One Bank’s Cyber Weakness Could Trigger Wider Disruption, CBN Warns

A cyber weakness in one bank could spread across interconnected financial institutions and trigger wider disruption in Nigeria’s financial system, the Central Bank of Nigeria (CBN) has warned.

The apex bank urged banks, fintechs and other financial institutions to strengthen cybersecurity, manage third-party technology risks and improve business continuity measures to prevent isolated incidents from escalating into systemic threats.

The CBN charged banks, fintechs and other financial institutions to treat cybersecurity, third-party technology risks and business continuity as matters of financial-system stability, warning that vulnerabilities in one institution could trigger wider disruption across the interconnected financial ecosystem.

The apex bank said financial institutions must move beyond protecting their individual organisations and strengthen safeguards across their interconnected networks as growing dependence on fintechs, payment service providers, cloud operators and other technology vendors creates new channels for cyber and systemic risks.

The director, Payments System Supervision Department of the CBN and chairperson of the Nigeria Electronic Fraud Forum, Dr Rakiya Opemi Yusuf, gave the warning on Wednesday during a panel session at the 19th Annual Banking and Finance Conference of the Chartered Institute of Bankers of Nigeria (CIBN) in Abuja.

The session, titled, “Navigating Cyber and Systemic Risks in the AI-Driven Future of Banking: Implications for Financial Stability and Business Resilience,” focused on the implications of artificial intelligence, cyber threats and digital interconnectivity for Nigeria’s financial system.

Yusuf warned that a weakness in one bank, fintech, payment service provider or technology vendor could potentially spread to other interconnected institutions, creating what she described as a “one-fire” effect capable of disrupting the wider financial system.

She said institutions must therefore regularly assess their dependencies, third-party relationships and technology providers to understand how a failure in one part of the ecosystem could affect their operations.

According to her, resilience goes beyond preventing cyber incidents, stressing that financial institutions must also be capable of continuing to deliver critical services during disruptions and recovering quickly after an incident.

Yusuf said the CBN was strengthening its policies, regulations, supervisory frameworks and other measures to ensure vulnerabilities capable of threatening financial stability were identified and addressed before they crystallised.

She noted that such risk considerations were also being taken into account at the product-approval stage.

The CBN director urged financial institutions to extend cybersecurity and risk-management responsibilities beyond their internal systems to third-party providers on which their operations increasingly depend.

She said banks and other institutions should critically examine the resilience of their technology partners, including their capacity to withstand and recover from cyberattacks or major operational failures.

Yusuf also called for prompt reporting of cyber incidents and vulnerabilities, saying timely disclosure would enable regulators to intervene before isolated incidents evolved into broader systemic threats.

She stressed the need for greater information and intelligence sharing among financial institutions, arguing that stronger collaboration would help the industry identify emerging threats and improve its collective response.

The CBN official also advocated stronger Security Operations Centres capable of monitoring threats across the financial ecosystem in real time.

On artificial intelligence, Yusuf urged financial institutions to balance innovation with accountability, stressing that increasing automation must not remove human responsibility from financial decisions and processes.

She described the principle as “automating accountability”, noting that although AI could perform increasingly sophisticated functions, humans would remain responsible for decisions and outcomes involving financial services.

Yusuf further urged institutions to strengthen data governance and pay closer attention to digital sovereignty by examining where critical data is stored, who has access to it, what insights can be generated from it and how such data influences decision-making.

She warned that placing critical data or technological capabilities beyond an institution’s effective control could expose the organisation to additional risks.

Yusuf said the financial sector must therefore adopt a collective approach to resilience, bringing regulators, banks, fintechs, payment service providers and technology companies into a stronger framework for managing cyber and systemic risks.

She maintained that the objective should be to build a financial ecosystem capable of absorbing shocks, containing cyber incidents and recovering rapidly without allowing the failure of one institution or service provider to destabilise the wider system.