In a bid to bolster cybersecurity measures in the financial sector, the Central Bank of Nigeria (CBN) has issued a directive to all financial institutions, necessitating the implementation of a 0.5% cybersecurity levy on all electronic transactions. This directive, outlined in a circular dated June 25, 2024, aligns with the provisions of the recently amended Cybercrime (Prohibition, Prevention, etc.) Act 2024.
Key Points:
- Levy Application: The 0.5% cybersecurity levy will be applied at the point of electronic transfer origination, with the deducted amount to be denoted as “Cybersecurity Levy” in the customer’s account.
- Remittance Procedure: Financial institutions are mandated to commence deductions within two weeks from the circular issuance date and remit the accumulated levies monthly to the National Cybersecurity Fund (NCF), overseen by the Office of the National Security Adviser (ONSA).
- Implementation Schedule: Levy implementation will begin two weeks after the circular issuance for all eligible financial transactions. Monthly remittances must be deposited into the NCF account at the CBN by the 5th business day of every subsequent month.
- Compliance Requirements: Financial entities must complete system reconfigurations for remittance file submission to the Nigeria Interbank Settlement System (NIBSS) within four weeks for primary financial institutions and eight weeks for other entities like microfinance banks.
- Exemptions and Penalties: Certain transactions, including loan disbursements, salary payments, and government-related welfare transactions, are exempt from the cybersecurity levy. Failure to comply with levy remittance can lead to penalties as stipulated in Section 44 (8) of the Cybercrime Act, including fines of not less than 2% of the defaulting business’s annual turnover.
This directive underscores the CBN’s commitment to enhancing cybersecurity resilience within the financial ecosystem, ensuring robust protection against cyber threats and vulnerabilities.