The Central Bank of Nigeria (CBN) has ordered banks to conduct a mandatory cybersecurity self-assessment within three weeks to bolster the resilience of the country’s financial system.
In a letter dated March 30, 2026, and published on its website on Tuesday, the apex bank stated, “Institutions are required to submit their completed CSAT within the following timelines: i. Three (3) weeks – Deposit Money Banks (DMBs); ii. Five (5) weeks – All other regulated institutions.”
The directive, addressed to banks, selected financial institutions, and payment service providers, introduced a Cybersecurity Self-Assessment Tool (CSAT) to evaluate the cyber risk exposure of regulated entities. The CBN noted that the move aligns with its statutory mandate under the Banks and Other Financial Institutions Act 2020 and its broader commitment to improving cybersecurity standards in the sector.
The bank emphasized, “The CSAT is a structured supervisory instrument designed to obtain comprehensive information on the cybersecurity posture of regulated institutions.” It explained that the tool would assess critical areas, including governance structures, risk management frameworks, technology systems, third-party risk exposure, incident response capacity, and overall operational resilience.
According to the CBN, insights generated from the exercise will support risk-based supervision and enhance regulatory oversight of cybersecurity threats within Nigeria’s financial ecosystem.
“All submissions must be fully completed and accompanied by relevant supporting documentation, where applicable,” the bank said, noting that the data provided must reflect institutions’ positions as of December 31, 2025. It added a warning against false or incomplete disclosures, stressing that accuracy and transparency would be strictly enforced.
“Supervised institutions are reminded that all information submitted to the CBN must be accurate, complete, and verifiable. Submission of false, misleading, or inaccurate information constitutes a regulatory breach and will attract appropriate sanctions,” the letter stated.
The CBN also disclosed plans to validate submissions through off-site reviews and supervisory engagements to confirm the data’s reliability. The directive, which takes immediate effect, signals tighter regulatory scrutiny of cyber risks in the banking sector amid rising digital transactions and increasing exposure to cyber threats.
