CBN Proposes Guidelines for Financial Institutions to Share Customers’ Data

Central Bank of Nigeria (CBN) has proposed guidelines that would usher in an ‘open banking‘ era in the country, a key step in creating a standard for how companies exchange digital financial data belonging to consumers.

The CBN in a draft document that became public on May 18 stipulated that financial institutions share cyber security breaches, a move that has been called for so many times in the industry to combat fraud and activities of cyber criminals.

The draft highlighted that financial institutions are to implement appropriate security measures, establish incident management procedures as well as report major security incidents without undue delay to the competent authorities.

“The security incidents reporting obligations should be without prejudice to other incident reporting obligations laid down in other regulations including the CBN Risk-Based Cybersecurity Framework.

“In the case of a major operational or security incident, participants shall without undue delay, notify the CBN and other relevant stakeholders, of the incident and remediating measures, and upon receipt of the notification, the CBN and other stakeholders shall assess the incident with respect to the ecosystem and where appropriate, take necessary measures to protect safety and stability of the financial system,” the document read.

According to the CBN, the operational guideline for open banking is part of its efforts to enhance competition and innovation in the banking system, adding that, it recognised the existence of an ecosystem for Application Programming Interface (API) in the banking and payments system and is aware of various efforts to develop acceptable standards among stakeholders.

“The Regulatory Framework for Open Banking in Nigeria established principles for data sharing across the banking and payments system to promote innovations and broaden the range of financial products and services available to bank customers.

“As a result, open banking recognises the ownership and control of data by customers of financial and non-financial services, and their right to grant authorisations to service providers for the purpose of accessing innovative financial products and services. This is anticipated to drive competition and improve accessibility to banking and payments services.

“Participants in open banking shall adhere strictly to security standards when accessing and storing data, and shall be subject to minimum privacy standards, operational standards, risk management standards and customer experience standards as prescribed by the bank,” it added.

Most notably adopted in the UK, open banking is the idea that the easy exchange of consumer data between financial and non-financial companies, with consumers’ consent, is necessary to create more useful and competitive consumer services.

Data is exchanged through application programming interfaces (APIs)—software programs that act as digital plugs for requesting and transferring data.

For instance, retailers like Jumia that meet regulatory requirements can connect to a bank’s customer data (at an agreed fee) to get information that could inform buy-now-pay-later decisions or new services. Same applies for banks seeking retailer customers’ data.