By Nafisat Damisa

Introduction

The proliferation of generative AI has transformed Nigeria’s cybercrime landscape, enabling deepfake fraud, automated social engineering, and AI-enhanced phishing at scale. In early 2024, scammers using AI-generated deepfake videos impersonating a company’s CFO defrauded a Hong Kong finance worker of $25.6 million. As similar threats emerge in Nigeria’s fintech sector, this article examines whether the Cybercrimes (Prohibition, Prevention, etc.) Act 2015 (as amended 2024) is legally adequate, or whether Nigeria’s evidentiary and accountability frameworks are too weak to support effective prosecution of AI-driven cybercrime

Current Legal Landscape
Nigeria’s primary legal framework on preventing cybercrime is the Cybercrimes (Prohibition, Prevention, etc.) Act 2015, amended in 2024 to address cryptocurrency transactions, cyberbullying and various forms of digital misconduct. Complementary frameworks include the National Information Technology Development Agency Act 2007, the Nigerian Data Protection Act 2023, and sectoral regulations such as the CBN’s Risk-Based Cybersecurity Framework. However, the majority of these frameworks were issued far before now, and emerging risks like AI-driven threats are not really being addressed. The Act nowhere mentions “artificial intelligence,” “algorithm,” or “autonomous system.” Notably, the National Artificial Intelligence Commission (Establishment) Bill, 2025, is currently pending before the Senate. If passed, it would establish a dedicated commission to coordinate AI strategy, research, and ethical deployment. However, the Bill in its present form focuses primarily on development and innovation promotion, with limited provisions on criminal liability, evidence handling, or enforcement against AI-facilitated cybercrime, leaving the core accountability and evidentiary gaps largely unaddressed.

AI as a Double-Edged Sword
AI paradoxically enables both defence and attack. Nigerian financial institutions deploy AI for real-time fraud detection and pattern recognition. Conversely, cybercriminals exploit generative AI for deepfake creation, automated credential stuffing, and convincing phishing tailored to Nigerian English and Pidgin. The same technology that powers fraud detection systems can be weaponised to evade them. Take justice delivery as an example, the Evidence Act 2011 (as amended 2023) admits computer-generated evidence under Section 84, but remains silent on AI’s capacity to seamlessly generate or alter electronic records, creating “doctored AI-generated evidence”.  These and many more issues await Nigeria’s digital space in the coming years.

The Legal Gaps

There are multiple critical gaps that undermine AI governance.  For this article, three are considered.  First, no framework attributes criminal liability when an autonomous AI commits an offence. The question of whether the developer, user, or owner should bear criminal responsibility for the acts of an autonomous system remains entirely unanswered under Nigerian law, leaving prosecutors without a clear legal theory of culpability.

Second, Section 84 of the Evidence Act 2011 governs computer-generated evidence but does not address AI-generated outputs. The Act’s definition of “computer” excludes AI’s cognitive processing capabilities, creating a statutory blind spot where evidence produced by generative or autonomous systems falls outside the existing admissibility framework.

Third, Nigeria lacks any framework for mandatory AI-generated content labelling, impeding deepfake traceability. Computer-generated evidence under Section 84 of the Evidence Act 2011 remains admissible if unchallenged at trial, a dangerous precedent for AI evidence, as opposing parties may lack the technical capacity to mount any challenge at all.

Comparative Jurisdictions: Rich Laws, Tangible Results

Jurisdictions with advanced AI laws demonstrate clear outcomes. The EU AI Act (Regulation 2024/1689) mandates transparency obligations, requiring synthetic content labelling and informing individuals when interacting with AI systems; non-compliance triggers significant penalties. The US Algorithmic Accountability Act of 2023 is a proposed Act that will require impact assessments for high-risk AI systems in housing, credit, and employment, with FTC enforcement and a public repository.  China implemented mandatory measures for the Identification of AI-generated (Synthetic) content. These rules, mandated by the Cyberspace Administration of China (CAC) and others, require explicit (visible labels) and implicit (watermarks/metadata) identification for all AI-generated text, images, audio, video, and virtual scenes to ensure transparency, traceability, and combat disinformation. These laws contribute to measurable results: forensic traceability, expedited prosecution of deepfake fraud, and clear liability chains. Nigeria has none of these.

Hope or Illusion?

Without legislative intervention, AI’s promise against cybercrime remains an illusion. Nigeria requires the following to boost its hope:

1. Amendment of the Cybercrimes Act to include AI-specific offences and mandatory content provenance standards;
2. Revision of Section 84 of the Evidence Act 2011 to address AI-generated evidence credibility, not merely admissibility;
3. Investment in digital forensic capabilities is currently hampered by inadequate enforcement, weak forensic capabilities, and a lack of specialised personnel; and
4. A risk-based framework drawing from EU and US models.
5. Review of both secondary and tertiary education curricula to address the knowledge gap in AI and prepare the next generation for the AI-driven future.

Conclusion

AI can help curb cybercrime in Nigeria, but only if legal capacity catches up with technical capability. The Cybercrimes Act 2024 amendments were a step forward, but they did not address AI accountability, algorithmic transparency, or evidentiary credibility. The pending National Artificial Intelligence Commission Bill, 2025, signals legislative awareness, but without substantive provisions on liability, evidence, and enforcement, it cannot fill the existing gaps. The effectiveness of existing frameworks remains a question. An optimistic but cautious path exists, but until Nigeria enacts AI-specific legislation, whether through amending the Cybercrimes Act, revising the Evidence Act, or strengthening the pending Bill, weak laws will remain unable to support strong technology.

Nafisat Damisa is a Legal Research Associate in Olives and Candles – Legal Practitioners. For further information, enquiries, or clarification, please contact Nafisat via: [email protected] or [email protected]

By Isah Kamisu Madachi

By Gbolahan Oluyemi

In 2025, the National Pension Commission (PenCom) directed all Licensed Pension Fund Operators (LPFOs) to demand a Pension Clearance Certificate (PCC) from service providers before engaging their services. This new policy typically affects various types of entities, including small and medium-scale enterprises, most of which are not usually compliance-driven. Following this directive, the PCC has become an essential compliance document for both large, medium and small-scale firms. This article provides a guide on what a PCC is, why it matters, and how it can be obtained.

What is a Pension Clearance Certificate (PCC)?

A Pension Clearance Certificate (PCC) is an official document issued by PenCom confirming that an organisation has complied with the provisions of the Pension Reform Act. It is an annual document that must be renewed every year at no cost.  The yearly renewal is intended to ensure that organisations treat compliance as a continuous activity rather than a one-off act.

Why is a PCC Important?

The PCC is important because it demonstrates that an organisation is compliant with the provisions of the Pension Reform Act, especially as it relates to employee pension contributions under Section 4 (1) of the Pension Reform Act and subscription to group life insurance under Section 4 (5) of the Pension Reform Act. It is also required for certain transactions, such as government contracts and engagements with compliance-sensitive partners. In essence, a PCC assures investors, partners, and clients that your business is properly structured and compliant with regulatory requirements.

Who Needs a Pension Clearance Certificate?

Under Nigerian law, companies with three or more employees are required to participate in the Contributory Pension Scheme (CPS). If your organisation employs at least three staff members and provides or intends to provide services to Licensed Pension Fund Operators (LPFOs) or other regulated entities, you are expected to obtain a PCC annually.

How Do I Obtain a PCC?

PenCom issues the PCC electronically and at no cost through its web portal: https://pcc.pencom.gov.ng/.  Please note that Applicants who are just beginning compliance and remitting employees’ pensions are required to first obtain an employer code from a Pension Fund Administrator (PFA). This code is necessary to initiate the PCC application on the PenCom portal.

Upon logging into the portal, you will be required to complete your company profile by providing your date of incorporation, contact details, and website (if applicable), as well as uploading your CAC documents.

Next, you will upload an Excel schedule (using the template provided on the website) containing your employee list. After this, you will be required to upload Excel sheets detailing pension contributions. You will also need to upload your organisation’s group life insurance documentation and payment instrument.

Finally, you will review your application and submit it for further processing by PenCom. Before commencing an application, ensure you have the following:

1. Certificate of Incorporation (CAC documents)
2. Group Life Insurance Policy for employees
3. Evidence of Pension Fund Administrator (PFA) registration for employees
4. Three years’ proof of monthly pension remittances, including penalties for any defaults (where applicable). For companies less than three years old, provide proof of remittances from the date of incorporation
5. A valid Tax Identification Number (TIN)
6. An employee schedule showing staff details and contributions (usually in Excel format) Templates are available on the PenCom portal

Also note that for the portal to accept employee details and remittance records, employees must have completed their data capture with their respective Pension Fund Administrator and updated their records to reflect their current employer.

Conclusion

Obtaining a Pension Clearance Certificate in Nigeria may seem technical at first, but once proper processes are established, it becomes routine. The key is consistency in remittance, maintenance of accurate records and prioritisation of compliance in overall operations.

For many Nigerian businesses, the PCC is more than a regulatory requirement; it is a mark of credibility. In a competitive environment, that credibility can make all the difference.

Gbolahan Oluyemi is a Legal Practitioner and currently leads Olives and Candles – Legal Practitioners. For further information, enquiries, or clarification, please contact Gbolahan via: [email protected] or [email protected]