SEC Sets November 5 Deadline for Cybersecurity Risk Assessment Reports by Capital Market Operators

The Securities and Exchange Commission (SEC) has directed all capital market operators (CMOs) in Nigeria to submit their cybersecurity risk assessment reports on or before Thursday, November 5, 2026, as part of broader efforts to strengthen the protection of the country’s financial system against cyber threats.

The directive, contained in a circular issued by the commission, requires affected operators to complete a cybersecurity assessment form through the Cybersecurity Module on the SEC’s electronic portal.

The regulator said the exercise was designed to strengthen cybersecurity risk management and resilience across the financial sector, while providing authorities with the information needed to assess the sector’s exposure to digital threats.

SEC stressed that all affected entities must ensure their submissions accurately reflect their current cybersecurity risk profiles, underscoring the importance of up-to-date information in identifying vulnerabilities and developing appropriate regulatory responses.

“All CMOs are required to complete the assessment form on the Cybersecurity Module on the Commission’s e-Portal on or before November 05, 2026,” the commission stated.

“All affected entities are required to ensure that their submissions reflect their current cybersecurity risk profiles.”

The deadline places responsibility on capital market operators to review their existing cybersecurity arrangements, identify potential weaknesses and provide the regulator with relevant information about their exposure to cyber risks.

The exercise comes amid increasing reliance on digital infrastructure in financial transactions, securities trading, investment management and other capital market activities.

Sector-Wide Cybersecurity Framework

The assessment is being conducted through the Inter-Agency Cybersecurity Technical Working Group of the Financial Services Regulation Coordinating Committee (FSRCC), which is coordinating initiatives aimed at improving cybersecurity preparedness throughout the financial services industry.

According to the SEC, the initiative goes beyond gathering information from individual operators. It is part of a broader programme to establish a strategic cybersecurity risk management framework for the entire financial sector.

The programme includes conducting a comprehensive assessment of cybersecurity risks across financial institutions, identifying existing and emerging cyber threats, and determining vulnerabilities that could expose the industry to attacks or operational disruptions.

It also seeks to develop and promote appropriate cybersecurity frameworks, standards and guidelines to improve the ability of financial institutions to protect their digital infrastructure.

Another major component is the promotion of information sharing among financial sector regulators, financial institutions, law enforcement agencies, critical infrastructure operators and other relevant stakeholders.

The commission said the initiative would also strengthen coordination and response mechanisms for significant cyber incidents affecting the financial sector.

These measures are expected to improve cooperation among institutions and regulators, particularly in situations where cyberattacks could affect multiple organisations or disrupt critical financial services.

Growing Digital Exposure In Financial Services

The SEC’s directive reflects the growing importance of cybersecurity as Nigeria’s financial services industry continues to expand its use of digital technologies.

Capital market operators increasingly depend on electronic platforms for securities trading, investment transactions, client onboarding, portfolio management, record-keeping and communication with investors.

The increasing digitisation of these activities has improved efficiency, widened access to investment opportunities and reduced the limitations associated with traditional market operations.

However, the same digital transformation has created new vulnerabilities, making financial institutions potential targets for cybercriminals seeking to exploit weaknesses in information systems.

Cybersecurity risks can include unauthorised access to investor accounts, data theft, ransomware attacks, system disruptions, identity fraud and the compromise of confidential financial information.

A successful attack on a capital market operator could potentially affect not only the institution involved but also investors, counterparties and other interconnected market participants.

For a market dependent on investor confidence, the consequences of such incidents could extend beyond immediate financial losses to include reputational damage, operational disruption and concerns about the security of investment transactions.

The sector-wide assessment is therefore expected to help regulators obtain a clearer picture of the cybersecurity challenges confronting operators and identify areas requiring greater attention.

Investor Confidence And Market Stability

Cybersecurity has become an increasingly important component of financial market stability and investor protection.

Investors depend on capital market institutions to safeguard their personal information, financial assets and transaction records. Any compromise of these systems could undermine confidence in the market.

The SEC’s initiative is significant because it recognises that cybersecurity threats cannot be effectively addressed through isolated efforts by individual institutions alone.

A coordinated approach involving regulators, financial institutions, law enforcement agencies and critical infrastructure operators could improve the industry’s ability to identify threats early, exchange relevant information and respond more effectively to cyber incidents.

The development of common cybersecurity standards and guidelines could also encourage greater consistency in the way operators assess and manage risks.

For smaller capital market operators, the exercise could provide an opportunity to identify gaps in their cybersecurity arrangements and strengthen their internal controls.

The accuracy of the information submitted by operators will be particularly important. An assessment based on outdated or incomplete information could undermine the regulator’s ability to identify systemic vulnerabilities and develop appropriate interventions.

Regulatory Oversight And Compliance

The directive reinforces the SEC’s regulatory responsibility to promote an orderly, transparent and resilient Nigerian capital market.

By requiring operators to submit current cybersecurity risk profiles, the commission is seeking to improve its understanding of the operational risks confronting institutions under its supervision.

The exercise could provide the foundation for more targeted cybersecurity guidance, improved regulatory oversight and stronger coordination across the financial services industry.

Capital market operators are consequently expected to treat the submission as an important regulatory compliance requirement rather than a routine administrative exercise.

The SEC has provided the Cybersecurity Module on its electronic portal for the submission of the assessment forms.

The commission also provided a dedicated portal for the exercise: SEC Cybersecurity Assessment Portal.

Operators requiring clarification were directed to contact the commission through its cybersecurity support channels.

As Nigeria’s financial sector becomes increasingly interconnected and technology-driven, the effectiveness of cybersecurity arrangements will remain central to protecting investors, maintaining market confidence and ensuring the uninterrupted delivery of financial services.

The SEC’s assessment initiative represents a coordinated effort to strengthen the industry’s preparedness for emerging cyber threats and improve the resilience of Nigeria’s financial system.