CBN Deploys Cybersecurity Tool, Gives Banks 3 Weeks For Compliance

The Central Bank of Nigeria (CBN) has rolled out a Cybersecurity Self-Assessment Tool (CSAT) for banks and other financial institutions, mandating deposit money banks to comply within three weeks as part of efforts to strengthen cyber resilience across the sector.

In a circular signed by Olubunmi Ayodele-Oni, for the director, Compliance department, and addressed to banks, payment service providers, and other regulated entities, the apex bank said the move was in line with its statutory mandate under the Banks and Other Financial Institutions Act (BOFIA) 2020.

The CBN stated that the CSAT “is a structured supervisory instrument designed to obtain comprehensive information on the cybersecurity posture of regulated institutions,” adding that it covers critical areas such as governance, risk management, technology controls, incident response and operational resilience.

According to the circular, “insights derived from the CSAT will support risk-based supervision,” underscoring the regulator’s push to deepen oversight of cybersecurity risks in the financial system.

The apex bank directed all affected institutions, including Deposit Money Banks (DMBs), Payment Service Banks, Microfinance Banks, Finance Companies, and Development Finance Institutions, to complete and submit the assessment through a dedicated portal.

It further disclosed that “access credentials to the portal and detailed guidance on completion of the tool will be communicated to your Chief Information Security Officers and other relevant officials.”

Providing a clear compliance timeline, the CBN said, “institutions are required to submit their completed CSAT within the following timelines: three weeks for Deposit Money Banks and five weeks for all other regulated institutions.”

The CBN stressed that all submissions must be comprehensive, noting that “all submissions must be fully completed and accompanied by relevant supporting documentation, where applicable,” with the cut-off date for data pegged at December 31, 2025.

The CBN also warned institutions against providing false information, stating that “all information submitted to the CBN must be accurate, complete, and verifiable,” adding that submission of “false, misleading, or inaccurate information will attract appropriate sanctions.”