducted to detect vulnerabilities in the IT and OT environments of critical systems.

Section 4.4 of the Framework requires service providers to establish or contract a Cyber Security Operations Centre to monitor the network, endpoints, physical environment, personnel, malicious code and third-party activities. Section 4.4 of the Framework requires service providers to develop and implement a comprehensive Cyber Crisis Management Plan that includes scenario-based standard operating procedures.

Section 4.4 of the Framework requires service providers to get onboarded to the NCC-computer security incident response team (CSIRT) Vulnerability and Threat Exposure Management platform and other ngCERT initiatives as notified from time to time. Section 8.4 of the Framework requires cyber audit reports and other required documentation to be submitted to the Nigerian Communications Commission at least annually or as it requires.

Section 8.6 of the Framework provides that non-compliance will be enforced in line with the Enforcement Processes Regulations. Regulation 14(1) of the Nigerian Communications (Enforcement Processes, etc.) Regulations lets the Commission impose administrative fines for enforcement purposes, including where no specific sanction is provided.

Section 12.1 of the Guidelines requires a Principal to render monthly returns to the CBN, not later than the 10th day of the following month, that include incidents of fraud, theft or robbery at any Agent location. Section 12.3 of the Guidelines requires the returns to be addressed to the Director, Payments System Supervision Department of the CBN.

Section 12.5 of the Guidelines treats a return submitted later than ten working days after the end of the period specified as an infraction that shall attract sanctions in line with section 14. Item 5 of Appendix I to the Guidelines sets a fine of not less than N2,000,000 for the offence and N250,000 for each day that the default continues, for late rendition of periodic returns.

Section 9.1.2 of the Guidelines requires a Principal to continuously monitor an Agent's compliance with transaction limits and report any suspicious or fraudulent activity of the Agent. The Guidelines apply to all Financial Institutions licensed by the CBN and authorised to engage in Agent banking activities.

The Guidelines define a Principal as any of the following entities, commercial banks, non-interest banks, payment service banks, microfinance banks, mobile money operators, and any other category of financial institution that the CBN shall authorize to accept deposit and carry out Agent banking activities. The Guidelines supersede all other CBN guidelines on Agent banking and Agent banking relationships. The Central Bank of Nigeria issued the Guidelines in October 2025.

Section 14 of the Guidelines provides that the CBN may, in the event of a breach of any provision of the Guidelines, invoke any or all of the sanctions in that section against any defaulting participant in the Agent banking system.

Section 5 of the Framework requires a Supervised Financial Institution to report all cyber incidents, as defined in Appendix I, to the Director of Banking Supervision of the Central Bank of Nigeria not later than 24 hours after the incident is detected.

Appendix I to the Framework defines a cyber-incident as any event which may result in a financial loss above 0.01% of shareholders' funds unimpaired by losses, data breach and data destruction, unplanned outage in the Core Banking Application, website defacement, any glitch that results in financial losses, or others as determined from time to time.

The incident reporting template in Appendix VII to the Framework states that security incidents must be reported to the Director, Banking Supervision within 24 hours of the incident happening. The incident reporting template in Appendix VII to the Framework states that additional updates must be provided if the earlier reporting was incomplete.

The Central Bank of Nigeria issued the Framework by a letter of May 31, 2024 as the minimum requirements to be put in place by all banks and payment service banks in their cybersecurity programmes. The Framework's covering letter sets July 1, 2024 as the effective date for full compliance. The Framework applies to commercial banks, merchant banks, non-interest banks and payment service banks.

The Framework replaces the Risk-based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Providers issued in October 2018. Section 6 of the Framework provides that non-compliance with it shall attract appropriate sanctions as defined in section 68 of BOFIA, 2020. Section 7 of the Framework provides that the Central Bank of Nigeria shall monitor and enforce compliance.

Section 33(1)(b) of the Central Bank of Nigeria (Establishment) Act, 2007 empowers the Bank to issue guidelines to any person and any institution under its supervision. Section 33(5)(a) of that Act makes an institution that fails to comply with such a guideline liable on conviction to a fine not exceeding N10,000,000.

Section 21 of the Cybercrimes (Prohibition, Prevention, etc.) Act, 2015 requires any person or institution, whether public or private, that operates a computer system or network in Nigeria to immediately inform the National Computer Emergency Response Team (CERT) Coordination Center of any attack, intrusion, or other disruption liable to hinder the functioning of another computer system or network, so that the National CERT can take the necessary measures to address the issue.

The National CERT Coordination Center may propose isolating an affected computer system or network pending resolution. A person or institution that fails to report such an incident to the National CERT within the period that section 21(3) sets commits an offence and is liable to denial of internet services, and must in addition pay a mandatory fine of N2,000,000 into the National Cyber Security Fund. As enacted in 2015, section 21(3) set that period at 7 days of the incident's occurrence.

Section 3 of the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act, 2024 substitutes the expression “72 hours of its detection” for “7 days of its occurance” in section 21(3), and inserts the words “through their respective sectoral CERTs or sectoral Security Operations Centres (SOC)” after “Coordination Center” in section 21(1). The text of that Amendment Act certified by the Clerk to the National Assembly on 27 February 2024 leaves its commencement line blank.

The Office of the National Security Adviser is the Act's own coordinating body for all security and enforcement agencies under it. Section 2(2)(a) of the Interpretation Act provides that, where no other provision is made as to the time when an enactment is to come into force, an enactment contained in an Act of the National Assembly comes into force on the day when the Act is passed. Under section 2(1) of the Interpretation Act, an Act is passed when the President assents to the Bill for the Act.

Section 4.4 of the Cyber Resilience Framework for the Nigerian Communication Sector requires service providers to report cybersecurity breaches and incidents to NCC-computer security incident response team (CSIRT), in line with the Framework. Section 7.2 of the Framework adopts a two-step reporting approach with a reporting timeline for detection of 4 hours and a confirmation reporting timeline of 24 hours, with periodic 4-hour updates after the first detection.

Section 7.2 of the Framework requires service providers to classify and report incidents with potential impact based on a severity matrix. Section 7.2 of the Framework requires service providers to maintain a dedicated focal point for incident reporting, with clearly defined escalation and contact protocols in place. Annexure IV to the Framework requires the reporting entity to submit a follow-up report within 7 days of its initial notification.

Annexure IV to the Framework provides that, where an incident escalates beyond its initial severity classification or poses broader systemic risks, NCC-CSIRT should be updated immediately using the fastest available communication channel. Annexure IV to the Framework provides that failure to report incidents within the specified timeframes may result in sanctions or penalties in accordance with applicable Nigerian Communications Commission regulations and the Framework.

Section 2.3 of the Framework makes it applicable and enforceable on all communication service providers who provide services as defined in the Nigerian Communications Act, 2003. Section 8.4 of the Framework states that compliance with it takes effect on February 23, 2027.

The Code of Practice for Interactive Computer Service Platforms/Internet Intermediaries, issued by the National Information Technology Development Agency (NITDA) under section 6 of the NITDA Act, 2007 in collaboration with the Nigerian Communications Commission and the National Broadcasting Commission, applies to all Interactive Computer Service Platforms and Internet Intermediaries operating in Nigeria, a term the Code defines broadly to include social media operators, websites, blogs, media-sharing sites, discussion forums, streaming platforms, and gaming platforms.

Part II requires a Platform to label, censor, redact, or otherwise apply access control so that content inappropriate for a child, such as sexually explicit content or images of violence, is not viewable to a child. Part II also requires a Platform to inform users through its terms of service not to create, publish, modify, transmit, store, or share content harmful to a child.

A Platform must also give consideration, in assessing whether content is harmful, to the risk that its dissemination could have a physical or psychological impact on a child or an adult, and must ensure its community rules specify how children will be protected from harmful content they may encounter.

The Code does not itself prescribe an age-verification mechanism, and non-compliance is stated to be a breach of the Nigerian Communications Act, 2003, the National Broadcasting Commission Act, 2004, and the NITDA Act, 2007, rather than a penalty set out in the Code itself.

Section 20(1) of the Copyright Act, 2022 excludes several acts from the exclusive rights conferred by sections 9 to 13, by way of fair dealing, including private use, parody, satire, pastiche, or caricature, non-commercial research and private study, and criticism, review, or the reporting of current events, subject to acknowledging the title and author where the use is public, except where the work is incidentally included in a broadcast.

The excluded acts also include the inclusion of an artistic work situated in a public place in an audiovisual work or broadcast, the incidental inclusion of an artistic work in an audiovisual work or broadcast, and reading or recitation in public or in a non-commercial broadcast of a reasonable extract from a published literary work, with acknowledgment. Separately excluded are quotations in the form of short excerpts from a work.

Also excluded is news of the day for public broadcast or publicly communicated by any other means. Section 20(1)(d)'s proviso conditions the criticism, review, and current-events exception on a fairness test weighing the purpose and character of the use, the nature of the work, the amount and substantiality of the portion used, and the effect of the use on the potential market or value of the work.

Section 20 carries no headline-length or short-extract cap distinct from these tests, and no reported Nigerian decision applies it to a systematic news aggregator rather than an individual quoting or reporting on a published work. Related rights under the Act, covering performers, sound recordings, broadcasts, and expressions of folklore, do not extend to a print or online news publisher's own reporting.