Cybercrimes Act 2015

Establishes National Cybersecurity Fund for capacity building and mandates financial institutions to implement comprehensive transaction monitoring systems.

JurisdictionNigeria
CategoryCybersecurity
StatusActive
Latest development

Analysis

Key Requirements

The Cybercrimes Act 2015 establishes several key requirements for organizations in Nigeria:

  • Establishment of a National Cybersecurity Fund: The Act mandates the creation of a fund to support cybersecurity initiatives and capacity building. Financial institutions are required to contribute 0.005% of all electronic transactions,%20act%202015%20collection%20and%20remittance%20of%20levy%20for%20the%20national%20cybersecurity%20fund.pdf) to this fund.

Compliance Challenges

Organizations face several challenges in complying with the Cybercrimes Act:

  • Lack of Cybersecurity Expertise: Many organizations struggle to find and retain qualified cybersecurity professionals to implement required controls. A 2021 study by ISC2 found a global shortage of over 3 million cybersecurity professionals.
  • Cost of Compliance: Implementing comprehensive transaction monitoring systems and other required controls can be expensive, especially for smaller institutions. The Nigerian Fintech Association has highlighted this as a key challenge for its members.
  • Evolving Threat Landscape: Cybercriminals constantly develop new attack methods, making it difficult for organizations to keep pace. The Nigerian Cybercrime Working Group regularly publishes alerts on emerging threats.

Implementation Best Practices

To effectively implement the Act's requirements, organizations should:

  • Conduct Regular Risk Assessments: Perform comprehensive cybersecurity risk assessments at least annually. The NIST Cybersecurity Framework provides a solid foundation for this process.
  • Implement a Security Information and Event Management (SIEM) System: A SIEM tool can help monitor and analyze security events across an organization's infrastructure. Gartner's Magic Quadrant for SIEM evaluates leading solutions.
  • Provide Ongoing Security Training: Regularly train employees on cybersecurity best practices and awareness. KnowBe4 offers a comprehensive security awareness training platform.

Recent Updates

The Cybercrimes Act has seen some recent updates:

Related Regulations

The Cybercrimes Act interacts with several other Nigerian regulations:

  • National Information Technology Development Agency (NITDA) Guidelines: NITDA has issued several guidelines that overlap with the Cybercrimes Act, particularly regarding data protection and cybersecurity standards.

Industry Impact

The Cybercrimes Act has had significant impacts on various industries:

  • Financial Services: Banks and fintech companies have had to invest heavily in cybersecurity infrastructure and personnel. The Nigerian Inter-Bank Settlement System (NIBSS) reports a significant decrease in electronic fraud since the Act's implementation.
  • Telecommunications: Telecom providers have faced increased scrutiny and compliance requirements. The Nigerian Communications Commission (NCC) has issued additional guidelines to help telecom companies comply with the Act.
  • E-commerce: Online retailers have had to enhance their security measures and customer data protection practices. The E-Commerce Association of Nigeria (ECAN) provides resources to help members navigate these requirements.

Sources

Recent developments

  • — Technology Times reports that six Nigerian civil society organisations have urged President Tinubu to further amend the Cybercrimes Act 2015, warning that despite the 2024 amendment, vague provisions in the law are still used to restrict press freedom and expression under Section 39 of the Constitution.[1] (source)
  • — The ICIR quotes human rights lawyer Femi Falana stating that arresting journalists for “cyberstalking,” “insult” or “causing annoyance” under Section 24 of the Cybercrimes Act 2015 is now illegal, because those offences were repealed and replaced by Section 5 of the 2024 Amendment Act.[2] (source)
  • — The Guardian Nigeria feature on the Cybercrimes Act 2015 highlights ongoing calls from legal and industry stakeholders for “urgent amendment” to improve effectiveness, balance enforcement with rights protection, and strengthen prevention rather than only punishment.[3] (source)
  • — TVC News reports that the Nigeria Union of Journalists has called for a review of the Cybercrime Act 2015, arguing that its provisions are being used against media practitioners and need to be aligned with constitutional guarantees of freedom of expression.[8] (source)
  • — Abe LP’s legal review explains that the 2024 Amendment Act is intended to close loopholes in the Cybercrimes Act 2015, broaden liability to employees in all sectors, modernise provisions on electronic signatures and payment technologies, and impose stricter obligations such as quarterly vulnerability assessments and mandatory NIN-based verification.[5] (source)
  • — The same review details key industry impacts, including expanded offence coverage for ATM/POS and mobile payment manipulation, reporting through sectoral CERTs or SOCs within 72 hours, and new compliance burdens on organisations across banking, telecoms, and other critical sectors.[5] (source)
  • — Technology Times reports concerns that exclusive Federal High Court jurisdiction under Section 50 of the Cybercrimes Act 2015 is overburdening the court system, with legal experts warning that this structure complicates timely prosecution of cybercrime cases and may need reform.[9] (source)
  • — BBC News Pidgin fact-checks viral claims of a “Cybercrimes Act 2025,” clarifying that no such law exists and that the operative statute remains the original Cybercrimes Act 2015 as amended by the 2024 Act, which among other things targets platforms that fail to remove certain offensive content but does not criminalise social media group administrators.[6] (source)
  • — Digital Policy Alert notes that President Tinubu signed the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act 2024 into law, expanding the 2015 Act’s scope to all public and private organisations, shortening cybersecurity incident reporting to 72 hours, and clarifying criteria for cybercrimes including harmful pornographic and false content.[4] (source)
  • — WIPO’s legislation database records formal assent to the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act 2024 on 28 February 2024, establishing it as the latest binding update to Nigeria’s Cybercrimes Act 2015 framework.[7] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates