The Central Bank of Nigeria (CBN) has warned banks, fintechs and other financial institutions that a cybersecurity weakness in a single institution or technology provider could trigger a cascading crisis across the country’s interconnected financial system.
The apex bank said the growing interdependence among banks, fintech companies, payment service providers, cloud operators and other technology vendors means that an isolated cyber incident or operational failure could quickly affect other parts of the financial ecosystem.
Dr. Rakiya Opemi Yusuf, Director of the Payments System Supervision Department at the CBN and Chairperson of the Nigeria Electronic Fraud Forum, gave the warning during a panel session at the 19th Annual Banking and Finance Conference of the Chartered Institute of Bankers of Nigeria (CIBN) in Abuja.
The session was titled “Navigating Cyber and Systemic Risks in the AI-Driven Future of Banking: Implications for Financial Stability and Business Resilience.”
It examined the increasing exposure of the financial sector to cyber threats, artificial intelligence and technology-driven interconnectedness, as financial institutions continue to rely on an expanding network of external technology and service providers.
Yusuf said the increasing dependence of banks and other financial institutions on fintechs, payment service providers, cloud operators and other technology vendors had created additional pathways through which operational failures and cyber incidents could spread.
She described the potential consequences as a “one-fire” effect, explaining that a weakness in one bank, fintech, payment provider or technology vendor could extend beyond the organisation directly affected.
According to the CBN official, financial institutions must therefore expand their understanding of cybersecurity beyond their own internal systems and consider vulnerabilities within the wider network of companies and service providers on which they depend.
She urged banks, fintechs and other institutions to regularly assess their third-party relationships and dependencies.
Such assessments, she said, should examine whether technology partners have sufficient capacity to withstand cyberattacks, operational disruptions and other incidents that could affect the delivery of critical financial services.
Yusuf stressed that resilience should not be measured solely by an institution’s ability to prevent a cyberattack.
She said institutions must also be assessed on their ability to maintain critical services during a disruption and restore normal operations as quickly as possible.
The emphasis on resilience reflects the increasingly interconnected nature of Nigeria’s financial system, where institutions depend on shared infrastructure and external technology providers to deliver services to customers.
A disruption affecting one component of that ecosystem could therefore have consequences for other institutions and users if appropriate safeguards are not in place.
Yusuf said the CBN was responding to these emerging risks through stronger policies, regulations and supervisory frameworks designed to identify vulnerabilities that could threaten financial stability before they develop into wider problems.
She explained that systemic-risk considerations were increasingly being incorporated into the approval of new financial products, reflecting the regulator’s efforts to prevent vulnerabilities from being introduced into the financial system as new services and technologies are deployed.
The CBN official also called for faster reporting of cyber incidents and vulnerabilities by financial institutions.
She said early notification would give regulators and other relevant stakeholders more time to assess threats and take steps to contain them before they spread across interconnected networks.
Yusuf further advocated stronger intelligence and information sharing among financial institutions.
She said institutions could respond more effectively to emerging threats if relevant information about cyberattacks, vulnerabilities and evolving techniques used by criminals was shared across the industry.
Such collaboration, she noted, would help institutions learn from incidents affecting other organisations and strengthen their own defences against similar threats.
Yusuf also called for stronger Security Operations Centres (SOCs) capable of providing real-time monitoring of threats across the financial ecosystem.
The capability to detect suspicious activity quickly, she said, would be important in reducing the potential impact of incidents and improving the sector’s ability to respond to threats.
Artificial intelligence was another major issue discussed during the session.
As banks and fintech companies increasingly explore AI for customer service, fraud detection, decision-making and other functions, Yusuf cautioned institutions against allowing greater automation to reduce human responsibility.
She described the principle as “automating accountability”, stressing that while AI systems can perform increasingly sophisticated tasks, human beings must remain responsible for decisions and their consequences.
The warning comes as the financial sector continues to adopt AI-driven technologies that can process large volumes of data and automate functions that previously required direct human intervention.
Yusuf said the adoption of AI must therefore be accompanied by appropriate governance and accountability mechanisms.
She also highlighted the importance of data governance and digital sovereignty, urging financial institutions to have greater clarity about the location of critical data, who has access to it, what intelligence can be extracted from it and how that information is subsequently used in decision-making.
According to her, institutions could face additional vulnerabilities when critical data or technological capabilities are placed outside their effective control.
The CBN official consequently called for a broader approach to resilience, arguing that financial institutions must consider the security of the entire ecosystem rather than focusing exclusively on their individual organisations.
This approach would require closer coordination between regulators, banks, fintech companies, payment service providers and technology companies.
Yusuf said stakeholders should work together to identify interconnected vulnerabilities and establish mechanisms capable of containing disruptions before they affect the wider financial system.
The call for collaboration reflects the changing nature of financial services in Nigeria, where traditional banks now operate alongside fintechs, digital payment companies, cloud providers and other technology businesses.
While these relationships have expanded the range and accessibility of financial services, they have also increased the number of connections through which a cyber incident could potentially spread.
The CBN’s warning therefore places greater emphasis on third-party risk management, incident reporting, intelligence sharing and operational resilience.
It also highlights the need for financial institutions to ensure that the technology providers supporting their operations have appropriate cybersecurity and continuity capabilities.
For customers, the ability of financial institutions to maintain services and recover quickly from disruptions remains critical, particularly as digital channels have become increasingly important to everyday financial transactions.
Yusuf said the ultimate objective should be to build a financial system capable of absorbing shocks, containing cyber incidents and recovering rapidly without allowing the failure of a single institution or service provider to destabilise the wider ecosystem.
The CBN’s position underscores the growing importance of collective cybersecurity as Nigeria’s financial sector becomes more technology-driven.
As banks and fintechs continue to adopt AI and deepen their reliance on interconnected digital infrastructure, protecting individual institutions will increasingly depend on protecting the wider network in which they operate.