The Central Bank of Nigeria has warned that cybersecurity can no longer be treated as an internal problem for individual banks, saying a weakness in one institution or technology provider could spread rapidly across the country’s increasingly interconnected financial system.
Director of the CBN Payments System Supervision Department and Chairperson of the Nigeria Electronic Fraud Forum, Rakiya Opemi Yusuf, gave the warning at the 19th Annual Banking and Finance Conference of the Chartered Institute of Bankers of Nigeria in Abuja.
Yusuf said the growing dependence of banks on fintech companies, payment service providers, cloud operators and other technology vendors had created more channels through which operational failures and cyber incidents could spread.
She urged financial institutions to examine not only their own systems but also the resilience of third-party providers on which they depend. According to her, the ability to continue critical services during a disruption and restore operations quickly should be central to how resilience is measured.
Yusuf said the CBN was strengthening supervisory policies and incorporating systemic-risk considerations into the approval of new financial products in an effort to prevent vulnerabilities from becoming embedded in the wider ecosystem.
She also called for faster reporting of cyber incidents, stronger intelligence sharing among institutions and more capable Security Operations Centres for real-time threat monitoring.
On artificial intelligence, Yusuf warned that automation must not weaken human accountability, stressing that responsibility for decisions and their consequences must remain with people even when AI systems perform increasingly sophisticated functions.
She also highlighted data governance and digital sovereignty, saying institutions must understand where critical data is stored, who can access it and how intelligence extracted from it is used.
The CBN official said the ultimate objective should be a financial system capable of absorbing shocks, containing cyber incidents and recovering rapidly without allowing the failure of a single institution or service provider to destabilise the wider sector.
