Cashless Policy and the Cybersecurity Challenges in Nigeria (III)

By Dr. Nathaniel Atansuyi

It is no gainsaying that the adoption of digital financial services has brought numerous benefits to Nigeria, but it has also brought with it several cybersecurity challenges. In this section, the article examines the successes and failures of regulators and customers alike in dealing with cybersecurity challenges related to the cashless policy in Nigeria.

The Regulators

The CBN is the main regulator has successfully introduced various measures to promote electronic payments, including the use of these digital platforms such as Unstructured Supplementary Service Data (USSD), debit and credit cards, mobile banking, internet banking, WhatsApp banking, mobile wallets, Point-of-Sale machines, Automated Teller Machines (ATM), and others.

However seamless the regulator’s progress, there are still some challenges, such as inadequate infrastructure and low awareness among the population, which has limited its success. For instance, the Central Bank of Nigeria (CBN) has introduced several measures to enhance cybersecurity in the financial sector.

In 2015, the CBN issued a circular that requires all banks and other financial institutions to implement a risk-based cybersecurity framework. The framework is designed to identify, assess, and mitigate cyber risks in the financial sector, and in addition, the Cybersecurity Committee of the Bankers’ Committee was established to coordinate efforts to combat cyber threats in the financial sector. The committee has implemented several initiatives, including the establishment of a Cybersecurity Fusion Center, which provides real-time monitoring of cyber threats.

The Nigerian Interbank Settlement System (NIBSS) was established to manage the electronic payment system and facilitate interbank transactions, they have successfully established the National Central Switch, which enables the interoperability of all electronic payment channels in Nigeria. However, the high cost of transaction fees and the lack of robust infrastructure in some areas have limited the adoption of electronic payment channels.

Deposit Money Banks (DMBs) are responsible for implementing the cashless policy at the retail level by encouraging their customers to adopt electronic payment channels. The DMBs have been successful in deploying various electronic payment channels, including the use of Point of Sale (POS) terminals and mobile banking apps.

However, the high cost of transaction fees, charging on failed transactions on dirty reads, slowness in repayment of failed transactions, and the lack of adequate infrastructure in some areas for seamless connectivity has limited the expected widespread adoption of electronic payment channels.

Nigerian Communications Commission (NCC) NCC is responsible for regulating the telecommunications sector in Nigeria and has played a critical role in promoting the use of mobile banking and mobile payments. The NCC has successfully introduced measures to encourage the deployment of mobile payment platforms by telecom operators, which has led to an increase in mobile payments.

NCC also introduced several measures to enhance cybersecurity in the telecoms sector, which is a critical component of the digital financial services ecosystem. The NCC has introduced regulations that require telecommunications companies to implement measures to protect their networks from cyber threats. However, the lack of network coverage in some areas has limited the success of mobile payments.

Regulators Inadequacies

Despite the progress made by regulators in addressing cybersecurity challenges, there are still several areas where they are yet to be optimal in their responsibilities. One of the main failures of regulators is the lack of adequate enforcement of existing cybersecurity regulations. For example, many financial institutions in Nigeria have not fully implemented the risk-based cybersecurity
framework introduced by the CBN in 2015.

Additionally, some telecommunications companies have not fully complied with the NCC’s regulations on cybersecurity. Another failure of regulators is the lack of adequate investment in cybersecurity.

While the CBN has introduced several initiatives to enhance cybersecurity in the financial sector, there is still a significant gap in cybersecurity investment. Many financial institutions in Nigeria do not have adequate resources to invest in cybersecurity, which makes them vulnerable to cyber threats.

Successes of Customers

Customers in Nigeria have also made significant progress in addressing cybersecurity challenges
related to the cashless policy. One of the main successes of customers is the adoption of best
practices for online security.

Many customers now use strong passwords, two-factor authentication, and other security measures to protect their online accounts. More and more customers are becoming more aware of the risks of cyber threats and are taking steps for self-protection. For example, many customers now regularly check their account balances and transaction histories to detect fraudulent activities, especially phishing, and vishing.

Failures of Customer

Despite the progress made by customers in addressing cybersecurity challenges, there are still several areas where they have failed. One of the main failures of customers is the lack of awareness of cybersecurity risks. Many customers do not fully understand the risks associated with online transactions, and the protection of personal information, and these failures are making them to be vulnerable to cyber threats.

Also, there is a lack of adequate investment in cybersecurity. Many customers do not have adequate resources to invest in cybersecurity measures, such as antivirus software and firewalls, which makes them vulnerable to cyber threats. An increased and effective collaboration between regulators, financial institutions, telecommunications companies, and customers will address these challenges in no small measure.

Regulators need to enforce existing regulations and invest more resources in cybersecurity. Financial institutions and telecommunications companies need to invest more in cybersecurity and comply with existing regulations. Customers need to be educated on cybersecurity risks and encouraged to invest in cybersecurity measures to protect themselves.

Furthermore, there is a need for continuous
monitoring and evaluation of the cybersecurity framework to identify potential gaps and challenges.

The Cybersecurity Committee of the Bankers’

Committee and other relevant stakeholders should conduct regular assessments of the cybersecurity framework to ensure that it remains effective in addressing cybersecurity challenges and harnessing international collaboration and sharing of best
practices.

Cyber threats are global in nature, and collaboration with other countries and international organizations can help Nigeria address cybersecurity challenges more effectively.

In conclusion, while it can be said that the cashless policy in Nigeria has made significant progress in promoting electronic payments in Nigeria, the implementation has faced some cybersecurity challenges, such as inadequate infrastructure and low awareness among the population. By working together and investing in cybersecurity, Nigeria can continue to reap the benefits of a cashless economy while mitigating the risks of cyber threats.

Adequate consideration should be given to
cybersecurity consultants by the regulators in filling the gaps and shortfalls in cybersecurity risk assessments, mitigations, and solutions.

Here are some ways the cybersecurity consultants can collaborate with the regulators, as a third force overseeing the threat landscape.

Conduct a cybersecurity risk assessment

Consultants can work with regulators to conduct a comprehensive assessment of the risks associated with the cashless policy. This can help regulators identify potential vulnerabilities and gaps in their cybersecurity measures, and develop strategies to mitigate them.

Provide training and awareness

Consultants can help regulators to raise stakeholders’ awareness about cybersecurity’s importance in the cashless policy. They can also provide training to key personnel on how to identify and respond to cybersecurity threats.

Advice on cybersecurity with the adequate implementation of Nigeria Data Protection
Regulation (NDPR) regulations

Consultants can help regulators develop and implement cybersecurity regulations in the country, especially with the protection law, that are aligned with international best practices. This can include providing input on policy frameworks, standards, and guidelines that are relevant to the cashless policy.

Conduct penetration testing

Consultants can work with regulators to conduct penetration testing to identify vulnerabilities in the cashless system. This can help regulators identify areas that require improvement and implement necessary security measures to prevent cyber-attacks.

Monitor compliance

Consultants can assist regulators in monitoring compliance with cybersecurity regulations and NDPR by conducting regular audits and assessments of financial institutions that operate within the cashless policy framework.

It is worth noting that cybersecurity consultants can collaborate with regulators in Nigeria’s cashless policy by providing expertise, conducting assessments, and advising on best practices to address shortfalls in cybersecurity. This collaboration can help ensure the safety and security of the cashless policy and build trust among stakeholders.

Dr. Nathaniel Atansuyi, FIIM, MNCS, MCPN (C.itp), Cybersecurity Analyst at Safe Mode Data
Technologies [SMDT] Limited