CBN Warns Banks, Fintechs: One Weak Link Can Burn the Whole System

The Central Bank of Nigeria has told banks, fintechs and other financial institutions to treat cybersecurity and third-party technology risks as core financial stability issues. The regulator warned that a weakness in one institution could spread fast across the system and cause widespread disruption.

Dr Rakiya Yusuf, Director of Payments System Supervision at the CBN and Chairperson of the Nigeria Electronic Fraud Forum (NeFF), gave the warning at the 19th Annual Banking and Finance Conference of the Chartered Institute of Bankers of Nigeria (CIBN) in Abuja. She spoke during a session titled "Navigating Cyber and Systemic Risks in the AI-Driven Future of Banking: Implications for Financial Stability and Business Resilience."

The 'One-Fire' Problem

Yusuf said the growing reliance of financial institutions on fintechs, payment service providers, cloud operators and other technology vendors has opened new channels for cyber and systemic risks. A weakness in a bank, fintech, payment service provider or technology vendor could spread rapidly across interconnected institutions, creating what she called a "one-fire" effect capable of destabilising the entire financial system.

Her message to operators was blunt. Securing internal systems is no longer enough. Institutions must strengthen safeguards across the wider financial ecosystem and continuously assess their dependencies, third-party relationships and technology partners to see how a disruption in one part of the ecosystem could hit their own operations.

She stressed that operational resilience goes beyond preventing cyberattacks. Institutions must also keep critical services running during disruptions and recover quickly from incidents.

What the CBN Is Doing

Yusuf disclosed that the CBN is strengthening its regulatory framework, supervisory processes and policy measures to identify and address vulnerabilities capable of threatening financial stability before they materialise. Cyber and operational risk considerations are now being built into the product approval process, so that new financial products do not introduce systemic vulnerabilities.

She also urged banks to extend cybersecurity and risk-management oversight to third-party service providers, assessing whether their technology partners can withstand and recover from cyberattacks and major operational failures.

On incident reporting, the CBN director called for prompt disclosure of cyber incidents and vulnerabilities to regulators. Early reporting, she said, would allow timely intervention before isolated breaches escalate into systemic threats. She also pushed for greater intelligence and information sharing among financial institutions, and recommended stronger Security Operations Centres (SOCs) able to monitor cyber threats across the financial ecosystem in real time.

AI, Data and Accountability

On the growing adoption of artificial intelligence, Yusuf cautioned that innovation must be matched with accountability. Automation should not remove human responsibility from financial decisions. She described the approach as "automating accountability," explaining that while AI can perform increasingly sophisticated tasks, human oversight must remain central to decisions affecting customers and the financial system.

She urged institutions to strengthen data governance and pay greater attention to digital sovereignty by examining where critical data are stored, who has access to them, what intelligence can be derived from them and how that data influences decision-making. Placing critical data or key technological capabilities beyond an institution's effective control, she warned, could expose the financial system to additional risks.

Yusuf maintained that safeguarding Nigeria's financial system requires a collective approach involving regulators, banks, fintechs, payment service providers and technology companies. The goal, she said, is a resilient ecosystem that can absorb shocks, contain cyber incidents and recover swiftly without allowing the failure of one institution to threaten the stability of the entire system.