CBN rolls out cybersecurity tool for banks, sets compliance deadlines

The Central Bank of Nigeria (CBN) has introduced a Cybersecurity Self-Assessment Tool (CSAT) to strengthen the resilience of Nigeria’s financial system against rising cyber threats.

In a circular dated March 30, 2026, the apex bank directed all regulated institutions—including Deposit Money Banks, Payment Service Banks, Microfinance Banks, Payment Service Providers, Finance Companies, and Development Finance Institutions—to complete and submit the assessment within specified timelines.

The circular, titled: “Deployment of Cybersecurity Self-Assessment Tool (CSAT)” and signed by Olubunmi Ayodele-Oni for the Director of the Compliance Department, noted that the initiative aligns with the provisions of the Banks and Other Financial Institutions Act.

According to the CBN, the CSAT is a structured supervisory instrument designed to evaluate the cybersecurity posture of financial institutions and their preparedness to prevent and respond to cyber incidents.

READ ALSO: CBN orders banks to bar loan defaulters from accessing services

The tool will assess critical areas such as cybersecurity governance, risk management frameworks, technology and third-party risk controls, incident response capabilities, and overall operational resilience.

The bank explained that insights generated from the exercise will enhance risk-based supervision and strengthen regulatory oversight across the financial ecosystem.

Affected institutions are required to submit their responses via a dedicated online portal, with access details to be provided to Chief Information Security Officers and other designated officials.

Deposit Money Banks have been given three weeks to comply, while other institutions have five weeks. All submissions must include relevant supporting documentation and reflect each institution’s position as of December 31, 2025.

The CBN warned that inaccurate or misleading submissions will attract sanctions, adding that verification processes—including off-site reviews and supervisory engagements—will be conducted. The directive takes immediate effect.