Business
CBN warns banks, fintechs over cyber risks
…Says weak links could destabilise financial system
By Emma Ujah, Abuja Bureau Chief
ABUJA: The Central Bank of Nigeria, CBN, has urged banks, fintechs and other financial institutions to treat cybersecurity and third-party technology risks as critical financial stability issues, warning that vulnerabilities in one institution could trigger widespread disruption across the financial system.
The Director, Payments System Supervision at the CBN and Chairperson of the Nigeria Electronic Fraud Forum, NeFF, Dr Rakiya Yusuf, gave the warning at the 19th Annual Banking and Finance Conference of the Chartered Institute of Bankers of Nigeria, CIBN, in Abuja.
Speaking during a session titled, “Navigating Cyber and Systemic Risks in the AI-Driven Future of Banking: Implications for Financial Stability and Business Resilience,” Yusuf said the growing reliance of financial institutions on fintechs, payment service providers, cloud operators and other technology vendors had created new channels for cyber and systemic risks.
She warned that a weakness in a bank, fintech, payment service provider or technology vendor could spread rapidly across interconnected institutions, creating what she described as a “one-fire” effect capable of destabilising the entire financial system.
Yusuf said financial institutions must therefore move beyond securing their internal systems to strengthening safeguards across the wider financial ecosystem.
She urged banks and other operators to continuously assess their dependencies, third-party relationships and technology partners to determine how disruptions in one part of the ecosystem could affect their operations.
The CBN director stressed that operational resilience involved more than preventing cyberattacks, noting that institutions must also be able to maintain critical services during disruptions and recover quickly from incidents.
She disclosed that the CBN was strengthening its regulatory framework, supervisory processes and policy measures to identify and address vulnerabilities capable of threatening financial stability before they materialise.
According to her, cyber and operational risk considerations were now being integrated into the product approval process to ensure that new financial products did not introduce systemic vulnerabilities.
Yusuf also urged financial institutions to extend cybersecurity and risk-management oversight to third-party service providers.
She said banks must assess the capacity of their technology partners to withstand and recover from cyberattacks and major operational failures.
The CBN director called for prompt reporting of cyber incidents and vulnerabilities to regulators, saying early disclosure would enable timely intervention before isolated breaches escalated into systemic threats.
She also advocated greater intelligence and information sharing among financial institutions, noting that stronger collaboration would improve the industry’s ability to detect emerging threats and coordinate responses.
Yusuf recommended the establishment of stronger Security Operations Centres, SOCs, capable of monitoring cyber threats across the financial ecosystem in real time.
On the growing adoption of artificial intelligence, she cautioned that innovation must be matched with accountability, insisting that automation should not eliminate human responsibility from financial decisions.
She described the approach as “automating accountability,” explaining that while AI could perform increasingly sophisticated tasks, human oversight must remain central to decisions affecting customers and the financial system.
Yusuf further urged financial institutions to strengthen data governance and pay greater attention to digital sovereignty by examining where critical data were stored, who had access to them, what intelligence could be derived from them and how such data influenced decision-making.
She warned that placing critical data or key technological capabilities beyond an institution’s effective control could expose the financial system to additional risks.
Yusuf maintained that safeguarding Nigeria’s financial system required a collective approach involving regulators, banks, fintechs, payment service providers and technology companies.
She said the objective should be to build a resilient ecosystem capable of absorbing shocks, containing cyber incidents and recovering swiftly without allowing the failure of one institution to threaten the stability of the entire financial system.
