The Central Bank of Nigeria (CBN) has mandated banks and financial institutions to complete a new cybersecurity self-assessment tool (CSAT) to bolster the sector’s resilience.
In a March 30 circular signed by Olubunmi Ayodele-Oni for the compliance director, CBN stated that the tool aligns with its powers under the Banks and Other Financial Institutions Act (BOFIA) 2020. It evaluates cybersecurity readiness across governance, risk management, tech/third-party controls, incident response, and operational resilience.
Deposit money banks must submit assessments within 3weeks; other entities (payment service banks, microfinance banks, providers, finance companies, and development finance institutions) have 5weeks. Submissions, reflecting data as of December 31, 2025, go via a dedicated portal with guidance for chief information security officers. CBN will validate via reviews and engagements, warning that false data breaches BOFIA 2020 and invites sanctions.
Insights from CSAT will inform risk-focused oversight of cybersecurity threats. The directive is effective immediately.
