Nigeria Cybercrimes Act: Offences, Reporting and the 2024 Amendment

Nigeria's Cybercrimes (Prohibition, Prevention, etc.) Act 2015, as amended in 2024, is the country's main cyber law, and it puts duties on operators of computer systems, service providers and financial institutions, not only on offenders. Legal commentary on the 2024 amendment reports that it cut the cyber threat reporting window to 72 hours, routed reports through sectoral CERTs and Security Operations Centres, tied data retention to the Nigeria Data Protection Act 2023, and set the 0.5% cybersecurity levy that caused a public storm in May 2024. A Presidential Order made in June 2024 then designated 13 sectors as Critical National Information Infrastructure (CNII). This guide covers who the Act reaches, the obligations security teams own, the levy's status, enforcement, and what it means for service accounts and AI agents. It is for security, legal and risk leads at organisations that run systems in Nigeria. Privacy duties sit in a separate law: see the Nigeria Data Protection Act Guide.

Sources: the official text of the 2015 Act and the 2024 Amendment Act could not be accessed in readable form (the government-hosted amendment is an image scan), so this page is based on secondary sources: law firm and advisory reviews by Templars, Tech Hive Advisory, Mondaq (A review of the Cybercrimes Amendment Act 2024) and ALP. Each obligation below names its source. Figures, deadlines and percentages appear only where at least two of these independent sources agree. The CNII Order 2024 is cited from the official gazette copy published by ngCERT. Confirm against the official text before relying on it.

Key takeaways

• Report within 72 hours: Templars and Tech Hive Advisory both report that the amended reporting duty requires cyber attacks, intrusions and disruptions to be reported within 72 hours, through the relevant sectoral CERT or SOC to the national ngCERT Coordination Centre, replacing the original 7 days. They differ on whether the clock runs from detection or occurrence.
• CNII is now designated: the Designation and Protection of Critical National Information Infrastructure Order 2024 (S.I. No. 21 of 2024) names 13 sectors, from power and banking to health and education, and makes their operators members of a Trusted Information Sharing Network.
• The levy is law but not being collected through banks: Mondaq, Templars and Tech Hive Advisory all describe a 0.5% levy on electronic transaction value; the Central Bank of Nigeria (CBN) issued an implementation circular on 6 May 2024 and, per Templars and Tech Hive Advisory, withdrew it on 17 May 2024.
• Retention is two years and must respect the NDPA: Templars and Tech Hive Advisory report that service providers keep specified traffic data and subscriber information for two years, and that the amendment requires this to follow the Nigeria Data Protection Act 2023.
• Insiders are in scope: both reviews report that the amendment widened identity theft and conspiracy offences from financial institution staff to employees of any public or private organisation, which makes access governance a legal control, not just a security one.

Scope: who and what is covered

The Act creates criminal offences that apply to anyone, and positive duties that apply to defined groups. Read it as two layers: the offences you must protect against and the obligations you must perform.

The Second Schedule businesses, as listed in ALP's commentary on the Act, are GSM service providers and telecommunication companies, internet service providers, banks and other financial institutions, insurance companies and the Nigerian Stock Exchange. Check the gazetted text for the current list before deciding whether you are an obligated business.

The CNII Order designates computer systems, networks and communication infrastructure in these sectors: power and energy; water; information, communication, science and technology; banking, finance and insurance; health; public administration; education; defence and security; transport; food and agriculture; safety and emergency services; industrial and manufacturing; and mines and steel. The Order's Schedule lists specific systems within each, such as telecommunications infrastructure, payment systems and national identity databases, and the National Security Adviser can update the list with presidential approval. For how this compares with other countries' critical infrastructure regimes, see the Critical Infrastructure Regulation Map.

Key obligations

Report cyber threats within 72 hours

The original section 21 required incidents to be reported to the National CERT Coordination Centre and made failure to report within 7 days an offence. Templars and Tech Hive Advisory both report that the 2024 amendment shortened the window to 72 hours and changed the channel to sectoral CERTs or SOCs, which feed ngCERT. Tech Hive Advisory describes the clock as running from detection; Templars describes it as running from occurrence. Until you have checked the official text, plan on the stricter reading and treat the first sign of an attack, intrusion or disruption as the start. Write that definition into your incident plan.

• What to report: attacks, intrusions and other disruptions liable to hinder the functioning of another computer system or network.
• Who receives it: your sectoral CERT or SOC (for example the one your sector regulator operates or nominates), with onward routing to ngCERT. Confirm the channel with your regulator now, not during an incident.
• Overlap: if personal data is affected, the NDPA has its own 72-hour notice to the Nigeria Data Protection Commission. Run both clocks from one triage decision. For other countries' clocks see the Breach Notification Laws by Country Guide.

Retain traffic data and subscriber information

According to Templars and Tech Hive Advisory, section 38 requires service providers to keep traffic data and subscriber information, as the communications regulator prescribes, for two years, and the amendment adds that retention and protection must follow the NDPA 2023. In practice that means the data must be secured, access-logged and kept no longer than required. Penalties for contravention are set in the Act; we could not confirm the current figures from two independent sources, so check the official text. See the Log Management and Retention Guide for retention design.

Assist law enforcement

Section 40 of the 2015 text, as hosted by the Asian School of Cyber Laws, requires service providers to assist law enforcement, including preserving and disclosing data on request, with penalties for providers and their officers. Keep a documented request-handling process with legal review and a record of each disclosure.

Verify customers and protect payment systems

Templars and Tech Hive Advisory both report that the amendment requires financial institutions to obtain the customer's National Identification Number, issued by the National Identity Management Commission, before issuing cards. Tech Hive Advisory also reports that section 30 was widened from ATMs and point-of-sale terminals to any payment technology.

Protect CNII and join information sharing

Under the CNII Order, the Office of the National Security Adviser (ONSA) periodically audits and inspects CNII, develops minimum standards and procedures for presidential approval, and builds a CNII Protection Plan with stakeholders. Operators are members of the Trusted Information Sharing Network and share threat and vulnerability information. The Order itself sets no separate incident reporting clock: section 21 applies.

Remit the cybersecurity levy (obligated businesses)

Mondaq, Templars and Tech Hive Advisory all describe section 44 as setting a 0.5% levy on the value of electronic transactions by Second Schedule businesses, paid into the National Cyber Security Fund. The status section below explains why collection is on hold.

Timeline and current status

As of November 2026, we found no reissued CBN implementation circular in the sources we checked. The levy remains in the Act, so obligated businesses should treat it as a dormant liability: track CBN and ONSA announcements and be ready to remit if a new instrument is issued. The reporting, retention and CNII provisions are in force.

Enforcement and penalties

ONSA coordinates security and enforcement agencies under section 41, which also establishes ngCERT and a National Computer Forensic Laboratory. The Act sets prison terms and fines for offences such as unauthorised access, system interference, computer-related fraud, attacks on designated CNII, trafficking in passwords and access codes, and failures by service providers. Several sections were reworded in 2024, and we could not confirm current penalty amounts from two independent sources, so they are not listed here. Read the penalty in the official amended text for any provision that matters to you.

One figure does have two sources: Mondaq and Templars both report that a Second Schedule business that fails to remit the levy commits an offence punishable by a fine of not less than 2% of annual turnover, and that failure to pay can lead to closure or withdrawal of the operating licence.

Templars and Tech Hive Advisory both report that section 24, the cyberstalking offence, was narrowed in 2024 after an ECOWAS Court of Justice ruling that it did not meet international standards. It now targets pornographic messages and knowingly false messages likely to cause a breakdown of law and order or a threat to life. Security teams rarely meet it directly, but it matters for content moderation and abuse desks.

What it means for AI agents and non-human identities

The Act is technology-neutral. Its unauthorised access, data modification and fraud offences turn on whether access was authorised, and the 2024 amendment extended insider offences to all organisations. That makes authorisation evidence for machine identities a practical necessity.

• Define authority for every automated actor: service accounts, API keys and AI agents act on systems at machine speed. Record which human owner approved each one, what it may access and why. If an agent's action is ever questioned, a written scope is the evidence that access was authorised. See the NHI Ownership Guide.
• Treat credential theft as reportable: a stolen API key used to enter a system is an intrusion, and the 72-hour reporting window may already be running. Your detection rules for anomalous machine identity behaviour feed the reporting decision directly. The Detection Engineering for Non-Human Identities Guide covers the signals.
• Password and access code trafficking: section 6 covers trafficking in passwords and access codes. Secrets leaked to public repositories or shared in chat put an organisation at risk of being the victim of that offence, so secret scanning and rotation belong in the compliance programme. See the Secrets Management Guide.
• Retention data handled by automation: where pipelines or agents query retained traffic data, their access must be logged and limited, because section 38 now requires NDPA-aligned protection.
• CNII operators: machine identities with reach into designated systems (SCADA historians, payment switches, identity databases) should be inventoried, owned and reviewed on a fixed cycle. ONSA audits will ask how access is controlled; NHI Mgmt Group recommends at least quarterly review for these identities.

Compliance steps

1. Classify your position: decide whether you are a service provider, a financial institution, a CNII operator under the 2024 Order, a Second Schedule business, or simply a system operator with section 21 duties. Record the decision and the legal advice behind it.
2. Confirm your reporting channel: identify your sectoral CERT or SOC and its intake method, and test that you can reach it out of hours.
3. Update the incident plan: define what starts the clock, add the 72-hour cyber threat report and the separate NDPA notice, and assign who signs each. Use the Incident Response Plan Template as a base.
4. Set retention: for service providers, implement two-year retention for the traffic data and subscriber information your regulator specifies, with access logging, encryption and deletion at expiry.
5. Write a law enforcement request procedure: verification of the requester, legal review, data minimisation and a disclosure log.
6. Govern insider and machine access: least privilege, joiner-mover-leaver controls for staff, and owner-approved scopes for service accounts and agents.
7. CNII operators: join the Trusted Information Sharing Network, prepare audit evidence and track ONSA's minimum standards when published.
8. Watch the levy: if you are an obligated business, assign someone to monitor CBN and ONSA and model the cost of remittance.

Framework mapping

Measuring it

• Time from detection to sectoral CERT report: target well under 72 hours in exercises.
• Machine identities with a named owner and approved scope: percentage of service accounts, API keys and agents.
• Retention conformance: share of in-scope data stores meeting two-year retention and deletion at expiry.
• Law enforcement requests handled within procedure: percentage with legal review and a disclosure log entry.
• CNII audit findings closed on time: for designated operators.

Common failure patterns

• Starting the clock at confirmation of root cause: commentary links the trigger to detection or occurrence of the attack, not to forensic conclusions. Waiting for forensics to finish can miss 72 hours.
• Reporting to the wrong body: after the amendment, reports go through sectoral CERTs or SOCs. Teams with an old runbook may still send only to ngCERT or only to their regulator.
• Retaining forever: two years is the retention period, and the NDPA requires protection and minimisation. Unbounded log retention creates privacy exposure.
• Treating the levy as dead: the circular was withdrawn, but section 44 remains. Obligated businesses should not remove it from their risk register.
• Ownerless service accounts: without a recorded approver and scope, it is hard to show which automated access was authorised when an incident is investigated.

Practitioner checklist

• Record which Act roles apply to you: system operator, service provider, financial institution, CNII operator, Second Schedule business.
• Identify and test the sectoral CERT or SOC reporting channel.
• Define the clock trigger in the incident plan and rehearse the 72-hour report alongside the NDPA notice.
• Implement two-year retention for in-scope traffic and subscriber data with NDPA-aligned protection.
• Maintain a law enforcement request procedure with legal review and a disclosure log.
• Inventory service accounts, API keys and AI agents with owners and approved scopes.
• Run secret scanning and rotate exposed credentials promptly.
• CNII operators: join the Trusted Information Sharing Network and prepare for ONSA audits.
• Monitor CBN and ONSA for any reissued levy instrument.

Standards and references

Source note: apart from the CNII Order, the sources below are secondary. Confirm against the official text before relying on it.

• National Assembly of Nigeria: Cybercrimes (Prohibition, Prevention, etc.) Act 2015 (text as enacted, secondary copy hosted by Asian School of Cyber Laws)
• ngCERT: Designation and Protection of Critical National Information Infrastructure Order 2024 (S.I. No. 21 of 2024)
• Nigerian Communications Commission: Cybercrime Act 2015 consumer summary
• Templars: Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act 2024 review
• Tech Hive Advisory: Nigeria Cybercrimes Act amendment, charting the future direction
• Mondaq: A review of the Cybercrimes (Amendment) Act 2024 and the proposed cybersecurity levy
• ALP: Update on the cybersecurity levy under the Nigeria Cybercrimes Act

Related NHI Mgmt Group resources: Nigeria Data Protection Act Guide · Cyber Incident Reporting Requirements Map · Computer Misuse and Anti-Hacking Laws Guide · Ghana Cybersecurity Act 2020. This guide summarises the Cybercrimes (Prohibition, Prevention, etc.) Act 2015 as amended in 2024 and the CNII Order 2024 as published at the date above and is not legal advice.