Nigeria’s financial institutions are racing to meet the June 10, 2026 deadline set by the Central Bank of Nigeria for compliance with a new cybersecurity baseline aimed at strengthening the country’s financial system against emerging digital threats.
Industry sources, however, said while most commercial banks are on track to meet the deadline, many smaller financial institutions remain far from compliance, exposing the wider banking ecosystem to the very risks the new framework was designed to prevent.
The new cybersecurity standard is targeted at strengthening Anti-Money Laundering, Combating the Financing of Terrorism and Counter-Proliferation Financing systems across all regulated financial institutions.
On March 10, 2026, the Central Bank of Nigeria issued Circular BSD/DIR/PUB/LAB/019/002, directing the mandatory implementation of baseline standards for automated AML/CFT/CPF systems across the financial sector.
Under the directive, every regulated financial institution is required to submit an implementation roadmap to the apex bank by June 10, 2026.
Financial Vanguard gathered that only tier-one banks and a limited number of other institutions are likely to meet the deadline, while many operators below them are lagging due to the absence of Chief Information Security Officers and inadequate cybersecurity infrastructure.
Speaking on the situation, cybersecurity expert, Ms. Seun Runsewe, said the scope of the circular goes beyond acquiring software solutions.
“The circular covers 12 functional areas, and every one of them requires not just a system purchase but a governance architecture,” she said.
She explained that most leading banks are better positioned to comply because they already have established cybersecurity structures and technical support systems in place.
“Realistically, most of the leading banks would meet the deadline because they have CISOs, internal teams, and vendors already lined up,” she added.
Runsewe, however, expressed concern about the readiness of smaller financial institutions, particularly microfinance banks, finance houses and primary mortgage institutions, which make up a large portion of Nigeria’s regulated financial ecosystem.
“The categories of financial institutions below the banks including roughly 900 microfinance banks, more than 100 finance houses, and the primary mortgage banks, is where the majority of regulated institutions in this country actually sit,” she stated.
“Most don’t have a CISO, let alone a functioning automated AML solution. Many are starting from near zero with the deadline already on top of them.”
She warned that the vulnerability of smaller institutions could have far-reaching consequences for the broader financial system because they operate on interconnected payment and identity infrastructure shared with larger banks.
“It isn’t only their problem. These institutions sit on the same shared rails as everyone else – NIBSS, BVN, the agency banking networks. One under-instrumented microfinance bank is a door. That is how ecosystem-wide breaches actually unfold: through the smallest, weakest connected node. The big banks inherit whatever happens at the bottom,” she said.
The new regulatory push comes amid increasing concerns over cyber threats, digital fraud and illicit financial flows within the banking sector, with regulators seeking to strengthen compliance systems and improve resilience across Nigeria’s rapidly expanding financial services industry.
