CBN Alerts Banks, Fintechs To Rising Cyber Risks

The Central Bank of Nigeria, CBN, has called on banks, fintechs and other financial institutions to regard cybersecurity and third-party technology risks as critical financial stability issues, warning that weakness in one institution could disrupt the wider financial system.

The warning was issued by the Director of Payments System Supervision at the CBN and Chairperson of the Nigeria Electronic Fraud Forum (NeFF), Dr Rakiya Yusuf, during the 19th Annual Banking and Finance Conference of the Chartered Institute of Bankers of Nigeria (CIBN) in Abuja.

While speaking during a session titled, “Navigating Cyber and Systemic Risks in the AI-Driven Future of Banking: Implications for Financial Stability and Business Resilience,” Yusuf said the growing reliance of financial institutions on fintechs, payment service providers, cloud operators and other technology vendors had created new channels for cyber and systemic risks.

She warned that a weakness in a bank, fintech, payment service provider or technology vendor could spread rapidly across interconnected institutions, creating what she described as a “one-fire” effect capable of destabilising the entire financial system.

Strengthening financial system resilience

According to her financial institutions must therefore move beyond securing their internal systems to strengthening safeguards across the wider financial ecosystem.

She urged banks and other operators to continuously assess their dependencies, third-party relationships and technology partners to determine how disruptions in one part of the ecosystem could affect their operations.

The CBN director stressed that operational resilience involved more than preventing cyberattacks, noting that institutions must also be able to maintain critical services during disruptions and recover quickly from incidents.

She disclosed that the CBN was strengthening its regulatory framework, supervisory processes and policy measures to identify and address vulnerabilities capable of threatening financial stability before they materialise.

According to her, cyber and operational risk considerations were now being integrated into the product approval process to ensure that new financial products did not introduce systemic vulnerabilities.

CBN urges stronger third-party oversight

Yusuf also urged financial institutions to extend cybersecurity and risk-management oversight to third-party service providers.

She said banks must assess the capacity of their technology partners to withstand and recover from cyberattacks and major operational failures.

The CBN director also urged financial institutions to promptly report cyber incidents and vulnerabilities to regulators, noting that early disclosure would allow authorities to intervene quickly and prevent isolated breaches from developing into wider systemic threats.

She also advocated greater intelligence and information sharing among financial institutions, noting that stronger collaboration would improve the industry’s ability to detect emerging threats and coordinate responses.

Yusuf recommended the establishment of stronger Security Operations Centres, SOCs, capable of monitoring cyber threats across the financial ecosystem in real time.

AI adoption requires accountability

On the increasing use of artificial intelligence, she warned that innovation must go hand in hand with accountability, stressing that automation should not remove human responsibility from financial decision-making.

She described the approach as “automating accountability,” explaining that while AI could perform increasingly sophisticated tasks, human oversight must remain central to decisions affecting customers and the financial system.

Yusuf also called on financial institutions to strengthen their data governance practices and pay closer attention to digital sovereignty by assessing where critical data are stored, who has access to them, the intelligence that can be derived from them and how they are used to inform decision-making.

She warned that placing critical data or key technological capabilities beyond an institution’s effective control could expose the financial system to additional risks.

Yusuf maintained that safeguarding Nigeria’s financial system required a collective approach involving regulators, banks, fintechs, payment service providers and technology companies.

She said the goal should be to build a resilient financial ecosystem that can withstand shocks, contain cyber incidents and recover quickly, without allowing the failure of any single institution to undermine the stability of the entire financial system.