The Nigerian Senate's recent initiative to amend the Banks and Other Financial Institutions Act (BOFIA) to better accommodate fintech companies, less than five years after President Muhammadu Buhari signed the BOFIA 2020 into law, raises significant questions about the comprehensiveness of the celebrated legislation. Senator Adetokunbo Abiru's statement that fintech companies now present systemic risks comparable to or exceeding those of traditional banks suggests that the 2020 Act, despite its supposed provisions for fintech regulation, did not fully anticipate or adequately address the rapid expansion of Nigeria's digital finance ecosystem.
Fintech Provisions within BOFIA 2020
When BOFIA 2020 was enacted, it was hailed as a historic achievement, introducing explicit provisions for the regulation of fintech companies for the first time in Nigerian banking law. Section 57 of the Act stipulated that any entity operating specialized banking or other financial institution businesses, including fintech operations, must be duly incorporated in Nigeria and hold a valid license from the Central Bank of Nigeria (CBN).
Further elaborating on this, Section 69 mandated that no person could conduct any fintech business in Nigeria without proper incorporation and licensing under the Act, outlining detailed procedures for license applications. The 2020 law effectively broadened the CBN's regulatory scope to encompass what it termed "other financial institutions," thereby bringing fintech companies under banking supervision. Section 61 applied the comprehensive provisions of Chapter A, including offenses, penalties, and CBN's powers, to these entities with necessary modifications. Additionally, the Act granted the CBN Governor the authority under Section 31 to appoint directors responsible for supervising regulated entities, allowing for oversight tailored to the specific competencies of fintech companies. The legislation also addressed cybersecurity concerns, imposed requirements for information display and website advertisements, and established penalties for regulatory violations within the financial system.
Emerging Systemic Risks and Regulatory Shortcomings
Despite these provisions, the Senate's current declaration in December 2025 that large fintech operators have become systemic risks capable of destabilizing the national economy indicates that the 2020 Act, even with its explicit fintech regulatory framework, licensing requirements, and expanded CBN oversight, fundamentally misjudged the trajectory and implications of technology-driven financial services. Senator Abiru highlighted that mobile money operators, digital lenders, switching and settlement companies, wallet providers, and payment service banks now serve millions of Nigerians, process substantial daily transaction volumes, and manage vast amounts of sensitive behavioral and financial data.
The senator's assertion that the laws governing these entities no longer reflect their influence signifies that BOFIA 2020 has become obsolete just five years after its enactment. This situation suggests that the 2020 framework was based on an underestimation of fintech's scale and systemic importance.
The Senator’s warning that some fintech entities now operate at scales rivalling mid-sized banks, with data holdings carrying national security implications, exposes a fundamental gap in BOFIA 2020.
While BOFIA 2020 mandated licensing and imposed supervisory requirements, it apparently lacked mechanisms to designate certain fintech operators as systemically important institutions requiring enhanced oversight. The proposed amendment aims to establish a statutory basis for such designation, including:
- •Establishing a national registry to ensure traceability and beneficial ownership disclosure.
- •Empowering the CBN with enhanced prudential tools specifically designed for digital institutions.
- •Strengthening data sovereignty protections and bolstering consumer protection frameworks.
These proposed measures represent significant regulatory infrastructure that, according to the Senate, should have been integral to BOFIA 2020 if the full scope of the fintech challenge had been understood at the time.
Past Incidents and Ongoing Concerns
The incident in April 2024, where the CBN temporarily halted customer onboarding for several fintech firms due to failures in Know Your Customer (KYC) compliance, anti-money laundering red flags, and suspicious transactions, further underscores the insufficiency of BOFIA 2020's regulatory tools. Senator Abiru characterized this event as evidence that the scale of these institutions has outgrown existing regulatory capabilities, noting that these tools were only four years old at the time. This suggests either a failure by the drafters of BOFIA 2020 to foresee the rapid growth of fintech or a deliberate choice to create a permissive framework that prioritized innovation over systemic stability.
Senator Abiru's concerns extend to foreign ownership structures, offshore data storage, and opaque beneficial ownership networks operating beyond regulatory scrutiny. He stated that Nigeria cannot definitively ascertain the location of all financial and behavioral data processed by certain institutions, who has access to it, or which foreign jurisdictions might claim it. This situation represents a real-time sovereignty crisis. While BOFIA 2020 empowered the CBN to regulate fintech companies, it apparently did not mandate data localization, transparency in beneficial ownership, or restrictions on foreign-controlled infrastructure, omissions that now pose national security risks, according to the Senate sponsor of the new amendment.
The Senator's preference for integrating fintech oversight within the Central Bank, rather than establishing a separate regulatory agency, aligns with the original philosophy of BOFIA 2020, which already placed fintech regulation under the CBN's purview. The critical difference now is the recognized need for the CBN to possess significantly more robust powers and tools than BOFIA 2020 provided. While Senator Abiru referenced international best practices favoring central bank integration for fintech oversight, the implication is that such international standards from 2020 should have informed BOFIA 2020 itself. Nigeria's current efforts to adapt suggest a past adoption of a less assertive regulatory model than what was required.