Risk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Providers - Letter to All Banks and Payment Service Providers

Sep 13, 2026

Official guidance issuing a risk-based cybersecurity framework for Deposit Money Banks (DMBs) and Payment Service Providers (PSPs), setting minimum baseline requirements for cybersecurity programmes. Establishes an effective compliance date of January 1, 2019. Emphasizes confidentiality, integrity and availability of information, resilience against threats such as ransomware, targeted phishing and Advanced Persistent Threats, and the need to integrate cybersecurity into business objectives and overall risk management. Covers governance, risk management, operational resilience, metrics, monitoring, reporting, and regulatory compliance, including multiple appendices.

LanguageEnglish

CategoryLetters

FormatPDF

Pages65

Reading Time23 min

AccessFree to download

Table of Contents

Introduction

Cybersecurity Governance and Oversight

Cybersecurity Risk Management System

Cybersecurity Operational Resilience

Metrics, Monitoring & Reporting

Compliance with Statutory and Regulatory Requirements

Appendix I: Critical Systems and Cyber-Incidents

Appendix II: Cybersecurity Self-Assessment Tools

Appendix VII: Reporting Templates

BSD/DIR/GEN/LAB/11/25 October 10, 2018 LETTER TO ALL BANKS AND PAYMENT SERVICE PROVIDERS ISSUANCE OF RISK-BASED CYBERSECURITY FRAMEWORK AND GUIDELINES FOR DEPOSIT MONEY BANKS AND PAYMENT SERVICE PROVIDERS The CBN hereby issues the attached Risk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks (DMBs) and Payment Service Providers (PSPs) , which represents the minimum requirements to be put in place by all DMBs in their respective cybersecurity programmes. The effective date for full compliance with the provisions of the guidelines is January 1, 2019 and all DMBs and PSPs are expected to do so, on or before that date. Please, be guided accordingly. Yours faithfully, AHMAD ABDULLAHI DIRECTOR, BANKING SUPERVISION RISK-BASED CYBERSECURITY FRAMEWORK AND GUIDELINES FOR DEPOSIT MONEY BANKS AND PAYMENT SERVICE PROVIDERS OCTOBER 2018 Table of Contents 1. Introduction ........................................................................................................................................... 1 2. Cybersecurity Governance and Oversight ............................................................................................... 3 3. Cybersecurity Risk Management System................................................................................................ 8 4. Cybersecurity Operational Resilience ................................................................................................... 11 5. Metrics, Monitoring & Reporting ......................................................................................................... 13 6. Compliance with Statutory and Regulatory Requirements .................................................................... 14 Appendix I: Critical Systems and Cyber-Incidents ....................................................................................... 15 Appendix II: Cybersecurity Self-Assessment Tools ...................................................................................... 16 Appendix III: Know Your Environment: ....................................................................................................... 17 Appendix IV: Enhancing Cybersecurity Resilience ....................................................................................... 22 Appendix V: Informative References ............................................................................................................ 34 Appendix VI: Cyber-Threat Intelligent Sources ............................................................................................ 35 Appendix VII: Reporting Templates ............................................................................................................. 38 Acronyms....................................................................................................................................................... 1 Glossary ........................................................................................................................................................ 2 1. Introduction The safety and soundness of Deposit Money Banks (DMBs) and Payment Service Providers (PSPs) require that they operate in a safe and secure environment. Hence, the platform on which information is processed and transmitted should be managed in a way that ensures the confidentiality, integrity and availability of information as well as the avoidance of financial loss and reputation risk, amongst others. In recent times, cybersecurity threats have increased in number and sophistication as DMBs and PSPs, use information technology to expedite the flow of funds among entities. In this regard, threats such as ransomware, targeted phishing attacks and Advanced Persistent Threats (APT), have become prevalent; demanding that DMBs and PSPs remain resilient and take proactive steps to secure their critical information assets including customer information that are ac

FAQs

What does the framework require for DMBs and PSPs?

It sets minimum cybersecurity baseline requirements to be implemented within DMBs’ and PSPs’ cybersecurity programmes, using a risk-based approach.

When is full compliance with the guidelines required?

Full compliance is required by January 1, 2019, on or before that date for all DMBs and PSPs.

How should a cybersecurity programme be integrated into the organizations?

It must be fully integrated into business goals and objectives and must be an integral part of overall risk management processes.

Sep 13, 2026

Upload by McGucket