The Central Bank of Nigeria (CBN) has directed all banks to complete a mandatory cybersecurity self-assessment within three weeks, aiming to strengthen resilience across the country’s financial system.
In a letter dated March 30, 2026, published on its website, the apex bank stated that Deposit Money Banks (DMBs) must submit their completed Cybersecurity Self-Assessment Tool (CSAT) within three weeks, while other regulated institutions have five weeks.
The directive applies to banks, selected financial institutions, and payment service providers, and introduces the CSAT to evaluate cyber risk exposure across the sector.
“The CSAT is a structured supervisory instrument designed to obtain comprehensive information on the cybersecurity posture of regulated institutions,” the CBN said, noting that it assesses governance structures, risk management frameworks, technology systems, third-party risks, incident response capacity, and overall operational resilience.
The CBN emphasized that all submissions must be accurate, complete, and verifiable. False or misleading information will constitute a regulatory breach and attract sanctions. The bank also plans to validate submissions through off-site reviews and supervisory engagements.
Institutions are required to submit the assessment through a dedicated portal, with access credentials communicated to Chief Information Security Officers and other relevant officials. The data provided must reflect positions as of December 31, 2025.
The directive reflects heightened regulatory scrutiny of cyber risks in Nigeria’s banking sector amid rising digital transactions and increasing exposure to cyber threats.
Victor Ologun, a marketing professional in the financial services sector, noted that weak cyber defences continue to expose customers to growing risks, underlining the importance of compliance with CBN’s cybersecurity requirements.
