Nigeria: Cloud in Financial Services

The current financial services industry in Nigeria is characterized by a cohesive regulatory regime, with the Central Bank of Nigeria (the "CBN") being the major regulator for banks pursuant to the Central Bank of Nigeria Act, 2007. Other financial institutions, including those in the capital markets and the insurance sectors, pension funds and collective investment schemes are supervised by separate market regulators.

• Who is the regulator?

  Currently, the banking industry in Nigeria is regulated by the CBN, the insurance industry by National Insurance Commission, and the pension industry by the National Pension Commission. The Security and Exchange Commission however has overarching responsibility for financial institutions other than banks, such as capital markets, primary investment of pension funds and collective investment schemes.

• Are cloud services permitted?

  Cloud services are in principle permitted.

• What are the sector-specific laws and guidelines that need to be considered?

  There is presently no specific regulation for cloud services in Nigeria.

  For a bank, with respect to its move to the cloud, the following should (in addition to its other regulatory and compliance obligations⁵) be noted:

  1. Outsourcing rules: There are presently no specific rules regulating outsourcing of banking operations in Nigeria;
  2. (ii) banker-client confidentiality: A bank must maintain client confidentiality in respect of customer information. Banking secrecy covers information relating to the customer's account, the customer's transactions with the bank and information relating to the customer acquired through the keeping of his account. The duty to respect privacy and confidentiality is recognised under Nigerian law as a right to which a bank customer is entitled; and
  3. (iii) the CBN recommends that a bank complies with its IT Standards Blueprint.⁶

  The Nigerian Insurance Act currently does not regulate outsourcing by insurers.

  A move to the cloud by a bank or insurer will likely remain subject to the following key principles: (i) the financial institution remains responsible for the function (ii) the arrangement must not compromise the services provided to clients; (iii) privacy and (iv) the services must be regularly monitored.

• Is approval needed?

  Generally, approval is not required.

• What are the audit / inspection requirements?

  A bank must at all times be able to provide the CBN with necessary information and ensure the right of the CBN to carry out its supervisory functions and objectives, including the right to access information and on-site visits if the CBN considers necessary

• What are the data transfer requirements?

  Under the National Information Technology Development Agency Guidelines on Data Protection (the "Draft Guidelines"), personal information may be transferred out of Nigeria provided the requirements of the Draft Guidelines are met.⁷ The Draft Guidelines will permit the transfer of personal information outside Nigeria where adequate provisions are in place for its protection. This could take the form of legislation or contractual provisions which ensure adequate protection of personal information or could be sanctioned by consent of the data subject.

  Microsoft holds itself accountable to and is subject to laws of general application applicable to information technology service providers, and has binding agreements which, in our view, provide adequate protection. In addition, Microsoft adheres to the EU Model Clauses as well as the EU Privacy Shield and the ISO 27018 Privacy Standard. Microsoft also ensures compliance with the EU General Data Protection Regulation (GDPR) which came into force in May 2018.

• Footnotes

  ¹ In the Nigerian Banking Industry Information Technology Standards Blueprint issued by the CBN (paragraph 6.1.1), it notes that benefits can include cost efficiencies, an elastic utility computing environment that supports on-demand scalability, convenience and continuous availability, back-up and recovery, and storage capacity.
  ² Central Bank of Nigeria Guidelines on Mobile Money Services in Nigeria
  ³ Central Bank of Nigeria Regulatory Framework for Banks Verification Number Operations in Nigeria
  ⁴ Some of the risks noted by the CBN include risks of security, privacy, dependency, vulnerability and downtime (see Nigerian Banking Industry Information Technology Standards Blueprint issued by the CBN, paragraph 6.1.1).
  ⁵ Including under the Consumer Protection Framework.
  ⁶ Nigerian Banking Industry Information Technology Standards Blueprint issued by the CBN, which sets out the CBN's recommended framework and standards, and offers guidelines for a bank in relation to its engagement of information technology vendors and service providers.
  ⁷ Paragraph 4.1.8 of the National Information Technology Development Agency Draft Guidelines on Data Protection in Nigeria