EXPLAINER: Understanding CBN’s 0.5% Cybersecurity Levy

By Adedapo Adesanya

On Monday, May 6, 2024, the Central Bank of Nigeria (CBN) directed all financial institutions, including commercial banks and others to deduct a 0.5 per cent cybersecurity levy on electronic transfers as stipulated in the Cybercrime (Prohibition, Prevention, etc) (Amendment) Act 2024.

The directive has since created an uproar among Nigerians as they interpreted it to be that the 0.5 per cent fee would be charged on the value of the funds transferred electronically. For instance, a sum of N1,000 will attract N5, N2,000 to attract N10, N5,000 to attract N50, and so on.

But from the explanation given by the CBN in 2018 when this policy was first implemented, the cybersecurity fee is levied on the service charge by the financial institutions from the originator of the transaction.

For example, if the service charge on the transfer of N10,000 is N50, the 0.5 per cent cybersecurity levy will be charged on the N50, not N10,000, which means apart from paying N50 for Electronic Money Transfer Levy (EMTL), 7.5 per cent Value-Added Tax (VAT), and other fees, the customer will likely pay 25 Kobo as an additional fee for the transaction.

This development is not new. The Cybersecurity Act was first passed in 2015 and introduced a 0.005 per cent levy on electronic transfers. In June 2018, the CBN implemented the policy and directed banks to collect the levy on “electronic transactions occurring in a bank or on a mobile money scheme or any other payment platform that have an accompanying service charge.”

It was explained in 2018 through Mr Dipo Fatokun, who was then the Director Banking and Payments System Department, that “Electronic transactions shall be all financial transactions occurring in the bank or on a Mobile Money Scheme or any other payment platform that have an accompanying service charge; the levy shall be 0.005 per cent of the service charge (exclusive of all tax effects) from all electronic financial transactions occurring in a bank, a Mobile Money Scheme and other Payment Platforms.

“All electronic transactions (both inter and intra) that have an accompanying service charge shall qualify as eligible transactions; the effective date of collection shall be with effect from July 1, 2018.”

Now, the levy has been increased by 900 per cent and covers fintechs, payment service providers, and other financial institutions. These institutions have been mandated to remit the monies to the National Cybersecurity Fund (NCF), which would be administered by the Office of the National Security Adviser (ONSA).

In the latest circular signed by the Director of the Payments System Management Department of the CBN, Mr Chibuzo Efobi; and the Director of the Financial Policy and Regulation Department, Mr Haruna Mustafa, the apex bank emphasised that failure to remit the fees is an offence as stated in Section 44 (8) of the Act and will attract a conviction of not less than 2 per cent of the annual turnover of the defaulting business, amongst others.

“Following the enactment of the Cybercrime (Prohibition, Prevention, etc) (Amendment) Act 2024 and pursuant to the provision of Section 44 (2)(a) of the Act, ‘a levy of 0.5% (0.005) equivalent to a half per cent of all electronic transactions value by the business specified in the Second Schedule of the Act,’ is to be remitted to the National Cybersecurity Fund, which shall be administered by the Office of the National Security Adviser,” a part of the notice said.

While the outbursts have continued, many have also justified the need for the charge, especially with fraud prevalent in the Nigerian financial ecosystem.

Available data released by the Financial Institutions Training Centre (FITC) showed that Nigerian banks lost N2.09 billion to frauds in the fourth quarter of 2023, with mobile emerging as the top channel through which the largest amount was lost. 

According to the report, the N2.09 billion loss recorded in Q4 was a 77.58 per cent increase from the N1.18 billion recorded by the banks in Q3 2024.  

There are also indicators that the number might be higher this year, with the CBN forcing the hands of neobanks like Opay, MoniePoint, PalmPay, and Kuda not to open new accounts.

Despite this new fund, it is not all gloomy as 16 banking transactions are exempted from the CBN’s new cybersecurity levy.

These are Loan disbursements and repayments; Salary payments; Intra-account transfers within the same bank or between different banks for the same customer; Intra-bank transfers between customers of the same bank, Other Financial Institutions’ instructions to their correspondent banks; Interbank placements; Banks’ transfers to CBN and vice-versa; Inter-branch transfers within a bank; and Cheque clearing and settlements.

Others are Letters of Credit; Banks’ recapitalisation-related funding – only bulk funds movement from collection accounts; Savings and deposits, including transactions involving long-term investments such as Treasury Bills, Bonds, and Commercial Papers; Government Social Welfare Programmes transactions e.g. Pension payments; Non-profit and charitable transactions, including donations to registered non-profit organisations or charities; Educational institutions’ transactions, including tuition payments and other transactions involving schools, universities, or other educational institutions; as well as transactions involving the bank’s internal accounts such as suspense accounts, clearing accounts, profit and loss accounts, inter-branch accounts, reserve accounts, nostro and vostro accounts, and escrow accounts.