CBN Warns Banks to Tighten Cybersecurity, Prevent Wider Risk
By Patience Ikpeme
The Central Bank of Nigeria (CBN) has told banks, fintechs and other financial institutions to treat cybersecurity, third-party technology risks and business continuity as issues that affect the stability of the whole financial system. The apex bank warned that a weakness in one institution could spread and cause disruption across the wider financial network.
The CBN said financial institutions can no longer focus only on protecting themselves. As more banks depend on fintechs, payment service providers, cloud companies and other technology vendors, new risks are opening up that can affect the whole system if not properly managed.
The Director, Payments System Supervision Department of the CBN and Chairperson of the Nigeria Electronic Fraud Forum, Dr. Rakiya Opemi Yusuf, gave this warning on Wednesday during a panel session at the 19th Annual Banking and Finance Conference of the Chartered Institute of Bankers of Nigeria (CIBN) in Abuja.
The session was titled “Navigating Cyber and Systemic Risks in the AI-Driven Future of Banking: Implications for Financial Stability and Business Resilience.” It looked at how artificial intelligence, cyber threats and growing digital connections are affecting Nigeria’s financial system.
Yusuf said that a weakness in one bank, fintech, payment service provider or technology vendor could spread to other connected institutions. She called this a “one-fire” effect, one that can disrupt the whole financial system if not caught early.
She said institutions must regularly check their dependencies, their partnerships with other companies, and their technology providers, so they understand how a problem in one place could affect their own operations.
Yusuf said being ready for risk is not only about stopping cyberattacks from happening. Financial institutions must also be able to keep offering important services when something goes wrong, and recover quickly afterward.
She said the CBN is strengthening its policies, regulations, supervisory work and other tools to catch and deal with risks that could threaten financial stability before they become serious problems. She added that these kinds of risks are now also being considered when new financial products are being approved.
The CBN director called on financial institutions to extend their cybersecurity and risk-management work beyond their own systems, to cover the third-party companies they depend on. She said banks and other institutions should take a hard look at how strong their technology partners are, including whether those partners can withstand and recover from cyberattacks or major breakdowns.
Yusuf also called for cyber incidents and weaknesses to be reported quickly, saying that fast reporting would allow regulators to step in before small, isolated problems grow into bigger threats to the whole system.
She said financial institutions need to share more information and intelligence with each other, adding that stronger teamwork across the industry would help everyone spot new threats early and respond better.
The CBN official also called for stronger Security Operations Centres that can watch for threats across the financial system in real time.
Speaking on artificial intelligence, Yusuf urged financial institutions to balance new technology with responsibility, saying that even as more processes become automated, humans must not be removed from financial decisions.
She described this idea as “automating accountability,” explaining that although AI can now carry out more complex tasks, people must still be the ones held responsible for decisions and outcomes in financial services.
Yusuf also urged institutions to strengthen how they manage data and pay closer attention to where their critical data is stored, who can access it, what information can be drawn from it, and how it affects decision-making. She warned that if an institution loses effective control over its critical data or technology, it could be exposed to extra risks.
She said the financial sector must work together to build resilience, bringing regulators, banks, fintechs, payment service providers and technology companies into a stronger, shared system for managing cyber and system-wide risks.
Yusuf said the goal should be a financial system strong enough to absorb shocks, contain cyber incidents, and recover quickly, without letting the failure of one institution or service provider bring down the wider system.
