Are the CBN cybersecurity rules binding?

Yes. The framework states that it represents the minimum requirements to be put in place by all DMBs and PSBs in their cybersecurity programmes, and the circular sets 1 July 2024 as the effective date for full compliance. The CBN monitors compliance through annual cybersecurity supervisory review and evaluation exercises, risk-based examinations, industry compliance audits and periodic spot checks, and non-compliance attracts sanctions under BOFIA 2020.

Do the Nigerian texts mention mobile apps?

The framework names mobile banking among the platforms and protocols whose inherent risks and vulnerabilities institutions must continually identify, sets secure coding and security testing requirements for applications throughout the SDLC, and applies MFA to customer access and critical systems. The mobile money guidelines set transaction security standards for mobile payments applications, the electronic payment channels guidelines cover mobile POS and web applications, and the open banking guidelines cover the APIs and the apps behind them.

How often do we need vulnerability assessments and penetration tests?

The framework requires a yearly vulnerability assessment and threat analysis, internal vulnerability scans every quarter, and a penetration test by a third party annually at a minimum. Within the baseline controls, a vulnerability assessment of all IT assets is reported to the ISSC and senior management at least once every quarter, and external penetration testing is required at least annually, and may be more frequent on internet-facing systems and applications. The open banking security standards require periodic vulnerability scanning and penetration testing of system security.

What remediation deadlines does the framework require?

The framework does not set a single number of days in the document. It requires institutions to specify responsibilities and timelines for the remediation of identified vulnerabilities for different categories, to deploy security updates promptly after testing in line with their patch management policy, to confirm that patches and configurations were applied successfully, and to audit the process and report to senior management. The open banking security standards require remediation in tandem with the severity of the asset. Your institution sets the numbers and must be able to show them.

Can Ostorlab be our annual third-party penetration test?

Ostorlab is a third party and tests the app and its APIs behind login, with a working exploit or request and response evidence for each finding, and retests after the fix. Whether that covers your annual penetration test, or complements a manual one, is your institution's call. The framework also asks for testing of servers, networks and other assets, and for participation in industry cyber exercises, which stay outside Ostorlab's scope.

How does the NDPA 2023 apply to a mobile banking app?

The Act requires technical and organisational measures to keep personal data secure, and measures that include encryption, de-identification, periodic risk assessments and regular testing of the effectiveness of the measures. The NDPC GAID 2025 treats data processing software, including mobile applications, as subject to a DPIA before deployment, privacy by design and by default, and the data security guidelines of the app stores. A breach likely to result in a risk to rights and freedoms must be notified to the Commission within 72 hours. Ostorlab tests the technical controls and gives you evidence; the assessment and the notification stay with your DPO.

Can our data stay in Nigeria?

Ostorlab does not have a Nigerian region. On-premises scanning keeps the scan on infrastructure you control, inside your network and inside the country. On the Enterprise plan you can choose one of the available regions, but the NDPA restricts transfers of personal data outside Nigeria unless an adequacy decision applies or another basis under sections 41 to 43 is met, so check with your compliance team. Ostorlab is SOC 2 Type II audited, and the details are in the Trust Center.

What do you need to run a scan?

At a minimum, you can search for your application on the App Store or Google Play and run a free, fast scan on ostorlab.co with no login required. Or provide the mobile artifact (APK, AAB or IPA). For deeper coverage of authenticated flows, add test credentials before running a full scan.

CBN cybersecurity framework: assess your mobile banking app before and after every release.

The CBN Risk-Based Cybersecurity Framework and Guidelines for DMBs and PSBs ask supervised financial institutions to run yearly vulnerability assessments, a third-party penetration test at least once a year and internal vulnerability scans every quarter. The Operational Guidelines for Open Banking require periodic vulnerability scanning and penetration testing, MFA and OAuth 2.0 with OpenID Connect for API access. The NDPA 2023 requires security measures, regular testing of their effectiveness and breach notification within 72 hours. Ostorlab tests your app and the APIs behind it, behind login, on every release.

Assesses the mobile app and the APIs it calls, on the build your customers download
Tests login, one-time codes, step-up checks and session handling with your test accounts
Lists the SDKs and native libraries in each release and maps them to known vulnerabilities
Proves each finding with a replayable exploit or request and response evidence

Scan your own app Book a demo

Free scan of your app from the App Store or Google Play. No login required.

Who it applies to: Deposit money banks, merchant banks, non-interest banks and payment service banks supervised by the CBN, and the participants in the open banking and mobile money frameworks
Key dates: Cybersecurity framework issued 31 May 2024, effective 1 July 2024; open banking operational guidelines issued 7 March 2023; NDPA 2023 enacted 12 June 2023
Focus: Yearly vulnerability assessments, an annual third-party penetration test, quarterly internal scans, secure SDLC, MFA and 72-hour data breach notification
Main reference: CBN Risk-Based Cybersecurity Framework and Guidelines for DMBs and PSBs, 2024

Key dates

The Nigerian texts behind your mobile channel

The cybersecurity framework sits alongside the payments, mobile money and open banking texts, with the NDPA 2023 and the NDPC GAID 2025 on data protection. The dates below are for the texts cited on this page.

June 2020
Electronic payment channels
The CBN issues the Guidelines on Operations of Electronic Payment Channels in Nigeria, covering ATM, POS, mobile POS and web acceptance, with PCI DSS, PA-DSS and second factor authentication among the minimum standards.
February 2021
Open banking framework
The CBN issues the Regulatory Framework for Open Banking in Nigeria, setting data-sharing principles and requiring a common industry API standard.
July 2021
Mobile money framework and guidelines
The CBN issues the Framework and Guidelines on Mobile Money Services in Nigeria, replacing the 2015 texts, with transaction security standards for mobile money solutions in section 12 of the Guidelines.
7 March 2023
Open banking operational guidelines
The CBN issues the Operational Guidelines for Open Banking in Nigeria by circular PSM/DIR/PUB/CIR/001/043. Security standards, including periodic vulnerability scanning and penetration testing, are in Appendix III.
12 June 2023
NDPA 2023
The Nigeria Data Protection Act 2023 is enacted, with security of processing in section 39 and personal data breach notification within 72 hours in section 40.
31 May 2024
CBN cybersecurity framework
The CBN issues the Risk-Based Cybersecurity Framework and Guidelines for DMBs and PSBs 2024 by circular BSD/DIR/PUB/LAB/017/008, effective 1 July 2024. It replaces the October 2018 framework and considers BOFIA 2020 and the NDPA 2023.
March 2025
NDPC GAID 2025
The Nigeria Data Protection Commission issues the General Application and Implementation Directive 2025, with a data security schedule that includes vulnerability tests of databases and duties for data processing software such as mobile applications.
30 March 2026
CSAT deployment
The CBN deploys its Cybersecurity Self-Assessment Tool by circular, covering cybersecurity governance, risk management practices, technology and third-party risk controls, incident response and operational resilience.
1 July 2026
Instant payment guidance takes effect
The guidance on the operations of instant payment, issued 12 March 2026, takes effect: opt-in and opt-out flows must be protected with multi-factor authentication, institutions deploy real-time fraud monitoring, and a mobile banking app may be linked to one device at a time.

What the CBN asks

The CBN and NDPC rules, applied to your mobile app

For each rule: what the text says, what it means for a mobile banking app, how Ostorlab helps, and what stays with your team.

CBN Risk-Based Cybersecurity Framework and Guidelines for DMBs and PSBs, 2024, 2.2 and Appendix I, 1.2
Run yearly assessments, an annual third-party penetration test and quarterly scans
What the text says
Supervised financial institutions shall conduct yearly vulnerability assessments and threat analysis to detect and evaluate risk to their information assets and determine the appropriateness of security controls. A third party shall conduct a penetration test annually, at a minimum, and internal vulnerability scans are carried out quarterly. The baseline controls also require a vulnerability assessment of all IT assets, with the report presented to the Information Security Steering Committee and senior management at least once every quarter, a vulnerability assessment when there is a significant change to the information processing infrastructure or knowledge of new vulnerabilities, and automated vulnerability scanning tools where possible. External penetration tests on IT assets are required at least annually, and may be conducted more frequently on internet-facing financial systems and applications.
Source:CBN Risk-Based Cybersecurity Framework and Guidelines for DMBs and PSBs, 2024, 2.2 and Appendix I, 1.2
What it means for your mobile app
The annual third-party penetration test, the quarterly internal scans and the yearly assessment are minimums. Mobile banking is named in the same baseline controls as a platform to keep under continuous review.
How Ostorlab helps
Mobile SAST analyses the binary, including embedded SDKs, and Mobile DAST tests the running app; both run from your CI/CD pipeline. The AI-agent pentest tests the app and its APIs behind login, with a working exploit you can replay for each AI-agent finding.
What stays with you
The scope and frequency policy, the choice of the third party for the annual penetration test, server and network testing, and reporting to the ISSC and senior management.
CBN Risk-Based Cybersecurity Framework and Guidelines for DMBs and PSBs, 2024, Appendix I, 1.2(a), (b) and (h), and Appendix III, 1.9
Remediate to deadlines and keep patch compliance
What the text says
The framework requires responsibilities and timelines for remediation of identified vulnerabilities to be specified for different categories, security updates to be deployed promptly after thorough testing and in accordance with the patch management policy, confirmation that patches and security configurations have been applied successfully, and regular audits of the vulnerability remediation and patch application process with reports presented to senior management. The controls also require a vulnerability management policy approved by the Board, mechanisms to identify the patch compliance status of IT assets, and continuous identification of inherent risks and vulnerabilities in the platforms and protocols used for business services, such as USSD and mobile banking.
Source:CBN Risk-Based Cybersecurity Framework and Guidelines for DMBs and PSBs, 2024, Appendix I, 1.2(a), (b) and (h), and Appendix III, 1.9
What it means for your mobile app
A finding in the app or an API needs a category, an owner and a fix deadline, and the fix needs to be verified after it ships. The SDKs and libraries inside the app are software you patch.
How Ostorlab helps
SCA fingerprints statically compiled libraries and maps them to known vulnerabilities, release to release. Findings are rated critical, high, medium or low, tracked as tickets in the platform or in Jira and ServiceNow, and retested once the fix ships.
What stays with you
Patch windows, server and infrastructure patching, risk acceptance and the audit of the patch process.
CBN Risk-Based Cybersecurity Framework and Guidelines for DMBs and PSBs, 2024, Appendix III, 1.6(a) to (c)
Build security into the SDLC and test before and after release
What the text says
Cybersecurity controls must be considered and incorporated in all stages of the system or application lifecycle, and the business requirement for the acquisition or development of systems and applications must identify and document security requirements. Institutions must ensure secure coding practices and conduct regular security testing throughout the Software Development Life Cycle to identify and address vulnerabilities in applications and systems. Open-source code and libraries must be properly tested before use.
Source:CBN Risk-Based Cybersecurity Framework and Guidelines for DMBs and PSBs, 2024, Appendix III, 1.6(a) to (c)
What it means for your mobile app
Every app release is a change to an internet-facing channel. The requirement names open-source components explicitly, and most of a mobile app bundle is open source or third-party code.
How Ostorlab helps
Ostorlab runs automated scans from your CI/CD pipeline on every build and monitors store releases without manual triggers. Mobile SAST works on the APK, AAB or IPA, with no source code needed.
What stays with you
Security requirements, secure coding standards, manual reviews and release approval.
CBN Risk-Based Cybersecurity Framework and Guidelines for DMBs and PSBs, 2024, 2.3 and 3.1 with Appendix I, 1.2(g) and 1.4
Know the components in every release
What the text says
Institutions must establish mechanisms for maintaining an up-to-date inventory of authorised software and hardware as well as internal and external network connections, and keep a catalogue of connections to switches, third parties and wholesale customers. The framework also requires continuous identification of inherent risks and vulnerabilities in the platforms and protocols used for business services, and a third-party risk management framework that covers vendor selection, due diligence, contract negotiations, ongoing monitoring and incident response.
Source:CBN Risk-Based Cybersecurity Framework and Guidelines for DMBs and PSBs, 2024, 2.3 and 3.1 with Appendix I, 1.2(g) and 1.4
What it means for your mobile app
A mobile banking app bundles third-party SDKs that talk to their own backends. They belong in your inventory and in your third-party risk view, with the connections they open.
How Ostorlab helps
Ostorlab lists the SDKs and native libraries in each release with their versions and their location in the app bundle, and shows what the app and its SDKs exchange with backends over the network.
What stays with you
The asset ledger, third-party due diligence and contracts.
CBN Risk-Based Cybersecurity Framework and Guidelines for DMBs and PSBs, 2024, Appendix III, 1.1 and Appendix IV, 2(c)
Enforce MFA and manage access
What the text says
Access control policies must cover users, systems and service accounts, with least privilege, immediate revocation when a role changes or ends, and multifactor authentication, role-based access control and layered controls to secure employees, customers and third-party access to the institution's network, systems and applications. Authentication mechanisms must match the criticality and sensitivity of the system, and critical systems must use multi-factor authentication. Access is to be continuously validated using mechanisms such as zero trust to prevent the use of compromised credentials, and mechanisms for the automated recovery or blocking of compromised accounts must be implemented. The emerging technology controls repeat strong authentication, including MFA and biometrics, for adopted technologies.
Source:CBN Risk-Based Cybersecurity Framework and Guidelines for DMBs and PSBs, 2024, Appendix III, 1.1 and Appendix IV, 2(c)
What it means for your mobile app
The mobile app is a channel where customers and, at times, third parties reach banking systems. The second factor has to be enforced by the server on the key flows, whatever the app sends.
How Ostorlab helps
Authenticated testing covers login and logout, token refresh, timeouts, session invalidation and MFA enforcement, including step-up flows, together with the API calls behind them.
What stays with you
Choosing authentication methods, privileged access management, access reviews and device policy.
CBN guidance on the operations of instant payment, circular dated 12 March 2026, effective 1 July 2026 (summarised on the CBN Reforms and Initiatives page)
Apply the instant payment controls to the app
What the text says
The CBN guidance on the operations of instant payment, issued on 12 March 2026 and effective from 1 July 2026, provides that customers can voluntarily disable instant transfers on their accounts for any duration, and that the opt-in and opt-out processes must be protected with multi-factor authentication. Institutions are required to deploy real-time enterprise fraud monitoring systems and strengthen identity verification for online account opening and reactivation. A mobile banking app may only be linked to one device at a time, and when it is activated on a new device it carries a temporary N20,000 transaction limit for the first 24 hours.
Source:CBN guidance on the operations of instant payment, circular dated 12 March 2026, effective 1 July 2026 (summarised on the CBN Reforms and Initiatives page)
What it means for your mobile app
Device binding and the new-device limit are behaviours of the app and the backend together. MFA on the opt-out flow and fraud monitoring are controls you can test with real accounts.
How Ostorlab helps
Ostorlab tests MFA enforcement and step-up flows, including how attackers try to manipulate them, and tests the API calls behind device binding, account reactivation and transaction limits.
What stays with you
Deploying the fraud monitoring system, identity verification for account opening, and the customer communication around the new controls.
CBN Framework and Guidelines on Mobile Money Services in Nigeria, July 2021, Guidelines section 12, transaction security standards
Protect PINs and transaction messages in mobile money solutions
What the text says
Mobile money solutions must adhere to minimum transaction security standards: all transactions on an account shall be allowed only after authentication of the mobile number and the PIN associated with it; the mobile payments application shall not allow the option of saving the PIN either on the handset or on the application; the PIN shall not travel in plain text during the transaction; and the payment authorisation message from the user's mobile phone shall at a minimum be encrypted and checked for tampering by the scheme operator, so that an interceptor cannot change its contents. A security policy approved by the Board of Directors must exist, with separation between the security function and the IT division, periodic audit of adherence to the specified security standards, logical access controls, and a proxy or inspection firewall so that there is no direct connection between the internet and the operator's systems.
Source:CBN Framework and Guidelines on Mobile Money Services in Nigeria, July 2021, Guidelines section 12, transaction security standards
What it means for your mobile app
PIN handling and message integrity can be tested in the app and on the wire. A modified device or an intercepting proxy is exactly what the no-saved-PIN, no-plain-text and tamper-checking rules are about.
How Ostorlab helps
Ostorlab finds PINs, API keys, tokens and credentials in the app package and validates whether they work, intercepts traffic even with TLS pinning, and tests whether messages and one-time codes can be replayed or altered.
What stays with you
The security policy, segregation of duties, the firewall architecture and the periodic audit of the standards.
CBN Guidelines on Operations of Electronic Payment Channels in Nigeria, June 2020, 2.3, 3.4.1 and 4.3 to 4.5
Certify and lock down payment applications
What the text says
All industry stakeholders who process or store cardholder information must ensure that their terminals, applications and processing systems comply with the minimum requirements of PA-DSS, PCI PED, PCI DSS, Triple DES as the benchmark for data transmitted and authenticated between parties, and EMV. For web acquiring, gateway providers must comply with PCI DSS, PA-DSS, Triple DES and second factor authentication, and issuers must provide second factor authentication to cardholders who use their cards on the web channel, with authentication at a highly secured level requiring 2FA, plus behavioural monitoring and SMS or email alerts. For mobile POS, the acquirer must ensure the mPOS application is PA-DSS certified, apply effective patch and version control management for the mobile application, transmit payment data with end-to-end encryption, and lock down mPOS applications so that other applications on the device do not interact with, store or transmit payment data.
Source:CBN Guidelines on Operations of Electronic Payment Channels in Nigeria, June 2020, 2.3, 3.4.1 and 4.3 to 4.5
What it means for your mobile app
If your app accepts card payments or your agents use a payment app, the certification, patching, encryption and lockdown requirements apply to the application itself, not only to the terminal.
How Ostorlab helps
Ostorlab analyses the payment app binary for weak cryptography and hardcoded keys, checks what it stores and logs, and tests whether app protections such as root, tamper and pinning checks can be bypassed on a modified device.
What stays with you
PA-DSS, PCI DSS and EMV certification, the acquirer agreements and merchant device management.
CBN Operational Guidelines for Open Banking in Nigeria, March 2023, 9.3 and Appendix III, 4, 5.3.4 and 8
Secure and test the open banking APIs
What the text says
Participants in open banking must implement information security controls in line with the security standards: a board-level accountability for risk, regular threat assessments, strong passwords and access management applying multi-factor authentication, security assessment of new applications, processes or services before implementation, and quarterly review of access to data. Technical security requires MFA for access to API systems, role-based access control, authentication protocols at a minimum OAuth 2.0 with OpenID Connect, mutual authentication over TLS, digital tokens that keep a third party within the permissions granted, and customer revocation rights. Participants must conduct periodic vulnerability scanning and penetration testing of system security and remediate identified vulnerabilities in tandem with the severity of the open banking assets. Application security controls must be built into the SDLC for all open banking APIs and into CI/CD pipelines, in line with the OWASP API Security project and the OWASP Top Ten.
Source:CBN Operational Guidelines for Open Banking in Nigeria, March 2023, 9.3 and Appendix III, 4, 5.3.4 and 8
What it means for your mobile app
Open banking turns your app ecosystem into an API-sharing surface. Consent, tokens and authorisation between parties are the controls to test, alongside periodic scanning of the API platforms.
How Ostorlab helps
Ostorlab intercepts app traffic even with TLS pinning and tests the APIs for broken authorization (BOLA, BFLA, IDOR) and misuse of tokens, consent scopes and sessions, with request and response evidence for each finding, then retests after the fix.
What stays with you
Open Banking Registry obligations, the consent management platform, partner onboarding, gateway configuration and regulator returns.
Nigeria Data Protection Act 2023, sections 39 and 40; NDPC General Application and Implementation Directive 2025, Articles 29, 31 and 33
Meet the NDPA security and breach duties, including in the app
What the text says
The Nigeria Data Protection Act 2023 requires a data controller and data processor to implement appropriate technical and organisational measures to ensure the security, integrity and confidentiality of personal data, taking into account the amount and sensitivity of the data and the likelihood of harm. The measures may include pseudonymisation or de-identification, encryption, processes to ensure security, integrity, confidentiality, availability and resilience of processing systems, restoration of availability after a physical or technical incident, periodic assessments of risks to processing systems, regular testing, assessing and evaluating the effectiveness of the measures, and regular updating of the measures. A personal data breach likely to result in a risk to the rights and freedoms of individuals must be notified to the Commission within 72 hours. The NDPC General Application and Implementation Directive 2025 requires a schedule for monitoring, evaluation and maintenance of data security systems that includes vulnerability tests of databases, authentication checks and encryption reviews, and treats data processing software, including mobile applications, as subject to a DPIA before deployment, privacy by design and by default, and the data security guidelines of the app stores.
Source:Nigeria Data Protection Act 2023, sections 39 and 40; NDPC General Application and Implementation Directive 2025, Articles 29, 31 and 33
What it means for your mobile app
The Act asks for security measures and for regular testing that they work; the GAID puts mobile applications and the app store security guidelines in the same provision. Store releases are in scope of the privacy work.
How Ostorlab helps
Ostorlab looks for personal data in local storage, caches, logs and screenshots, checks transport protections, and gives you evidence of the controls it tested. What counts as a personal data breach, the 72-hour assessment and the notification stay with your DPO.
What stays with you
The DPIA, breach assessment and notification, the DPO, encryption and key management, and retention.

Summary of public CBN and NDPC texts, checked on 27 September 2026. The instant payment controls are summarised from the CBN circular of 12 March 2026 as described on the CBN Reforms and Initiatives page. This page is not legal advice.

Mapping

CBN and NDPC rules, control by control

The controls the Nigerian texts point to, how Ostorlab tests them in your app and its APIs, and the evidence you can keep.

CBN and NDPC rules, control by control
Control	How Ostorlab helps	Evidence you keep
Yearly vulnerability assessment and annual third-party penetration testFramework 2.2; Appendix I 1.2	AI-agent pentest of the app and its APIs, behind login, on the build you ship. Details	A working exploit you can replay for each AI-agent finding, and a coverage heatmap
Remediation deadlines, patch verification and reportingAppendix I 1.2(h); Appendix III 1.9	Groups findings into tickets in the platform or in Jira and ServiceNow, retests after the fix, and records when the fix shipped.	Ticket history and retest result for each finding
Secure SDLC and application security testingAppendix III 1.6(a) to (c)	Mobile SAST and DAST in CI/CD on every build, and monitoring of store releases. Details	Scan results per build and per store release
Third-party components, SDKs and network connections2.3; Appendix I 1.2(g) and 1.4	Lists the SDKs and native libraries in each release with their versions, and shows which backends the app and its SDKs talk to. Details	Component identity, version and location in the app bundle, per release
MFA, role-based access and zero trustAppendix III 1.1; Appendix IV 2(c)	Logs in with one-time codes and tests MFA enforcement and step-up flows, and the API calls behind them. Details	Findings on login and step-up flows, with reproduction steps
Device binding, opt-out MFA and new-device limitsInstant Payment guidance, 12 March 2026	Tests device binding, account reactivation and transaction limits through the APIs behind them, with one-time codes. Details	Request and response evidence for each control tested
PIN storage and transaction message integrityMobile Money Guidelines section 12	Finds PINs, keys and credentials in the app package and validates whether they work, and tests message replay and alteration. Details	Validated secrets, with the permissions and services they expose
Payment application certification, patching and lockdownE-Payment Channels 2.3, 3.4.1, 4.3 to 4.5	Tests root, jailbreak, tamper and pinning protections at runtime, and checks what the payment app stores and logs. Details	A hardening score, with bypass evidence for each protection that failed
Open banking API authorisation, consent and periodic testingOpen Banking Operational Guidelines, Appendix III 4, 5.3.4 and 8	Intercepts traffic even with TLS pinning and tests authorization, token misuse, consent scopes and abuse such as enumeration and replay. Details	Request and response evidence for each API finding
Personal data security, testing and breach evidenceNDPA ss.39 and 40; GAID Articles 29, 31 and 33	Looks for tokens and personal data in storage, caches, logs and screenshots, and checks transport protections. Details	File system evidence showing what was written, where and when

Ostorlab tests controls in the app and its APIs. Governance, SOC monitoring, incident response and reporting, industry cyber exercises, third-party management, backups and recovery, and physical security stay with your teams.

Action plan

CBN controls to test in your mobile app

A practical list for security and technology risk teams, based on the CBN cybersecurity framework, the open banking guidelines and the NDPA 2023.

Mobile app in scope
Put the mobile app in the scope of your vulnerability assessment and penetration testing procedures, with a frequency and a pre-release step.
Quarterly scans and the annual third-party test
Schedule internal scans every quarter and the third-party penetration test at least once a year, with more frequent external testing for internet-facing systems.
Components and fix deadlines
Keep a versioned list of the SDKs, libraries and network connections in each release, and set fix deadlines by severity.
Build and release testing
Run automated security testing on every build and scan each store release, not only the version you tested last quarter.
MFA and sessions
Verify that logins and key operations require the second factor on the server, and test token refresh, timeouts and session invalidation.
PINs, tamper and device binding
Check that the app never stores the PIN and never sends it in clear text, test the tamper and pinning protections, and test one-device binding and the new-device limit.
Open banking APIs
Test the APIs the app calls for broken authorization, token and consent scope misuse, and requests for other customers' data, and scan the API platforms periodically.
Report, retest and notify
Track findings to closure with retests, keep the CBN 24-hour cyber incident reporting path ready, and keep the NDPA 72-hour breach notification path ready with your DPO.

A suggested list, not a CBN template. The incident reporting and breach notification duties belong to your institution. This is not legal advice.

Platform

The capabilities behind this page

Each one has its own page with the details.

Trusted by banks and fintechs, including

4.8/5 on Gartner Peer Insights SOC 2 Type II audited

Sources

The official texts this page is based on, checked on 27 September 2026.

CBN Risk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Banks, 2024CBN, circular BSD/DIR/PUB/LAB/017/008 dated 31 May 2024, effective 1 July 2024. Vulnerability identification (2.2), third-party risk management (2.3), baseline controls including vulnerability management, application and data security and patch management (Appendix I 1.2, Appendix III 1.1, 1.6 and 1.9), and emerging technology controls (Appendix IV)
Framework and Guidelines on Mobile Money Services in NigeriaCBN, July 2021. Replaces the 2015 framework and guidelines. Transaction security standards in section 12 of the Guidelines, risk management in section 14 and technology in section 15
Guidelines on Operations of Electronic Payment Channels in NigeriaCBN, June 2020. Minimum standards for ATM, POS, mobile POS and web acceptance services: PA-DSS, PCI PED, PCI DSS, Triple DES and EMV (2.3), mobile POS application requirements (3.4.1), and web acceptance including 2FA (4.3 to 4.5)
Operational Guidelines for Open Banking in NigeriaCBN, approved March 2023 and issued by circular PSM/DIR/PUB/CIR/001/043 dated 7 March 2023. Information security (9.3), shared information framework and consent (11), API standards (Appendix 1) and security standards including periodic vulnerability scanning and penetration testing and application security (Appendix III)
Regulatory Framework for Open Banking in NigeriaCBN, February 2021. Data and service access governance, guiding principles for API specifications, risk management and customer rights
Instant payment guidance and CSAT deploymentCBN, circular on the operations of instant payment dated 12 March 2026 and effective 1 July 2026, and deployment of the Cybersecurity Self-Assessment Tool by circular dated 30 March 2026, as described on the CBN Reforms and Initiatives page
Nigeria Data Protection Act 2023Act No. 37, enacted 12 June 2023. Security, integrity and confidentiality of personal data (section 39), personal data breaches and the 72-hour notification (section 40), and cross-border transfers (sections 41 to 43)
NDP Act General Application and Implementation Directive (GAID) 2025Nigeria Data Protection Commission, NDPC/NDP ACT-GAID/01/2025, March 2025. Monitoring, evaluation and maintenance of data security systems including vulnerability tests of databases (Article 29), deployment of data processing software including mobile applications (Article 31) and data breach notification (Article 33)

FAQ

Frequently asked questions

Straight answers on coverage, setup, and how results reach your team.

Can't find your answer? Book a demo or contact us.

Yes. The framework states that it represents the minimum requirements to be put in place by all DMBs and PSBs in their cybersecurity programmes, and the circular sets 1 July 2024 as the effective date for full compliance. The CBN monitors compliance through annual cybersecurity supervisory review and evaluation exercises, risk-based examinations, industry compliance audits and periodic spot checks, and non-compliance attracts sanctions under BOFIA 2020.
The framework names mobile banking among the platforms and protocols whose inherent risks and vulnerabilities institutions must continually identify, sets secure coding and security testing requirements for applications throughout the SDLC, and applies MFA to customer access and critical systems. The mobile money guidelines set transaction security standards for mobile payments applications, the electronic payment channels guidelines cover mobile POS and web applications, and the open banking guidelines cover the APIs and the apps behind them.
The framework requires a yearly vulnerability assessment and threat analysis, internal vulnerability scans every quarter, and a penetration test by a third party annually at a minimum. Within the baseline controls, a vulnerability assessment of all IT assets is reported to the ISSC and senior management at least once every quarter, and external penetration testing is required at least annually, and may be more frequent on internet-facing systems and applications. The open banking security standards require periodic vulnerability scanning and penetration testing of system security.
The framework does not set a single number of days in the document. It requires institutions to specify responsibilities and timelines for the remediation of identified vulnerabilities for different categories, to deploy security updates promptly after testing in line with their patch management policy, to confirm that patches and configurations were applied successfully, and to audit the process and report to senior management. The open banking security standards require remediation in tandem with the severity of the asset. Your institution sets the numbers and must be able to show them.
Ostorlab is a third party and tests the app and its APIs behind login, with a working exploit or request and response evidence for each finding, and retests after the fix. Whether that covers your annual penetration test, or complements a manual one, is your institution's call. The framework also asks for testing of servers, networks and other assets, and for participation in industry cyber exercises, which stay outside Ostorlab's scope.
The Act requires technical and organisational measures to keep personal data secure, and measures that include encryption, de-identification, periodic risk assessments and regular testing of the effectiveness of the measures. The NDPC GAID 2025 treats data processing software, including mobile applications, as subject to a DPIA before deployment, privacy by design and by default, and the data security guidelines of the app stores. A breach likely to result in a risk to rights and freedoms must be notified to the Commission within 72 hours. Ostorlab tests the technical controls and gives you evidence; the assessment and the notification stay with your DPO.
Ostorlab does not have a Nigerian region. On-premises scanning keeps the scan on infrastructure you control, inside your network and inside the country. On the Enterprise plan you can choose one of the available regions, but the NDPA restricts transfers of personal data outside Nigeria unless an adequacy decision applies or another basis under sections 41 to 43 is met, so check with your compliance team. Ostorlab is SOC 2 Type II audited, and the details are in the Trust Center.

Assess your mobile banking app the way the CBN describes it

Start with a free scan of your app from the store, or book a demo to run logged-in tests of your app and APIs with our team.

Scan your own app Book a demo

CBN cybersecurity framework: assess your mobile banking app before and after every release.

The Nigerian texts behind your mobile channel

Electronic payment channels

Open banking framework

Mobile money framework and guidelines

Open banking operational guidelines

NDPA 2023