THE NEW CYBER CRIME ACT 2025 BILL IN NIGERIA: For Fintechs, SMEs & social media players

THE NEW CYBER CRIME ACT 2025 BILL IN NIGERIA

For Fintechs, SMEs & social media players

Nigeria’s digital transformation has been nothing short of rapid—but as our online environment deepens, so too do the threats. Amid growing cyberattacks on banks, telecoms, public agencies, and citizens, the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act 2024 emerged into law in February 2024 to strengthen the 2015 framework Mondaq+1. While technically a 2024 law, it's widely seen as the foundational step toward a broader Cybercrime Act 2025. Here’s why it matters — especially for companies — and what’s key to monitor going forward.

Why It Matters—and Why You Should Care

Think of this law as your digital safety net. Whether you're a fintech startup, an SME using WhatsApp groups to sell, or a community influencer on Instagram, these rules are now part of your everyday.

• Protect your brand trust: A cyber incident doesn’t just cost money—it erodes customer confidence.
• Stay legally safe: Missing a 72-hour breach report or ignoring NIN/KYC rules can lead to steep fines.
• Stay nimble and future-proof: The Act adapts to emerging threats—from mobile payments to social platforms.

Let’s pause the jargon and outline how this impacts YOU—based on helpful legal insights:

Why This Act Is Essential for Companies

• Protecting Corporate Assets: Banks and fintechs lost over ₦1.1 trillion between 2017–2023, with a single 2024 attack stealing ₦53.4 billion Vanguard NewsNigeria World. Robust legal deterrents help shield both businesses and customers from growing cyber threats.
• Operational Continuity: Cyberattacks erode trust in digital banking, pushing Nigerians back to cash and slowing financial inclusion Vanguard NewsNigeria World. A solid cyber-law helps maintain seamless, trusted digital operations.
• Accountability & Responsibility: The Act enforces quick reporting of breaches and penalties for non‑compliance—driving businesses to invest in cybersecurity and incident-readiness Daily Trusttechhiveadvisory.africa.
• Legal Clarity and Compliance: Clear definitions around offenses like fraud, cyberstalking, and data misuse help companies establish better compliance and internal training THISDAYLIVETechpoint Africa.

Key Provisions & Important Points in the Amendment

1. Faster Reporting of Breaches

   • Cyber incidents must now be reported to ngCERT within 72 hours, down from 7 days. Failure leads to loss of internet access and a ₦2 million fine to the National Cybersecurity Fund Daily Trusttechhiveadvisory.africa.
   •  

   Incident Reporting in 72 Hours
   Anyone detecting a cyber intrusion must alert the appropriate sector-specific CERT or SOC within 72 hours—or risk a ₦2 million fine and possible internet denial. hamulegal.comabe-lp.comGlobal Practice Guides

2. Broader Scope for Offenses

   • Fraud provisions now apply to all employees of public or private organizations—not just those in financial roles Daily Trusttechhiveadvisory.africa.
   • Payment systems language expanded beyond just ATMs/POS to include any emerging payment technologyDaily Trusttechhiveadvisory.africa.
   •  

   0.5% Cybersecurity Levy
   Every electronic transaction triggers a 0.5% deduction, remitted monthly into the National Cyber Security Fund. Failure means fines (2% of turnover), or even license revocation. hamulegal.comMondaqRalph-Malix Legal Consult

3. National ID for Transactions (NIN for KYC)
   Financial institutions must collect NIN (and BVN) before opening or operating accounts, or face fines up to ₦5 million. hamulegal.comabe-lp.com
   •  

4. Establishment of CERTs and SOCs

   • Sectoral CERTs and Security Operation Centers (SOCs) now support ngCERT, with internet/data traffic channeled through these to enhance detection and response Daily Trusttechhiveadvisory.africaMondaq.
   •  

   Wider Scope of Identity Theft & Fraud Liability
   All sectors (not just banks) now have liability for identity fraud or impersonation—creating personal accountability. hamulegal.comabe-lp.com

5. Cybersecurity Levy Enhanced

   • A 0.5% levy on electronic transactions fuels the National Cybersecurity Fund. Noncompliance can lead to fines (at least 2% of annual turnover) or even business license revocation Daily TrustMondaq+1techhiveadvisory.africa.
   •  

   Cyberstalking Redefined—Sharper and Fairer
   Only messages that are pornographic or false with intent to threaten life or public order are punishable—not broad language like “annoyance.” hamulegal.comabe-lp.comGlobal Practice Guides

6. Clarified Cyber‑stalking Offenses

   • Section 24 now more precisely targets pornographic or false messages that threaten law, life, or public order—with fines up to ₦7 million or 3 years imprisonment; more severe bullying/harassment penalties also outlined Vanguard NewsTechpoint AfricaTHISDAYLIVEMondaq.

   Data Retention + Evidence Rules
   Service providers must retain traffic/subscriber data for two years, comply with the NDPA, and assist law enforcement while respecting privacy. abe-lp.comopenlawsnig.org.ng

7. Enhanced Penalties for Serious Cybercrime

   • Hacking critical systems now carries up to 10 years imprisonment or substantial fines NALT FoundationTechpoint Africa.
   • Identity theft, ATM/POS fraud, and ATM theft also carry stiffer penalties, reflecting evolving threats Techpoint AfricaNALT Foundation.

   Payment Tech Fraud Expanded
   Any emerging payment method—mobile apps, e-commerce, contactless—now falls under fraud provisions, not just ATMs or POS systems. abe-lp.comRalph-Malix Legal Consult

8. New Watchdogs & International Cooperation
   • The National Security Adviser's office now coordinates cybersecurity enforcement, international collaboration, and oversight of CERTs/SOCs MondaqTHISDAYLIVEPeoples Gazette Nigeria.
9. Safeguarding Freedom of Expression
   • Amendments narrow the earlier broadly worded cyberstalking provision—aiming to reduce misuse and protect press freedom and public discourse THISDAYLIVEMondaq.

Fast Facts from the Law (What the Amendment Actually Says)

Looking Ahead: What’s on the Horizon for 2025

While Amendments of 2024 are foundational, a full Cybercrime Act 2025 is anticipated to address emerging technologies and enforcement gaps:

• AI, Blockchain & Virtual Assets: The Federal Government is evaluating amendments to cover these technologies, per the NSA's statements in May 2025 Peoples Gazette Nigeria.
• Public‑Private Stakeholder Input: Experts urge more inclusive and periodic legislative reviews, better facilitating innovation while managing risk techhiveadvisory.africaForbes.
• Inflation-adjusted Penalties: With devalued fines becoming less deterrent, calls are growing for penalties pegged to real economic value—not static naira amounts Forbes.

SEO-Driven Section Headings (Suggestions)

• “Nigeria Cyber Crime Act 2025: What Businesses Need to Know”
• “Cybersecurity Levy in Nigeria: 0.5% Explained”
• “How Nigeria’s 2024 Cybercrime Amendments Protect Companies”
• “Reporting Cyber Attacks Fast: New Nigeria Requirements”
• “Emerging Tech & Cybercrime Laws: Looking to 2025”

Let’s pause the jargon and outline how this impacts YOU—based on helpful legal insights:

What It Means for You—By Industry

Fintech Firms

• Reporting pressure: Build quick detection and escalation channels to meet the 72-hour window.
• Tech upgrades: Make sure mobile wallets and payment APIs comply with fraud rules.
• KYC overhaul: Integrate NIN/BVN gathering into onboarding flows.
• Monthly levy accounting: Automate 0.5% deduction and remittance routines.
• Data governance: Encrypt, store, and audit traffic data for two years.

SMEs (Startups, Digital Sellers, Local Businesses)

• Compliance strain: Small teams may struggle with costs of tech and reporting, but ignoring it risks fines.
• Cybersecurity basics: MFA, encrypted phones, incident-response plans are now must-haves.
• Tax-like deductions: Those 0.5% levies can eat into margins; factor it into pricing or savings.
• Privacy sensitivity: Collect and store customer data carefully—especially with social media touchpoints.

Social Media-Based Businesses & Creators

• Content accountability: Be cautious with posts—no false, pornographic, or threatening content.
• Advertising rules: Social posts may count as ads under ARCON—check if media or promotional posts require pre-approval. Global Practice Guides
• Privacy compliance: Do not share personal customer data without consent—NDPA applies. Global Practice Guides

Custom Compliance Checklists

Impact at a Glance—Human Touchpoints

• Stress test your systems: Unexpected cyber threats or compliance demands can knock you off balance—but planning ahead can make your business more resilient.
• Cost vs. trust: Yes, there's a levy and tech cost—but customers value security and trust a compliant brand more.
• Growth-ready: Those prepared for this law will scale more sustainably, enter new markets, and win regulatory trust.
• Creativity stays, slipperiness goes: With sharper definitions, you can create boldly—but wisely.

Wrapping Up—With Heart

This law isn't just a bill—it’s a wake-up call. It asks us to balance agility with responsibility. To Fintech visionaries, local business heroes, and digital storytellers: embrace this change. Let it be your opportunity to strengthen operations, build trust, and innovate within safer guardrails.

Nigeria’s Cybercrimes Amendment Act 2024 is a significant leap in safeguarding our cyberspace—but it's just the beginning. For businesses, it demands speedy breach reporting, updated compliance systems, levy accounting, and employee training. Meanwhile, as the law evolves in 2025 to include AI, blockchain, and inflation-adaptive penalties, companies should be agile, stay informed, and engage in shaping future provisions.