Financial Services

The Central Bank of Nigeria’s Risk-Based Cybersecurity Framework changed the conversation in Nigerian banking. A board-approved cyber policy, a functioning security operations capability, defined incident reporting windows, periodic penetration testing and an accountable Chief Information Security Officer are no longer aspirations for the tier-one banks alone; they apply to microfinance and mortgage banks whose entire IT department may be four people. Most institutions in that position cannot justify a 24-hour in-house security operations centre, but they still have to answer the examiner. That gap is the single most common reason a financial institution first calls us.

The second pressure is the payment rails. Nigerian retail finance runs on NIBSS Instant Payments, the BVN framework and the card schemes, and customers judge an institution entirely on whether a transfer completes. A branch link that flaps for forty seconds during a settlement window produces failed transactions, duplicate debits, an angry contact centre and a dispute queue that takes days to clear. Agent banking multiplies the exposure: thousands of terminals in markets and filling stations, each one a transaction endpoint, each one subject to onboarding, limit and geolocation record-keeping rules that must be demonstrable on request.

Third is the cost of card compliance. Any institution that stores, processes or transmits cardholder data faces PCI DSS v4.0 — network segmentation, encryption and key management, logging, quarterly approved scanning vendor scans and an annual assessment. The technical work is unglamorous and the evidence collation is worse, but a lapsed attestation can cost a card scheme relationship. We do segmentation design, remediation and evidence assembly for the assessor, and we run the monitoring that keeps the environment in scope-compliant condition between assessments.