The Central Bank of Nigeria has been urged to broaden its oversight of financial institutions to include risks arising from cloud service providers, telecommunications networks, fintech companies and other technology partners.
The Director-General of the National Information Technology Development Agency, Kashifu Inuwa, said traditional regulatory frameworks are no longer adequate for a financial sector that increasingly depends on technology providers and interconnected digital infrastructure.
“Financial stability now depends on resilient technology and Nigeria’s capacity for digital self-determination,” Inuwa.
While speaking on digital transformation, supervision, innovation and operational resilience at the recent 15th Retreat of the CBN Committee of Departmental Directors in Lagos, he warned that an outage or disruption affecting an external technology provider could have wider consequences for the financial ecosystem.
Inuwa said regulators must look beyond individual financial institutions and gain broader visibility into the technology ecosystem underpinning modern banking. He noted that disruptions affecting external service providers could impact customers and the wider financial system, even when the affected bank remains fully operational.
“We need to be ahead of the institutions we regulate,” Inuwa said. “We cannot wait for regulated institutions to submit returns before we analyse and understand what is happening. We need end-to-end visibility of the ecosystem.”
The warning comes as Nigeria’s financial sector becomes increasingly digital, with the growth of electronic payments, mobile banking and fintech services expanding the range of technology platforms through which customers access financial services.
The CBN has also been strengthening technology-related safeguards in the financial sector. As part of these measures, it directed payment acquirers, processors and terminal service providers to maintain dual connections to NIBSS and Unified Payment Services, aimed at reducing disruptions arising from reliance on a single transaction channel.
The apex bank has also increased its use of automated technologies for financial supervision. In March, it issued baseline standards for automated anti-money laundering, counter-terrorism financing and counter-proliferation financing systems, requiring real-time detection, analysis and reporting of suspicious transactions.
Inuwa said the next phase of financial regulation should go beyond banks themselves to address risks associated with technology providers, including third-party and fourth-party dependencies, cloud infrastructure, data protection, artificial intelligence and the resilience of digital infrastructure.
He explained that the issue is particularly important because a bank may outsource a critical service to a technology company that, in turn, depends on another provider for its infrastructure. Such interconnected dependencies can create multiple layers of risk, making it harder for regulators and financial institutions to determine where a disruption may originate.
Cloud computing is emerging as a critical part of the regulatory landscape. Earlier this month, NITDA signed regulatory instruments establishing a framework for cloud computing and digital infrastructure, alongside a National Cloud Investment Strategy designed to strengthen Nigeria’s domestic cloud and data-centre capacity.
The agency is expected to commence the registration, technical assessment and certification of cloud and digital infrastructure providers through a national digital regulatory platform in October.
