Nigeria's cyber law rewrite will not secure systems on its own

What happened

Nigeria is reviewing its cybersecurity laws because AI is making fraud, deception and attacks on critical infrastructure harder to spot. TechCabal reports that AI was linked to 55% of cybercrime incidents recorded across Africa last year, and that deepfake cases rose sevenfold between the second and fourth quarters of 2024. The government accepts that current frameworks do not offer adequate guardrails or match international best practice. Reform is moving on three tracks: the Cybercrimes Act 2015, amended in February 2024; the National Cybersecurity Policy and Strategy, which was revised in 2021 and is due for review in 2026; and the proposed National Digital Economy and E-Governance Bill 2025, which went to public hearing in November 2025. A national cybersecurity architecture setting baseline standards for organisations is also under consideration. The chair of the House Committee on ICT and Cybersecurity expects the cybercrime, cybersecurity and digital economy bills to be enacted between January and June 2027, after the election period.

The pressure comes from real losses and exposures. Nigeria lost ₦25.85 billion to electronic payment fraud in 2025, and the Central Bank of Nigeria warned banks, fintechs and payment providers in September 2026 that cyber and AI-driven risks threaten financial stability. The data protection regulator fined MultiChoice Nigeria ₦766.24 million and opened investigations into 1,369 organisations, while the EFCC examined a ₦3 billion fraud against First City Monument Bank customers. Public bodies have also been exposed. Suspicious voter records reached the electoral commission's database through authorised terminals run by its own officials, the Corporate Affairs Commission suffered a breach involving more than 15 million documents, and a misconfigured cloud storage bucket leaked nearly three terabytes of Remita financial data. TechCabal's warning is that without better enforcement, hardened infrastructure and local expertise, the reforms could widen state surveillance powers without making the digital economy safer.

Why it matters for organisations in Africa, the Gulf and beyond

For organisations across Africa, the Gulf and beyond, the lesson is not specific to Nigeria. Legislation tends to follow incidents, and it moves more slowly than attackers. Many of the failures in this story were not exotic: an insider-operated access point, a cloud bucket left open, a fraud scheme built on unauthorised account access. No new statute fixes these. They are problems of access control, configuration, monitoring and ownership, and they sit inside the organisation.

The second point is that AI changes the economics of attack. Automated scams, synthetic identities and faster discovery of weak systems lower the cost for criminals, so defenders must detect and respond faster, not only comply on paper. Any region digitising public services and payments faces the same tension. Every new portal and integration adds data, users and failure modes, and the controls must be designed in from the start.

Third, baseline standards, if Nigeria adopts them, will tend to raise expectations of boards and suppliers well beyond one border. Regional groups with operations in several markets should expect more scrutiny of how they govern data, test their controls and prove who owns each risk. Organisations that treat the legal reviews as a signal and prepare now will be better placed than those who wait for final text. Evidence of working controls will be worth more than a policy document.

What leaders should do now

Leaders can act now on the weaknesses behind these incidents without waiting for the final text of any law.

• Review who can add or change records in critical systems, and monitor privileged and staff activity as closely as external traffic.
• Audit cloud storage and configurations for public exposure, and give every environment a named owner.
• Test fraud and identity controls against AI-enabled deception, including deepfakes and synthetic identities.
• Map current controls to the data protection and cybersecurity obligations that already apply, and track proposed reforms as they develop.
• Rehearse incident response with executives, so a breach becomes a managed incident rather than a crisis.

How DAAKYI can help

DAAKYI applies one model, GUIDE, SECURE, OPERATE, across IT, cloud, data privacy and other domains of cyber defence. GUIDE helps leadership set priorities and map legal obligations to the controls that matter. SECURE engineers the fixes, including identity and access management and cloud security, tests every deployment and hands knowledge over to your teams. OPERATE sustains detection, response and recovery once the controls are live.

Our view is that a security tool is not a control until it is tuned, monitored and owned. Reform will set expectations, but resilience depends on the day-to-day engineering and operations behind them. DAAKYI Cyber Academy also supports workforce awareness and executive readiness, delivered with training partners.

• regulatory assurance
• identity and access management
• cloud security engineering

Sources

• Nigeria is rewriting its cyber laws, but can it secure its systems against hackers? (TechCabal)