CBN urged to expand oversight of fintech, cloud risks

The Central Bank of Nigeria (CBN) should expand its regulatory oversight to encompass risks posed by cloud providers, telecom networks, fintechs, and other technology partners, according to Kashifu Inuwa, Director-General of the National Information Technology Development Agency.

Inuwa argued that traditional regulatory methods are insufficient in today's financial system, where banks increasingly depend on external technology providers and interconnected digital infrastructure. He warned that disruptions at these external providers could have cascading effects across the entire financial ecosystem, impacting financial stability. "Financial stability now depends on resilient technology and Nigeria’s capacity for digital self-determination," Inuwa stated at a recent retreat for CBN departmental directors.

“

Financial stability now depends on resilient technology and Nigeria’s capacity for digital self-determination.

Nigerian banks and payment companies are becoming more reliant on infrastructure they do not directly control, such as cloud computing, telecommunications, and various technology services. Inuwa stressed the need for regulators to develop visibility across this broader ecosystem, rather than solely monitoring individual financial institutions. He emphasized that disruptions outside a bank's direct control can still affect customers and the financial system, even if the bank itself remains operational.

"We need to be ahead of the institutions we regulate," Inuwa said. "We cannot wait for regulated institutions to submit returns before we analyse and understand what is happening. We need end-to-end visibility of the ecosystem." This call comes as Nigeria's financial sector becomes increasingly digital, with mobile banking and fintech services expanding access points. The CBN has been strengthening its technology-related safeguards, including directives for payment service providers to maintain dual connections to reduce single points of failure. Inuwa suggested the next regulatory phase should incorporate risks from technology suppliers, including third-party dependencies, cloud infrastructure, data protection, and artificial intelligence.

“

We need to be ahead of the institutions we regulate. We cannot wait for regulated institutions to submit returns before we analyse and understand what is happening. We need end-to-end visibility of the ecosystem.