April 23, 2024

  • Bitcoin(BTC)$24,383.00-1.66%
  • Ethereum(ETH)$1,657.83-2.53%
  • Tether(USDT)$1.000.18%
  • BNB(BNB)$310.23-1.26%
  • USD Coin(USDC)$1.000.10%
  • XRP(XRP)$0.39-0.81%
  • Binance USD(BUSD)$1.000.05%
  • Cardano(ADA)$0.39-2.73%
  • Dogecoin(DOGE)$0.09-2.67%
  • Polygon(MATIC)$1.38-6.66%

The Legality and Challenges of CBN’s Social Media KYC Directive

0 56
CBN - BVN, NIN, New accounts broad money

CEM INSIGHT, LEGAL | The ‘CBN (Customer Due Diligence) Regulations, 2023’ was recently published in the federal gazette by the Central Bank of Nigeria (CBN). The regulations direct all Deposit Money Banks (DMBs) to obtain comprehensive information about their customers, including details of customers’ social media handles as part of ‘Know Your Customer’ (KYC) procedures. KYC requirement for banks in Nigeria is a global best practice and an Anti-Money Laundering (AML) measure that places an obligation on banks to properly identify customers, verify their identity and assess the financial risk related to each customer. The ultimate aim, beyond record keeping and credit profiling is to prevent illegally obtained money (or money intended for illicit purposes) from entering the financial system. It is not new to the Nigerian financial sector. However, the provision mandating banks to obtain details of social media handles of customers as part of KYC requirements is a new development; and it has led to some uproar.

social media

According to a CBN circular dated the 20th of June 2023, the regulations are made pursuant to the provisions of the Money Laundering (Prevention and Prohibition) Act 2022 and the CBN AML/CFT/CPF (Anti-Money Laundering, Combating the Financing of Terrorism and Countering Proliferation Financing) Regulations 2022. This, on the surface, presupposes that the aim of the regulation and its additional KYC requirements is to better assess financial risk and prevent fraud, money laundering and terrorism financing. This move should ordinarily be lauded as a positive step in the right direction, especially as Nigeria was rated as a high-risk country for money laundering and terrorist financing by the Basel Institute on Governance last year. On the contrary, it has been met with skepticism by a populace who are weary of overbearing government regulation. Particularly, the legality of section 6 of the regulations that require banks to obtain social media handles of individuals and corporate entities (Sub-sections a(iv) and b(iii) respectively) as part of KYC measures has been called to question.


The core mandate of the CBN, displayed conspicuously on its website, is the overall control and administration of the monetary and financial sector policies of the Federal Government of Nigeria. The principal objects of the CBN, are set out in Section 2 (a)-(e) of the CBN Act 2007; it includes the promotion of a sound financial system in Nigeria (sub-section (d)), amongst other things. The Banks and Other Financial Institutions Act (BOFIA) 2020 is also a key legislation that makes the CBN the chief regulator of banking activities and empowers the CBN Governor, in Section 56, to make rules and regulations for the operation and control of all institutions under the supervision of the bank – that is, all financial institutions. Clearly, the CBN is the chief regulator of banking activities in Nigeria and it has the power to makes regulations in that regard. The question then is whether the CBN is, perhaps, over-extending its powers in relation to section 6(a)(iv) and 6(b) (iii) of the recently published regulations.

One quarter from where there has been audible criticism of those provisions is the Nigeria Data Protection Commission (NDPC), which has declared that the provisions in the CBN regulations go against proper legal procedures. The leading objective of NDPC’s establishing Act, the Nigeria Data Protection Act (NDPA) (Signed into law by President Tinubu on June 12, 2023) in Part 1, Section 1 of the Act is to “safeguard the fundamental rights and freedoms, and the interests of data subjects, as guaranteed under the Constitution of the Federal Republic of Nigeria”. It is noteworthy that “Data Subjects” in the Act refers to individuals to whom personal data relates. The NDPC, in a signed statement, raised some compelling issues with the CBN regulations, when the commission made reference to “purpose limitation” (Section 24(1)(b) of the NDPA) which means that the purpose for data collection must be clearly stated and “data minimisation” (Section 24(1)(c) of the NDPA) which means that data cannot be collected beyond the purpose for which it was intended. The offending provisions of the new CBN regulations fall short of this legal requirement has it does not satisfy those two key pre-conditions. There is also the requirement for a data privacy impact assessment mandated in section 28(1) of the NDPA which has apparently not been complied with.

Furthermore, the published CBN regulations in Section 6 places an obligation on banks to “identify” customers and obtain information, including social media handles, but in section 7 it is silent on verification and confirmation of social media handles, whereas measures for verification and confirmation of other obtained information like date of birth, identity card, passport, residential address, phone number etc. were provided for. This again calls into question, the rationale behind the inclusion of social media handles and it exposes the CBN’s awareness of the unreliability of such data. This leads to another question: Why include it? As a social media user, it is evident that individual handles are unreliable and often do not carry any personal identification markers of the users behind them. Besides, as the description implies, ‘social media’ exists for digital social interaction by individuals and corporate entities; and it is largely unregulated; although governments, including Nigeria, have demonstrated a desire to increase regulation in this area.

[READ ALSO] Fighting Cybercrime in Banks

The subject of regulation of social media brings to mind the seemingly aborted “Protection from Internet Falsehood and Manipulation Bill, 2019,” otherwise known as the social media Bill. The Bill was strongly condemned by Nigerians, but it had a sizeable number of supporters, particularly amongst public office holders that saw social media users as excessively abusive and disrespectful, citing other reasons like the spread of fake news as reasons for passage of such a bill. One curious case was that of the young northern student in 2022 who was tracked down and prosecuted by the Department of State Security (DSS) for his insulting comments on social media about the wife of former President Buhari, Aisha Buhari. It was a taste of how state power can be misused in a clime of stronger social media regulation. As such, tying social media handles to bank accounts can spell a bad omen for individual rights, freedom of expression and association etc., especially when the CBN regulation is vague on purpose and usage of this information.

Another consideration on this issue, from the government point of view, re-opens another scar on the nation’s consciousness; the EndSars protests in 2020. The protests were largely mobilized via social media, from where large amounts of money was sourced, collated and deployed to sustain the protests that shook the heart of the government. In the aftermath of the protests the leading figures in the protests, who operated through social media, revealed how their bank accounts were frozen during the time of the protests and in the immediate period after the protests. The un-official leaders of the protests, who were mainly young adult females referred to as the Feminist Coalition would later be accused of fraud and the diversion of $51,000 in bitcoin raised during the protest. It is not a wild guess that the government and regulators, including security agencies, were paying close attention to the developments at the time. Could this new CBN regulation be a move by the government to deter such bold steps in the future through the instrumentality of social media? Although there may be facts to hide behind in justification by the CBN, it appears that the benefits of such deterrence far outweigh the economic costs to Nigeria.

Available data simply does not encourage this directive by the CBN. According to a 2021 KPMG KYC survey, as at December 2019, Nigeria’s financial inclusion rate stood at 63.2%. This was a massive improvement from pre-2013 levels before the CBN introduced the 3-tier KYC system in 2013 that allowed low- and middle-income Nigerians open bank accounts with minimal requirements. The CBN itself has set a target of 95% financial inclusion by 2024 which it may not reach if its directive excludes people with no social media presence, as should be their right. Added to this is the cost and burden of compliance by banks with ever increasing CBN regulations, as they are already burdened to verify identity of customers in disparate systems in immigration, road safety, INEC, etc. because of the lack of a unified identity management system. According to Statista, only about 31.6 million social media users exist in Nigeria as at January 2023- which is equivalent to 14.3 per cent of the total population. The wisdom of collection of social media handles as part of KYC requirements for solely banking purposes is thus questionable.

In the end, it is unlikely and inconceivable that terrorists, fraudsters and corrupt public officials would foster their illicit desires publicly on social media; nor is their social media handles likely to feature in any payment or transaction advice. What is possible and likely is that businesses and individuals would curb their social media usage for fear of their political and personal expressions and preferences being used against them to hurt their finances, in contravention of their rights to freedom of expression under Part IV of the 1999 constitution and Article 19 of the Universal Declaration of Human Rights. The government would win a coup in reduced self-expression by Nigerians on social media but the country would take a big hit in reduced individual, business and commercial engagement on social media in a world where commerce is going digital. It is unclear how social media KYC requirements helps the CBN promote a sound financial system; the CBN may wish to reverse itself – and it is not enough to ‘not enforce’ that particular regulation. If it remains in the books, it remains binding.

Share this

Leave a Comment

glo advert
WP Twitter Auto Publish Powered By : XYZScripts.com