CBN withdraws circular on cyber security levy

The Central Bank of Nigeria (CBN) has withdrawn the contetious circular directing banks and other financial institutions to implement the 0.5 per cent cyber security levy.

The withdrawal of the circular was announced in a statement signed by Haruna Mustafa, Director, Financial Policy and Regulation Department, and Chibuzo Efobi, Director, Payment System Management Department.

The terse two-paragraph circular read: “The Central Bank of Nigeria circular dated May 6, 2024 (Ref. PSMD/DIR/PUB/LAB/017/004) on the above subject refers. ‘

“Further to this, please be advised that the above referenced circular is hereby withdrawn.”

Advertisement

President Bola Tinubu had, last week, ordered the CBN to suspend the implementation of the controversial cybersecurity levy policy after an avalanche of criticisms by Nigerians.

The House of Representatives had asked the CBN to withdraw its circular directing all banks to commence charging a 0.5 per cent cybersecurity levy on all electronic transactions in the country.

The CBN on May 6, 2024, issued a circular mandating all banks, mobile money operators, and payment service providers to implement a new cybersecurity levy, following the provisions laid out in the Cybercrime (Prohibition, Prevention, etc) (Amendment) Act 2024.

According to the Act, a levy amounting to 0.5 per cent of the value of all electronic transactions would be collected and remitted to the National Cybersecurity Fund, overseen by the Office of the National Security Adviser.

Financial institutions were required to apply the levy at the point of electronic transfer origination.

The deducted amount is to be explicitly noted in customer accounts under the descriptor “Cybersecurity Levy” and remitted by the financial institution. All financial institutions were required to start implementing the levy within two weeks from the issuance of the circular.

By implication, the deduction of the levy by financial institutions should commence on May 20, 2024.

However, financial institutions were to make their remittances in bulk to the NCF account domiciled at the CBN by the fifth business day of every subsequent month.

The circular also stipulated a timeframe for financial institutions to reconfigure their systems to ensure complete and timely submission of remittance files to the Nigeria Interbank Settlement Systems Plc as follows: “Commercial, Merchant, Non-Interest, and Payment Service Banks – Within four weeks of the issuance of the Circular.

“All other Financial Institutions (Microfinance Banks, Primary Mortgage Banks, Development Financial Institutions) – Within eight weeks of the issuance of the Circular,” the circular noted.

The CBN emphasised strict adherence to the mandate, warning that any financial institution that failed to comply with the provisions would face severe penalties.

As outlined in the Act, non-compliant entities were subject to a minimum fine of two per cent of their annual turnover upon conviction.

Recall that one of the critics of the levy, Femi Falana, SAN, had argued that the cyber security levy (CSL) applied by law exclusively to businesses and not to individuals.

He said the provision was covered in Section 44(2)(a) and sub-section (4) of the Nigerian Cybercrimes (prohibition, prevention, etc) Act, 2015.

His assertion was that If the CBN directive to banks covered individuals, then the CBN was breaking the law.

The clear understanding of the law, THE CONCLACE reports, is that any bank that extends the CSL levy collection beyond the clear provision of the law will be committing a crime.

Also, there are limited businesses covered by the CSL.

The categories are listed in the Second Schedule to the Act. A business outside the list in the Schedule is under no obligation to pay the levy. [Additional information from TheNiche]