CBN Issues Urgent Cybersecurity Warning to Banks and Fintechs Over System Destabilisation Risks

The Central Bank of Nigeria has warned financial institutions that weak cybersecurity defences could trigger systemic collapse across the banking sector. The regulator stressed that vulnerabilities in third-party technology providers pose a critical threat to financial stability and the broader economy.

The Central Bank of Nigeria has ordered banks and fintech companies to elevate cybersecurity from operational concern to financial stability priority, citing the contagion risk posed by vulnerabilities in single institutions or their technology partners.

In a stark warning delivered to the sector, the CBN signalled that a successful cyberattack on one lender or payment processor could cascade across the entire financial system, potentially disrupting deposit access, transaction processing, and credit flows that millions of Nigerians depend on daily. The regulator emphasised that third-party technology risks demand the same rigorous oversight as traditional banking risks.

The timing reflects growing anxiety within Nigeria's financial establishment. Over the past 18 months, Nigerian banks have reported multiple cyber incidents ranging from fraudulent wire transfers to account takeovers. Last year, the banking sector recorded over 1,200 reported cyber incidents, with losses exceeding N50 billion according to industry data. Fintechs, which have exploded in number across Nigeria's digital economy, often operate with leaner security infrastructures than traditional banks, creating potential weak links in the financial chain.

For everyday Nigerians, the implications are concrete. A widespread cyber incident affecting major payment processors could freeze access to savings, halt salary transfers, and cripple merchants' ability to process transactions. Small and medium enterprises dependent on digital payments for daily operations would face immediate cash flow crises. The naira's stability could also be threatened if such an incident triggered panic withdrawals or loss of confidence in the banking system, pressuring the currency further at a time when it already faces headwinds from weak oil revenues and capital outflows.

The CBN's warning underscores a critical vulnerability in Nigeria's financial architecture. Unlike traditional risks such as credit defaults or liquidity stress, cyber threats are borderless and difficult to predict. A fintech in Lagos using outdated cloud infrastructure could expose data belonging to account holders across the country. Similarly, a compromise of a third-party vendor serving multiple banks simultaneously could trigger simultaneous failures across institutions that would normally operate independently.

Regulators globally have learned this lesson the hard way. In 2021, a cyberattack on U.S. Treasury department contractors temporarily threatened market infrastructure. South Africa's banking sector experienced significant disruption in 2022 when a major payment processor suffered a ransomware attack. Nigeria cannot afford such disruptions given its already fragile financial system and the critical role banking plays in economic recovery efforts.

The CBN's directive signals that the regulator plans enhanced oversight of how banks vet and monitor their technology partners. This could mean stricter vendor management requirements, mandatory penetration testing, and enhanced incident reporting protocols. For financial institutions, compliance will require significant capital investment in security infrastructure and personnel, costs that may eventually be passed to customers through higher banking fees or reduced interest on savings.

Market analysts note that the CBN's warning also reflects a broader regulatory shift toward treating technology risk as equivalent to credit, liquidity, and operational risk. This elevation of cyber concerns suggests the regulator may soon introduce specific cybersecurity regulations with enforceable standards and penalties for non-compliance.