Artificial Intelligence (AI), driven attacks on the Nigerian financial sector surged 150% last year, according to Lanre Ogungbe, chief executive officer of Prembly, a cybersecurity company that builds digital identity verification, compliance and security infrastructure for financial institutions.
In Nigeria’s instant-settlement environment, systems have only seconds to distinguish a legitimate human user from an AI-driven bot before a fraudulent transaction is cleared.
To combat the threat, the Federal Government of Nigeria is moving to implement a comprehensive Cybersecurity Framework in 2026, a direct response to a “pandemic” of high-tech fraud.
With AI-driven attacks on the financial sector surging 150% and the country losing an estimated $500 million annually to cybercrime, the National Information Technology Development Agency (NITDA) and the Central Bank (CBN) are tightening the noose on digital bad actors.
This new framework marks a shift from passive “guidelines” to enforceable operational requirements, focusing on the speed and sophistication of modern machine-learning threats.
The AI Arms Race: Why Current Defenses Are Failing
Experts warn that Nigeria’s “Instant Payment” success has become its biggest vulnerability. AI is being used to exploit the seconds-long window between a transfer and its completion:
-
Hyper-Personalized Phishing: Attackers now use AI to scrape social media and craft messages that convincingly mimic bank CEOs or regulators, bypassing traditional “bad grammar” filters.
-
Near-Real-Time Exploitation: In Nigeria’s instant-settlement environment, systems have only seconds to distinguish a legitimate human user from an AI-driven bot before a fraudulent transaction is cleared.
-
Automated Weakness Scanning: AI tools are now widely available to criminals, allowing them to scan thousands of bank and fintech APIs simultaneously to find a single unpatched entry point
Core Pillars of the 2026 Framework
The proposed framework, as outlined by NITDA Director-General Kashifu Inuwa Abdullahi, introduces several “hard” requirements for Nigerian companies:
-
Minimum Spending Thresholds: Organizations in critical sectors (Banking, Telecoms, Energy) will be required to allocate a specific percentage of their annual budget strictly to cybersecurity.
-
Mandatory Breach Reporting: Companies must report cyber incidents within a strict, narrow timeframe (often 24–72 hours) to a central National Cybersecurity Coordinating Center (NCCC).
-
Threat Intelligence Sharing: For the first time, private sector banks and public agencies will be legally required to share real-time data on active “threat vectors” to prevent the spread of cross-bank breaches.
-
Board Accountability: Cybersecurity is being moved from the IT basement to the boardroom. Directors and CEOs will be held personally accountable for failed risk management protocols.
The “Japa” Talent Gap
A major obstacle remains the “Japa syndrome”—the massive exodus of cybersecurity talent to Europe and North America.
-
Expertise Shortage: Nigeria faces a critical shortage of professionals who can build “AI for Defense” to counter “AI for Attack,” according to Buki Ogunsakin, head of Satoshi BBO Solicitors.
-
Deloitte Outlook: Deloitte predicts that 2026 will be the year of “Human–AI Hybrid Defense,” where organizations must use AI to prioritize alerts while humans provide the final judgment for complex incident responses.
“Regulation moves slower than innovation in tech,” Ogunsakin said. “Technology moves very fast and regulation and regulator usually have to play the catch-up game. We find that where for instance there is no specific regulation for certain kinds of crime, we’re not able to curb it.”
Follow the MoneyCentral Nigeria channel on WhatsApp: Click here!
