The Nigerian Senate has passed a bill seeking to strengthen the regulatory powers of the Central Bank of Nigeria (CBN) over major financial technology companies and other non-bank financial institutions whose activities could affect the stability of the country’s financial system.
The proposed amendment to the Banks and Other Financial Institutions Act (BOFIA) 2020 is designed to expand the existing regulatory framework to cover financial institutions whose operations have become increasingly important to Nigeria’s financial sector.
The bill, identified as SB. 959, passed its third reading on Tuesday, November 10, 2026, after the Senate considered the report of its Committee on Banking, Insurance and Other Financial Institutions.
The committee is chaired by Senator Tokunbo Abiru, who represents Lagos East Senatorial District.
The development comes as Nigeria’s financial technology industry continues to expand, with digital payment platforms, electronic banking services, online lending businesses and other technology-driven financial services becoming increasingly popular among individuals and businesses.
Fintech companies have transformed how Nigerians conduct financial transactions by providing alternatives to traditional banking channels.
Customers can now transfer money, make payments, access financial services and manage transactions through mobile applications and digital platforms.
However, the rapid expansion of these services has also created new regulatory challenges, particularly in areas involving cybersecurity, customer information, operational risks and financial stability.
The proposed BOFIA amendment is intended to address some of these concerns by giving the CBN stronger powers to monitor institutions that could create wider risks for the financial system.
What the BOFIA amendment seeks to achieve
One of the major provisions of the proposed legislation is the introduction of a framework for identifying and regulating Systemically Important Institutions (SIIs).
Systemically important institutions are financial organisations whose size, activities or connections with other businesses make them important to the wider financial system.
Their failure or disruption could affect other institutions, interrupt financial services or create wider economic difficulties.
Under the proposed framework, the CBN would have explicit authority to identify, designate and register qualifying non-bank financial institutions as systemically important.
Once designated, these institutions would be required to comply with additional regulatory obligations.
The provisions include regular stress testing, data-integrity assessments, mandatory regulatory reporting and supervisory access to the operational systems of designated institutions.
Stress testing is a process used by regulators and financial institutions to examine how businesses would perform under difficult economic or operational conditions.
For example, a financial technology company may be assessed to determine whether it can continue providing essential services during a cyberattack, major system failure or sudden increase in transaction volumes.
These assessments could help regulators identify weaknesses before they develop into serious financial problems.
The proposed requirements would also allow the CBN to obtain information about the activities of designated institutions and assess whether their operations present risks to the wider financial system.
Stronger cybersecurity requirements
Cybersecurity is another important issue addressed by the proposed amendment.
As more financial transactions move online, the security of digital platforms has become essential to protecting customers and maintaining confidence in the banking system.
Financial technology companies handle sensitive information, including customers’ personal details, transaction records and financial activities.
If these systems are poorly protected, criminals may exploit security weaknesses to commit fraud, gain unauthorised access to accounts or steal financial information.
The proposed legislation seeks to strengthen cybersecurity safeguards and introduce operational resilience requirements for institutions designated as systemically important.
Operational resilience refers to a company’s ability to continue providing essential services even when it experiences disruptions.
For fintech companies, this could involve maintaining secure backup systems, improving fraud detection and ensuring that essential services can recover quickly after technical problems.
The proposed framework also includes stronger technology-risk management standards.
These measures could help improve the reliability of digital financial services and reduce the risks associated with operational failures.
Financial data ownership and customer protection
Presenting the committee’s report, Abiru highlighted concerns about the security, ownership and storage of financial information processed by technology-driven institutions.
He raised questions about where financial and behavioural data are stored, who has access to the information and which foreign jurisdictions may have claims over such data.
The issue is important because financial information can reveal significant details about individuals and businesses.
Transaction records may show spending habits, business relationships, income patterns and other financial activities.
When such information is not properly protected, customers may become exposed to identity theft, financial fraud and unauthorised use of their personal details.
The proposed amendment seeks to improve regulatory access to information and strengthen the standards governing the institutions that process financial data.
It also seeks to strengthen beneficial ownership disclosures.
Beneficial ownership refers to the individuals or entities that ultimately own or control a business, even when the ownership structure involves several companies or intermediaries.
Improved disclosure requirements could help regulators understand who controls major financial institutions and strengthen accountability within the industry.
Public register and enforcement measures
Another important provision of the proposed legislation is the establishment of an official public register of designated systemically important institutions.
The register would provide information about institutions that have been identified as having significant importance to the financial system.
The bill also proposes enforcement mechanisms and sanctions for institutions that fail to comply with the applicable regulatory requirements.
Such measures are intended to ensure that designated institutions take their responsibilities seriously.
However, implementing stronger regulations will require the CBN to establish clear standards that businesses can understand and follow.
Regulators will also need to consider the differences between large financial technology companies and smaller operators that may not pose the same level of systemic risk.
Implications for Nigeria’s fintech industry
The proposed amendment could have significant implications for Nigeria’s financial technology industry.
Major fintech operators may face additional compliance costs because of increased reporting requirements, cybersecurity standards and regulatory examinations.
Companies may also need to invest more in technology infrastructure, internal controls and risk-management systems.
Although these requirements could increase operating expenses, stronger regulation may improve public confidence in the sector.
For customers, better oversight could contribute to safer digital payments and more reliable financial services.
For investors, a clearer regulatory framework could improve confidence in the long-term stability of major fintech businesses.
However, smaller companies may need sufficient time and guidance to adapt to new requirements without affecting innovation or competition.
It is important to note that passage by the Senate does not automatically mean the bill has become law. The remaining constitutional legislative processes must be completed before its provisions can take effect.
The development nevertheless represents an important step in the effort to modernise Nigeria’s financial regulatory framework as digital financial services continue to expand.
