Posts

Data Protection In Nigeria; Impact On Open Banking Regulation

/in /by

By Aderonke Alex-Adedipe and Eustace Aroh

Introduction

The rapid growth of finance and technology (fintech) companies in the last decade have been necessitated by consumers’ needs for faster and more convenient financial services. These needs continue to evolve over time and traditional financial institutions struggle to keep up. Open banking offers financial institutions who have access to information of customers (“Providers”) the opportunity to share such information with other financial institutions (“Consumers”) to keep them aware of those needs and enable them offer optimum services.

In our previous article, we highlighted the provisions of the recent Central Bank of Nigeria’s (CBN) Regulatory Framework for Open Banking in Nigeria (“Framework”). In today’s article, we consider specifically, the implication of data sharing under the Framework in light of the Nigeria Data Protection Regulation 2019 (NDPR).

NDPR
The NDPR was issued by the National Information Technology Development Agency (NITDA) in 2019 to regulate the collection, processing and storage of personal data. Personal data is information relating to an individual who can be identified, directly or indirectly, in particular by reference to an identifier. It includes a name, address, a photo, an email address, bank details, medical information, IP address, IMEI number, IMSI number, SIM, and others.

Due to the fact that the damage an individual may suffer in the course of breach of some personal data may be higher, data such as ethnic and racial information, religious beliefs, biometric and health information are categorized as sensitive data. These data must, therefore, be subject to a higher level of protection. Although the NDPR does not classify financial data as sensitive data, financial institutions have access to a number of sensitive data such as ethnicity and biometrics.

Applicable Personal Data
Under the Framework, four types of data qualify for the open exchange of data. These are Product Information and Service Touchpoints (PIST), Market Insight Transactions (MIT), Personal Information and Financial Transaction (PIFT), Profile, Analytics and Scoring Transaction (PAST). Only the PIFT and PAST, however, involve the sharing of personal data of consumers amongst participants.

The PIFT deals with the sharing of customer’s information provided during the Know Your Customer (KYC) process and information of the customer’s transactions such as account balance, payments, loans, recurring transactions etc. The PAST involves the sharing of information on the customer which analyses, provides scores and gives an opinion on customer behaviour (profiling).

Safeguards of the Framework
The Framework stipulates a number of security standards and protocols with respect to sharing of personal information over the Application Programming Interface (API) as it relates to authentication, authorisation, encryption, and secure hosting of data. The Framework also provides for a risk management system for each participant to, among others, track the risk of data sharing with other participants, comply with data privacy laws such as the NDPR, and report such associated risks to the CBN.

Consent
Irrespective of the data protection requirements under the Framework, the Framework specifically requires participants to comply with all extant laws on data privacy such as the NDPR and the NDPR Implementation Framework. Under the NDPR, before personal data of a customer can be used for a purpose different from that which it was initially given, the data controller, (in this case, the financial institution) is required to inform the customer of:

  1. the purpose for which the data was originally collected;
  2. if there is any connection between the original purpose and the proposed purpose;
  3. the possible impact of the new processing on the data subject; and
  4. the existence of security safeguards to protect the data.

The Framework further requires participants to list the specific rights which customers may grant to the participants and obtain the consent of the customer for each right separately.

Providers are also expected to ensure that customers revalidate their consent annually or after 180 days in cases where the services of the provider have not been used.

Conclusion
While the Framework seeks to support innovation in the Nigerian financial sector, participants of the open exchange of data are expected to reassess their data privacy practices to ensure they meet data compliance requirements of the NDPR and the Framework.

PROHIBITION OF CRYPTOCURRENCY TRANSACTIONS BY THE CENTRAL BANK OF NIGERIA

/in /by

By Aderonke Alex-Adedeipe and Olawale Atanda

On the 5th of February 2021, the Central Bank of Nigeria (CBN)[i] released a letter addressed to banks and other financial institutions which stated that dealing in cryptocurrencies and facilitating payment for cryptocurrency exchanges are prohibited. The CBN further instructed all banks and other financial institutions to identify individuals or entities who transact in cryptocurrency or operate cryptocurrency exchanges and close the accounts of such persons or entities.

Not surprisingly, the letter elicited major concern amongst the public with many concerned about the potential negative effect it could have on Nigeria’s growing cryptocurrency market and innovation in the fintech industry.

In response, the CBN issued a press release (the “Press Release”) on the 7th of February 2021, addressing its earlier directive and providing reasons for its prohibition of cryptocurrency transactions by banks and other financial institutions.

In this article, we shed light on the directive of the CBN, its effect on cryptocurrency trading in Nigeria, and the Securities and Exchange Commission’s (SEC) stance on cryptocurrency in Nigeria.

What are the Justifications for the Prohibition of Cryptocurrency Transactions?

The CBN stated in the Press Release that cryptocurrencies are issued by unregulated and unlicensed entities and as such, the use of cryptocurrencies in Nigeria contravened existing law as they are not legal tender. It also identified the anonymity of cryptocurrency as an issue. It stated that anonymity and the lack of KYC made it susceptible to illegal use such as money laundering and the financing of terrorism. Another justification was the volatility of cryptocurrencies which it said has threatened the stability of financial systems in other countries.

The Effect on Cryptocurrency Trading in Nigeria

Nigeria has the second largest Bitcoin market in the world with over $500 million worth of Bitcoin traded over the last five years. The CBN’s directive on cryptocurrency transactions will understandably have an effect on the cryptocurrency market in Nigeria as it essentially prevents traders from buying cryptocurrencies with their credit/debit cards issued by Nigerian banks or receiving proceeds of cryptocurrency sales from exchanges which facilitate the buying and selling of cryptocurrency.

It appears However some exchanges have found a way around the restriction by switching to peer-to-peer trading which enables individuals buy or sell cryptocurrency from individual traders as opposed to the exchanges. In effect, this does away with the need for exchanges to operate settlement accounts in Nigerian banks.

In response to the CBN’s directive, banks have begun to identify and deactivate the account of individuals with inflows/outflows from/to cryptocurrency exchanges. It is unclear if affected individuals would be able to reopen accounts with these banks in future.

SEC’s Intention to Regulate Cryptocurrencies

On September 14 2020, the SEC issued a statement[2] announcing its intention to regulate “digital assets” which includes cryptocurrencies. In light of the CBN’s directive, the SEC faced calls to clarify whether there was a contradiction in the policies of the two regulators.

Subsequently, on February 11 2021, the SEC issued a statement stating that it would partner with the CBN to analyse and better understand the identified risks of cryptocurrency to ensure that appropriate regulations are put in place if cryptocurrency transactions are allowed in future.

Conclusion

The CBN’s decision on cryptocurrency has also attracted attention from the highest levels of government. On the 11th of February, the Nigerian Senate deliberated on the CBN’s directive, with some senators expressing reservations about the ban on cryptocurrency transactions.The Senate thereafter resolved to invite the CBN Governor to give a briefing on the actions of the CBN.

More interventions like this may be seen as stakeholders deliberate on the potential far-reaching effects of the CBN’s stance on cryptocurrency in Nigeria

 

[i] Pavestones has written several articles on CBN regulations and licenses. You can view them at https://pavestoneslegal.com/tag/cbn/

[2] Pavestones wrote on the statement here https://pavestoneslegal.com/regulation-of-cryptocurrencies-and-other-digital-assets-in-nigeria/

 

CONTACTLESS PAYMENT METHODS – THE REGULATION OF QUICK RESPONSE (QR) CODES IN NIGERIA

/in /by

By Seun Timi-Koleolu and Eustace Aroh

Introduction

A cashless world was hard to imagine in the 80s and 90s (at least for most of us). It was unimaginable for you to successfully make payments, without cash, a debit or a credit card. What exactly were you to use then?! Right before our eyes, the world began to change, the mobile phone became more than a phone, it became your everything; your notepad, your office, your camera and your payment device (with the use of Quick Response [QR] Codes and Near Field Communication [NFC] tags).

The use of QR Codes as a payment method was introduced by Alipay in 2011 and became a widely used method of payment in China. NFC tags (which are chips built into smartphones) were used in countries like the United Kingdom first.

In Nigeria, QR Codes as a payment method is gradually gaining traction. Fintech companies such as Paystack and Flutterwave now offer sellers and service providers the ability to receive payment by generating and printing or sending a QR Code to their customers even over social media platforms such as Facebook. Many of the traditional financial institutions (such as First Bank and Guaranty Trust Bank) have updated their mobile applications to enable Customers utilize QR Codes as a payment method.

To properly regulate the use of QR Codes as a payment means in Nigeria, the Central Bank of Nigeria (CBN) on January 13, 2021, issued a Framework for QR Code Payments in Nigeria (“Framework”). We have highlighted some salient provisions of the Framework below.

Who are the Participants?

The major participants to a QR Code transaction as stated in the Framework are:

  1. The Merchant – this is the store owner, seller or service provider that has requested for payment through a QR Code.
  2. The Customer – this is the individual who is to pay the Merchant using the QR Code.
  3. The Issuer – this is the financial institution of the Customer.
  4. The Acquirer – this is the financial institution of the Merchant.
What are their Obligations?
  1. Where a Merchant elects to receive payment through QR Codes, he can only display QR Codes approved in Nigeria.
  2. The Merchant is also expected to comply with all extant CBN regulations and the rules of the Acquirer.
  3. The Customer is expected to use the QR Code application (provided by its financial institution i.e. the Issuer) without modifications and adhere to any security protocol of the Issuer.
  4. The Issuer is required to provide the Customer, upon request, with a QR Code Payment application that complies with the QR Code regulations; and ensure that all Customers update the application within 14 days of deployment of an update or patch.
  5. Issuers are also required to send a quarterly risk management assessment report to the Director, Payments System Management Department, CBN.
  6. The Acquirer is expected to ensure the proper use of the QR codes at the Merchant’s location or platform; and ensure the technology and protocol used for QR code conforms with the QR Code payment regulations.
  7. The value of each QR Code transaction must be delivered by the Acquirer to the Merchant within a day after the transaction.
  8. Both the Acquirer and the Issuer are to ensure the security of their system in such transactions.
  9. Where a switch or payment service provider is involved, they are required to facilitate interoperability between the Issuer and Acquirer and comply with the Framework and other CBN regulations on electronic payments.
Other Provisions of the Framework

The Framework adopts the Merchant-presented mode specification for Nigeria (as opposed to the customer-presented mode) which means the Merchant has to present the QR Code for buyers to scan in order to conclude the payment transaction.
Please also note that the Nigeria Inter-Bank Settlement System Plc (as the Payment Terminal Service Aggregator) is to certify QR Codes, the payment applications, updates and patches.

Conclusion

Payment with the use of QR Codes in Nigeria is gradually becoming the preferred choice for businesses in Nigeria as it is an affordable alternative to utilizing POS solutions. The issuance of the Framework is a positive step to encourage innovation in financial services and promote the secured use of QR Codes in Nigeria

The Central Bank Of Nigeria’s Regulatory Sandbox Operations Framework

/in /by

by Seun Timi-Koleolu and Olawale Atanda

 

In July 2020, the Central Bank of Nigeria (CBN)[1] released a draft Framework for Regulatory Sandbox Operations[2] aimed at establishing a controlled environment where disruptive technology in the financial services can be tested under the supervision of the CBN.

The CBN has now issued an approved Framework for Regulatory Sandbox Operations in Nigeria (the “Framework”). The CBN has now issued an approved Framework for Regulatory Sandbox Operations in Nigeria (the “Framework”). The Framework is expected to give eligible fintech innovators an opportunity to test their products, services, or solutions without the need to acquire a CBN license.

What is the scope of the Framework?

The Framework is targeted at innovations that can improve the Nigerian payments system. It applies to proposed products, services or solutions that are either not contemplated under the prevailing laws and regulations, or do not precisely align with existing regulations.

Eligibility of Sandbox Participants

The Framework allows for CBN licensees and local companies (including financial sector companies and telecom companies) to participate in the sandbox operations. Innovators whose proposed payment solution involves technologies that are currently not covered under existing CBN regulations are also welcome to participate.

Entities that apply to participate in the sandbox operations must show evidence that the product, service or solution is innovative, useful and functional; and associated risks have been identified. The entities should also have a business plan to show that the product, service or solution can be successfully deployed after they exit the sandbox.

Application Requirements and Approval Process

When the CBN is ready to receive applications, it will place an invitation on its website and local newspapers. Once the invitation is placed, applications are to be sent to the CBN’s official email address – sandbox@cbn.gov.ng.

Applications should be submitted with a cover letter signed by an authorized signatory of the applying entity and addressed to the Director, Payments System Management Department, Central Bank of Nigeria, Abuja. The applicants are to state the initial timeline (in months) for the proposed test of the product, service, or solution.

Applicants will be informed of the CBN’s approval to participate in the sandbox, 45 working days after the closure of the application window.

Sandbox Cohorts

The Sandbox will consist of Cohorts (which are groups of innovators that share the characteristic of having been allowed to enter the sandbox at the same time for the same period).

There will be one Cohort per year. Upon the completion of the sandbox test, the CBN will decide whether the product, service or solution should be introduced into the market.

Conclusion

The Framework is a plus for innovation in Nigeria. It signals that regulators are willing to better understand and develop more suitable regulations for innovations in the fintech space. The success of the sandbox can only be determined over time as implementation will be a key factor.

 

[1] Pavestones has written several articles on CBN regulations and licenses. You can view them at https://pavestoneslegal.com/tag/cbn/

[2] You can read our analysis of the draft framework here https://pavestoneslegal.com/fintech-regulatory-update-the-central-bank-of-nigeria-regulatory-sandbox/

Setting Up International Money Transfer Services in Nigeria

/in /by

By Seun Timi-Koleolu and Olawale Atanda

 

Companies desirous of providing International Money Transfer Operator (IMTO) services in Nigeria are required to be licensed by the Central bank of Nigeria (CBN) as provided by the Guidelines for the Operation of International Money Transfer Services in Nigeria, 2014 (“IMTO Guidelines”).

 

What activities can IMTOs Provide?

IMTOs may accept monies for the purpose of transmitting to persons resident in Nigeria or another country. They may also carry out cross-border transfer services for personal purposes such as money transfer services towards family maintenance and money transfer services for foreign tourists visiting Nigeria.

However, IMTOs are not permitted to accept deposits or carry out money lending services (as there are separate licensing requirements for these services). They may also not buy foreign exchange from the domestic foreign exchange market for settlement purposes.

 

What are the requirements for an IMTO license?

The IMTO Guidelines provide requirements for both local and foreign companies wishing to acquire an IMTO license.

Local companies must have a minimum share capital of ₦2 billion and submit relevant document such as their incorporation documents and business plan. Foreign companies on the other hand, are required to show evidence of being licensed as IMTOs in their home country and have a minimum share capital of $1 million. They must also have authorized forex dealers (banks) to serve as local agents and pay an application fee of ₦500,000.

 

Is there any regulatory update concerning International Money Transfer?

The CBN issued two circulars (the “Circulars”) on November 30, 2020 announcing a new policy initiative on diaspora remittances through IMTOs. The Circulars clarified the CBN’s position on the operation of domiciliary accounts and the procedure for receipt of diaspora remittances.

 

What do the Circulars say?

The Circulars state that recipients of diaspora remittances through IMTOs shall now receive such inflows in foreign currency (US Dollars) through the agent bank of the IMTO.

The Circulars provide for recipients of remittances to have the option of receiving these funds over the counter in foreign currency cash (US Dollars) or have it transferred into their ordinary domiciliary accounts.

 

Conclusion

The CBN seeks to deepen the foreign exchange market by ensuring the availability of more foreign currency in the market and creating more transparency in the administration of diaspora remittances into Nigeria as provided in the Circulars.

The CBN has so far licensed about 60 IMTOs with many foreign based IMTOs looking to debut in the Nigerian market alongside local ones. It is important that these IMTOs understand the regulations around IMTO licensing and compliance.

REGULATION OF CRYPTOCURRENCIES AND OTHER DIGITAL ASSETS IN NIGERIA

/in /by

By Aderonke Alex-Adedipe and Eustace Aroh

  1. INTRODUCTION

Through Blockchain, digital assets were introduced to the world in 2009 with no central controlling authority. Very quickly, cryptocurrency transactions became popular in various parts of the world including Nigeria and have remained unregulated. Specifically, the Central Bank of Nigeria declared in 2018 that cryptocurrencies are not regarded as legal tender, discouraging Nigerians from participating in cryptocurrency transactions. Recent events however continue to suggest that cryptocurrency is largely embraced as Nigeria remains the largest source of bitcoin trading in Africa.

In recognition of the above, the Nigerian Securities and Exchange Commission (“SEC”) on September 14, 2020 issued its Statement on Digital Assets and Their Classification and Treatment (the “Statement”). The Statement proposes a set of rules which seek to regulate cryptocurrencies and other digital assets classified as securities.  This article highlights some salient provisions in the Statement and their effects on transactions relating to digital assets in Nigeria.

 

  1. WHAT CLASS OF DIGITAL ASSETS WILL BE REGULATED?

According to the Statement, digital assets provide investment opportunities. The SEC, being the primary regulator of investments and securities in Nigeria, assumes jurisdiction over the regulation of digital assets, provided they can be classified as securities.

It is SEC’s position that all virtual crypto assets are deemed as securities, except otherwise proven by the issuer of the asset who is required to make an initial filing with SEC. Where upon assessment, the asset is found to constitute securities, it will have to be registered with SEC. Consequently, all digital assets including Digital Assets Token Offering (DATOs), Initial Coin Offering (ICOs), Security Token ICOs and other Blockchain-based offers of digital assets classified as securities by SEC, will need to be registered.

 

  1. WHO WILL BE REGULATED UNDER THE PROPOSED RULES?

Any person engaging in receiving, dealing, transmitting and executing orders on behalf of people, portfolio management, investment advice, custodian or nominee services as it relates to virtual digital assets services must be registered by SEC. The regulation will cover digital assets within Nigeria, by Nigerian issuers or sponsors and foreign issuers targeting Nigerian investors. Foreign issuers or sponsors will be recognized where a reciprocal agreement exists between Nigeria and the foreign country or where the country is a member of the International Organisation of Securities Commission. Foreign issuers or sponsors may, however, be required to establish a branch office within Nigeria.

 

  1. CONCLUSION

Although countries have continuously stated that cryptocurrencies do not qualify as an official legal tender, the unprecedented growth rate of digital assets have forced countries to issue rules regulating digital asset transactions. In Nigeria, specifically, the SEC has stated that the intention of the proposed rules is to safeguard the interest of participants, rather than stifle the growth of technology. The rules if implemented with these factors in mind, will ensure protection and transparency of digital asset transactions in Nigeria.

Loan Recovery in Nigeria – The Recent Central Bank of Nigeria Policy

/in /by

Access to credit in Nigeria has been low for a while, with the Central Bank of Nigeria affirming that only 5.3% of the adult population have access to finance. There are many reasons for this including high interest rates deterring borrowers and high rates of default on loans deterring creditors.

In a bid to reduce the high rate of defaults by borrowers, enhance loan recovery by financial institutions and generally improve creditor confidence in Nigeria, on July 13, 2020, the Central Bank of Nigeria (CBN) released Guidelines[i] on Global Standing Instruction (the “Guidelines”). Below are key points from the Guidelines.

What is a Global Standing Instruction? Global Standing Instruction (GSI) is a mandate or an instruction to be executed by a borrower authorizing financial institutions to recover a borrower’s debt from any or all accounts maintained by that borrower across various participating financial institutions through a direct set-off from deposits/investments held in those financial institutions.

What Financial Institutions can offer a GSI to a Borrower? All financial institutions in Nigeria licensed by the CBN including commercial banks, microfinance banks, finance companies, mortgage banks, and investment banks (“Financial Institutions”).

Does it apply to Individuals or Companies? The current guidelines apply to borrowers who are individuals and not companies. We expect that guidelines for company debtors would be issued by the CBN in due course.

How does the GSI work? Borrowers are to execute a GSI mandate/authorization in hard copy or digital when taking a loan from a Financial Institution. Where the Borrower defaults on the loan, the Financial Institution would be entitled to deduct the money owed plus interest due from any other personal account, joint account or child account in any other Financial Institution, linked to the borrower’s BVN (Bank Verification number)[ii].

When can a GSI be triggered? Where a Financial Institution is unable to recover debt through other means, the institution may trigger the GSI and the Nigerian Inter-Bank Settlement System will proceed to debit the Borrower’s accounts across various Financial Institutions. A GSI is to serve as a last resort by a Financial Institution and can only be used to recover the principal loan amount and accrued interest only (not penalty interests).

Can a GSI be triggered over a joint account? Yes. However, the CBN may need to clarify how GSIs are to work in relation to joint accounts. Where a GSI is triggered over a borrower’s joint account with a third party, how would the rights of the third party to the funds in the account be protected?

What happens if a GSI is triggered in error? The Guidelines provide for penalties where it is established that a Financial institution breached the provisions of the Guidelines. For example, where a Financial Institution activates a GSI in error, the bank will pay a flat fine of ₦500,000.00 and bear all liability from such erroneous GSI activation.

When will the GSI take effect? The Guidelines are to take effect from August 1, 2020 and will be applicable on all loans granted from August 28, 2019.

Conclusion.

The GSI is a good initiative which should help improve creditor confidence in the Nigerian credit system. It would also be beneficial to fintechs in Nigeria who utilize microfinance bank licences[iii] to offer credit facilities such as payday or small business loans. Fintechs/creditors who offer loans with the use of a moneylender’s license[iv]  are, however not permitted to use GSIs. Since such money lenders play a major role in improving access to credit in Nigeria, particularly to individuals, it would be useful for similar regulations to be put in place for their benefit.

[i] You can access our articles on previous guidelines issued by the CBN by clicking on this link https://pavestoneslegal.com/tag/central-bank-of-nigeria/

[ii] The CBN had previously indicated that BVNs would be utilized to assist in the recovery of loans. Please access our articles on this here https://pavestoneslegal.com/tag/bvn/

[iii] Find more articles on microfinance banks in Nigeria here  https://pavestoneslegal.com/tag/microfinance-banks/

[iv] Please access our article on Money lending services here https://pavestoneslegal.com/tag/money-lending/

Pavestones’ Regulatory Update: CBN Revised Guide to Bank Charges

/in /by

The Central Bank of Nigeria (“CBN”) recently introduced changes to the fees charged by banks and other financial institutions for electronic banking transactions; account usage and maintenance; and ATM withdrawals.

The fees were reviewed downwards and contained in the revised “Guide to Charges by Banks, Other Financial and Non-Bank Financial Institutions” (the “Guide”) issued in December, 2019.

The Effect of the Charges

The CBN believes the reduced fees will incentivize stakeholders, especially those making micropayments, to further embrace electronic banking channels which will in turn improve financial inclusion.

The revision of these charges is a welcome development to encourage financial inclusion of the under-banked in Nigeria. It is however useful to note that fintech companies in the payments space such as PalmPay and Kuda Bank are already playing an important role in improving access to finance by offering lower fees on electronic transfers and online payments.

With this reduction, it might appear on the face of things that banks are in even more competition with Fintech companies. The reality however, is that there has been a long-standing issue in Nigeria with access to finance and this competition is likely to solve this issue in good time.

We have set out the key changes in the Guide below.

Key Changes Made in the Guide

  • Electronic Transfers: Transfers between bank customers was reduced to ₦10 for transfers below ₦5,000 and ₦25 for transfers between ₦5,000 and ₦50,000 while the previous charge of ₦50 was retained for transfers above ₦50,000.
  • ATM withdrawals: The ₦65 charged after the third withdrawal within a month on other banks ATM was reduced to ₦35 after the third withdrawal within a month.
  • Current Account Charges: The card maintenance fee previously charged on current accounts was removed while the annual card maintenance fee of foreign currency denominated cards was reduced to $10 from $20.
  • Savings Account Charges: The card maintenance fee charged on savings accounts is now to be charged quarterly as opposed to monthly. The ₦50 charge was however retained.
  • Hardware Tokens: The fees charged for hardware token was reduced to a maximum of ₦2,500 from the previous maximum of ₦3,000