CENTRAL BANK OF NIGERIA ISSUES DRAFT CYBERSECURITY GUIDELINE FOR DEPOSIT MONEY BANKS (DMB) AND PAYMENT SERVICE PROVIDER (PSP)

BACKGROUND
The Central Bank of Nigeria (CBN) recently published a draft guideline on cybersecurity for Deposit Money Banks (DMB’S) and Payment Service Providers (PSP’s). The guideline is
borne out of the persistent and increasing cyber-attacks on financial institutions and platforms in the country. The increased sophistication of attacks has resulted in the huge
financial losses, loss of trust with the potential risk of exploitation of design vulnerabilities, identity theft, malware attack, and malicious use that post risks to security and safety of individuals. Cyberattack exposes organisations to the loss of intellectual properties and
trade secret; online fraud and financial crimes, theft of personally identifiable information (PII); financial manipulation; disruption in production or services, and reduced trust for online activities. This is dire for the expansion of financial institutions seeking wider financial inclusions for millions of unbanked Nigerians.
The CBN is empowered under the Central Bank of Nigeria Act and Banks and Other Financial Institutions Act (BOFIA) to issue guidelines to regulate the nation’s financial institutions and service providers in the country. The guideline is a commendable response
to an exigent problem plaguing the nation’s cyberspace. Nigeria is witnessing a burgeoning
growth in its banking sector and fintech space with increasing record transactions. Payant, a payment platform recently announced recording over 1 billion naira worth of transaction on its platform in less than two years.
Section 5 of Cybercrimes Act criminalises attack on sectors designated as critical national infrastructure punishable by imprisonment term not less than 15 years without an option of
fine. Part 7.5 of the National Cybersecurity Policy designates financial services sectors amongst other sectors as National Critical Information Infrastructure (NCII).

BRIEF OVERVIEW OF THE GUIDELINE
The guideline is divided into six parts namely, Cybersecurity Governance and Oversight, Cybersecurity Risk Management Programme, Cyber Resilience Assessment, Cybersecurity
Operational Resilience, Metrics, Monitoring & Reporting, and Compliance with Statutory
and Regulatory Requirements.

The framework seeks to establish a minimum cybersecurity baseline to be put in place by DMB’s and PSP’s. It serves as guidance for the implementation of their cybersecurity policy towards enhancing their resilience in the face of growing threat and attacks. The guideline
puts cybersecurity at the forefront and should be fully integrated into organisations overall business and management objectives and strategy.

It is survival.
It is the duty of the Board of Directors to ensure compliance with all statutes, regulations, and the guideline. Non-compliance with the guideline shall attract sanction from the apex bank. CBN is charged with the responsibility to monitor, ensure compliance andenforcement of the framework. The guideline will take effect from 1st August 2018.

HIGHLIGHTS OF THE GUIDELINE
• The Board of Directors has overall responsibility for the DMB/PSP’s cybersecurity programme and the development of a cybersecurity strategy, and policy. The cybersecurity framework must “align policies, business and technological
approaches to address cyber risks and clearly define all cybersecurity roles and responsibilities”.
• The Board of Directors is responsible for providing oversight, leadership and resources to ensure that cybersecurity governance becomes an integral part of corporate governance. They are to integrate cybersecurity into business functions across all operational level and with the overall business goals and objectives.
• The senior management team shall be responsible for the implementation of the Board’s approved cybersecurity policies, standards and the delineation of
cybersecurity responsibilities and the Chief Information Security Officer
(CISO) will be in charge of day-to-day cybersecurity activities and mitigation of risk. DMB’s and PSP’s will have to set up compliance, internal audit, and risk management unit.
• DMB’s and PSP’s shall incorporate cyber risk management with their institution-wide risk management framework and governance requirements to ensure consistent management of risk across the institution which should be founded on the understanding of threats, vulnerabilities, risk profile and level of risk tolerance of the organisation.
• DMB’s and PSP’s need to build and strengthen cyber resilience. These include constant evaluation of security posture, inherent risks in business operations, visibility to emerging threats to information assets, the capability to swiftly respond and recover from cyber-incidents, and efficacy of existing controls to mitigate the identified risks.
• DMB’s and PSP’s shall submit a cybersecurity self-assessment and prompt report of threat and attack to the Director, Banking Supervision Department of the Central Bank of Nigeria bi-annually not later than February 28th and August 31st
endorsed by the board and signed by the CISO. This should not overlap with the provision of Section 21 of the Cybercrimes Act requiring reporting of threat and attack to the Nigerian Computer Emergency Response Team (ngCERT).
• The guideline encourages PSP’s and DMB’s to obtain cyber insurance package to mitigate risk and devise incidence response plan and strengthen resilience.
• The guideline provides informative references to COBIT, ISO, and NIST. The guideline also includes a reference template to for assessment test and reporting

KEY STATS
• Nigeria currently has over 147 million mobile phone subscribers, with internet penetration at over 100 million users. This includes a rising number of non-internet subscribers utilising the Unstructured Supplementary Service Data (USSD) platform.

• According to Serianu 2017 Cybersecurity report, Cybercrime cost Nigeria $649 million, a significant rise from $550 million the previous year. In 2017, Nigeria ranked third in the world for cybercrime according to the Nigerian Communication Commission (NCC), the West-African nation only surpassed by the U.S. and the U.K.
• The Nigerian Electronic Fraud Forum (NeFF) in its 2017 report has put the value of electronic banking fraud cases over the last three years at N5.571 billion. Fraud via ATM channels rose from N355.89 million in 2015, to N497.643 million in 2017. Mobile payment fraud rose to N347.645 million in 2017.
• In a 2016 report, Serianu reported that Nigerian financial institutions were hit with more online scams, Automated Teller Machine (ATM) skimming, identity theft, and customised malware targeting critical mobile and Internet banking infrastructure.
• According to the Global Cybersecurity Index (GCI) by the ITU, that measures the commitment of countries to cybersecurity across industries and sectors. Nigeria ranks 46th globally and 5th in Africa. The country is also grouped alongside 77 other countries in Maturing stage of Cybersecurity development.
• On the part of the government, the office of the National Security Adviser (NSA) pursuant to Section 42 of the Cybercrimes Act 2015, the Nigerian Computer Emergency Response Team (ngCERT) has been established, which serves as the Coordination Centre responsible for managing cyber incidents in Nigeria.

LEGAL EFFECT OF THE GUIDELINE
The CBN is charged with the responsibility to enforce compliance and mete out sanctions under the guideline. The guideline is considered a subsidiary legislation. A subsidiary
legislation is made pursuant to the power conferred by a principal legislation (The CBN Act and BOFIA in this context).The Nigerian Court in the case of Best Njoku & Ors v Chief Mike Iheanatu (2008) LPELR – 3871 has held that “subsidiary legislation generally has the force of law and it derives its authority from the substantive legislation”. This is
further strengthened by the provisions of Section 18 of the Interpretations Act.
This might imply that beyond the sanctions that can be issued by the CBN, individuals affected by a breach could bring an action against culpable financial institution; if the individual can be establish that the breach affected their rights and freedom. Consequently, DMB’s and PSP’s will have to bring their cybersecurity practice into conformity with the
guideline.

CONCLUSION
The guideline is a good step and a commendable one, the author believes other industry regulators will take a cue from the CBN’s innovation to protects consumers. DMB’s and
PSP’s should build resilience and sharpen capability to anticipate, detect, recover and contain attacks. They need to build their security architecture, regular training of staff, and immersing cybersecurity culture in the workplace, vendor/third party security vetting, access control, regularly test vulnerability and data loss prevention.

Nigeria currently lacks a definite legislative framework and practical regulatory guidance from industry regulators. In 2015, the country enacted the Cybercrimes (Prohibition and Prevention) Act that criminalises a considerable number of Cybercrimes prevalent in the
country. While the legislative effort was a good move, it has not stemmed the tide of attacks and the machinery for implementation appears to be technologically aback.
The country urgently requires a data protection framework to make organisations more responsible and diligent about security. There is no civil remedy under any extant law or
regulations for victims of cyberattack currently in Nigeria as we have seen in other climes.
The guideline is a positive step going forward.

Ridwan Oloyede – ridwan.oloyede@famsvillesolicitors.com