The recent cybersecurity levy circular by the Central Bank of Nigeria (CBN) was one circular that was one too many. It drove a sharp dagger into the hearts of bank depositors as it added another layer of costs to an already overburdened bag of levies and taxes, which includes stamp duties, value-added tax (VAT), account maintenance fees, and electronic transfer fees charged by banks. According to one bank customer who requested anonymity, ‘With the new bank levy, you get a surreal feeling of being serially raped by fiscal gangsters.’
The crucial issues that require addressing include, but are not limited to, the following:
- Can public institutions be funded directly by bank deposit levies with the CBN as the collecting agent?
- Can the Office of the National Security Adviser (ONSA) receive unappropriated funding for activities?
- Since banks already charge fees for electronic transfers, does the electronic transfer levy for cybercrime protection not represent double taxation?
- Since cybercrime goes beyond bank accounts, would the levy not result in the problem of ‘free riders’, where people who do not conduct digital transactions are shielded from paying the levy while others bear the total cost of financial and digital identity protection?
- Should the levy not be seen as regressive since it penalises people for electronic/digital transactions that can be monitored while encouraging the use of anonymous cash, the primary source of funding illicit activities?
- Should ONSA be allowed to be a revenue-generating arm of government?
- Public officers miss the point about the cybercrime protection levy. It is not the size that is worrisome, but the notion that account holders will pay the government for a service already covered by financial institutions in their digital transfer charges. Besides, depositors’ funds up to N5m are already covered by the Nigeria Deposit Insurance Company (NDIC); why can’t the NDIC not manage deposit protection, whether cyber or noncyber, in collaboration with the ONSA?
- How is it operationally feasible for banks to identify wage/salary payments for informal employment or activities for exceptions?
- How do we reconcile the disparities in the levy quoted in the 2018 and 2015/2024 circular (see illustration 1 below)?
The bank depositors’ anger, frustration, and disgust are real. Considering that bank customers have to deal with the consequences of double-digit inflation, that takes a swipe at the actual value of their savings and the depreciation of the naira in the foreign exchange (FX) market, which raises the cost of domestic goods and services, the fiscal authorities’ decision to pile an additional levy on individuals and households is like ‘kicking a critically injured lion to death. According to the earlier bank depositor, the Act is neither brave nor worthy. Nevertheless, it must be understood that the Act imposing the levy is not new, as it was first passed into law in 2018 and then amended in 2024; however, the logic behind the Act and the governance implications have been generally seen as undesirable, high-handed, and disruptive. The levy announcement has stirred sections of society to react.
For example, an economist and macroeconomic policy strategist wondered why the legislature would approve a bill that allows a federal government office through the CBN to levy charges on bank depositors for amounts not subject to appropriation and approval by the National Assembly (NASS). According to the economist, ‘You easily get lost in a maze of fiscal banditry and questionable public sector logic. For example, who decides how the Office of the National Security Adviser (ONSA) spends the funds raised? What are the budget head items for the spending? How is spending accountability assured? How constitutional is funding a national security office through bank deposit debits? Will bank deposits be the only areas of cyber protection?’. Analysts note that If cyber protection goes beyond bank deposits, why should the funding of ONSA rely on money in customers’ deposit accounts and electronic transactions from these accounts?
Proshare analysts observe that global best practice is to establish a ‘black budget’ for cyber protection-related issues, which has Senate Security Committee oversight. The funding is a fiscal arrangement based on standard operating protocols (SOPs) and does not distort the pricing of commercial activities such as electronic transactions on customer deposit accounts. To stretch the argument, if the naira were to come under a currency attack, would the CBN levy depositors’ bank accounts to repel the action of foreign currency speculators? If it did, how legal would it be? Fiscal intentions may be good, but policy execution frameworks are equally crucial; killing a child to solve the problem of a headache gets the job done but leaves a bigger ethical problem.
Therefore, fiscal policy observers believe there is something viscerally wrong with the CBN levying customers’ bank accounts to fund a government office or agency’s activities. According to a Public Sector Finance lecturer at one of the local universities, ‘the monetary authorities appear to be internalising a fiscal externality by getting the CBN to cover expenses for an activity unrelated to banking directly’. He notes that banks already spend hefty sums protecting their operations from cyber threats, and the ONSA’s role should be to provide a broader canopy of protection funded through a regular budgetary process.
For context, the levy supposedly aims to improve cybersecurity efforts in Nigeria through the ONSA. However, with a significant proportion of bank capital expenditure (capex) already invested and still being invested in cybersecurity infrastructure and compliance as mandated by the CBN, analysts question the need for an additional levy and the efficacy of cybersecurity efforts by entities other than financial sector operators.
More so, the right of the ONSA to raise extra-budgetary revenue directly from Nigerians without the National Assembly’s approval as a government agency becomes difficult to accept. Analysts have also questioned the benefits to Nigerians of the social contract inherent in the levy: Is there a guarantee of minimal or no cyberattacks on Nigerians because the ONSA cyber levy has been charged to bank depositors? This is unlikely.
Furthermore, Public Sector economists have argued that diverting funds directly to the ONSA bypasses established best-practice financial oversight mechanisms. One analyst argued that with the large volume of electronic payment transactions at a record high of N600trn in 2023, a levy of 0.5% would mean a sum of between N1trn and N1.5trn would be debited (adjusting for transaction exemptions – see illustration 5), of which a significant proportion would be allocated to ONSA with little to no audit oversight. This would mean transforming the national security office into an income-generating body, which would eventually become a distraction from its vital security roles.
The imposition of the cybersecurity levy also contradicts the CBN’s initiative to promote cashless transactions and enhance cybersecurity measures within the banking sector. Instead of incentivising digital payments, the levy imposes an additional financial burden on customers with high transaction costs.
Banks and the Cybersecurity Whirlpool
Technological evolution drives innovation, growth, and development in Nigeria, allowing cybercrimes to thrive. Multiple cyberattacks have occurred at deposit money banks and payment service providers, with significant funds/amounts lost. According to the Nigeria Interbank Settlement Systems, Nigerian banks lost N159bn between 2000 and 2013 and recently lost N50.5bn between 2019 and July 2023.
To show the prevalence of cybercrime, some banks included the amount lost to fraud and forgery in the FY 2023 audited financial statement: Access Corp had the highest loss at N6.15bn, followed by Fidelity Bank at N2.09bn, Wema had N685.60m, and GTCO had N198.88m. The data provided shows the high frequency of attacks and low recovery compared to previous years. This consistent rise in cyberattacks raises questions about the quality of cybersecurity measures and the alignment of cybersecurity measures to new technologies (see Table 1 below).
Table 1:
According to the Risk-Based Cybersecurity Framework and Guidelines for DMBs and PSBs implemented in January 2019 and revised on February 24, 2024, DMBs and PSBs must have a stand-alone cybersecurity budget. The private enterprise adopting a budgetary approach to tackling cybersecurity should be adequate; an extra tax levy on vulnerable Nigerians for cybersecurity seems heavyhanded and a fiscal overkill. It implies that citizens’ accounts are debited (the amount cannot be quantified or audited) to develop cybersecurity measures, which should be the role of financial sector operators and their regulators, as is the practice in other countries.
Funding the ONSA
It is often believed that there is light at the end of every tunnel. However, it has become evident that while running through several economic and existential tunnels, Nigerians do not see the light but the openings of new tunnels.
Under the provision of Section 44 (6) of the Cybercrime (Prohibition, Prevention, etc.) (Amendment) Act 2024, “the office of the National Security Adviser shall administer, keep proper records of the accounts and shall ensure compliance monitoring mechanism.” The amendment has broadened the scope of functions of the NSA, simultaneously empowering the NSA as the administrator and record keeper of the National Cybersecurity fund flows and compliance agency.
Proshare analysts note that administering a 0.5% cybersecurity levy on online transactions has been a longstanding provision of the Cybercrime Act of 2015. Despite its inclusion in the legislation, the government has not enforced the levy since its inception, and rightly so; it smacks of fiscal arm-twisting and public sector brigandage. The ONSA’s funding must sit within a budgetary framework with all the necessary guardrails (see illustration 2 below).
Illustration 2:
While the cybersecurity levy could potentially improve national cybersecurity infrastructure, concerns arise regarding its impact on citizens’ financial situation and the government’s approach to addressing cybersecurity concerns.
Citizens question whether the Act was meant to generate more revenue for the government. If so, is it not against the Nigerian constitution? Specifically, section 14(2)(b) of the Nigerian Constitution of 1999 [as amended] provides that ”the security and welfare of the people shall be the primary purpose of government.” Is this provision in line with the security and welfare of the people, or are there fiscal imperatives behind the amended Act beyond security concerns?
The guidelines outlined in the CBN Risk-Based Cybersecurity Framework for Deposit Money Banks (DMBs) and Payment Service Banks (PSBs) stipulate that banks need a cybersecurity budget to allocate resources toward cybersecurity measures. Notably, banks within Nigeria’s financial sector are already committing substantial investments to adopt cybersecurity technologies.
Given the potential ramifications for national security, it is worth questioning why the government did not opt to incorporate provisions for cybersecurity within the budget allocated to the National Security Adviser but to put an additional bullet item on the list of bank levies (see illustration 3 below).
Illustration 3:
Avoiding a Fiscal Extortion Racket
A recent report by SBM Intelligence revealed that up to 98% of Nigerians operating in the informal economy are subjected to daily taxes of up to N3,000 for different groups. Contrary to the narrative of Nigerians paying the lowest taxes anywhere in the world, this paints a grim picture of the already overtaxed and overburdened population, particularly the low-income earners.
Amidst the current runaway food inflation (40% in March 2024) and headline inflation (33.20% in March 2024), depreciating FX, and high cost of living, analysts have expressed concerns over the government’s unsubtle tax moves. In the current low-income situation, these levies further burden poor Nigerians struggling to make ends meet. Analysts believe introducing more levies could reverse the progress recorded in the country’s financial inclusion drive.
Coincidentally, FBNH, like other banks, recently explained to customers that it is reintroducing fees for deposits exceeding N500,000 for individuals and corporate account holders. Such charges on customer transactions have already driven some Nigerians out of the banking system, with individuals opting to hold more significant cash balances. As a temporary relief, the CBN, in a May 6, 2024 circular, extended the suspension of such deposit processing fees until September 30, 2024, which suggests moving the (evil) days forward.
The cumulative effect of these charges, alongside existing taxes such as stamp duty, transfer commission, VAT, levies, and SMS fees, has exacerbated the financial strain on individuals and businesses, especially SMEs reliant on electronic money transfers for daily transactions. With the proposed cybersecurity levy in the next two weeks, analysts warn that the government’s approach resembles nothing short of a public extortion racket.
Critics have also pointed out that the Taiwo Oyedele-led Presidential Committee on Fiscal Policy and Tax Reforms should have been consulted to see how the new levy fits into a harmonised national tax system that does not nibble away at Nigerian incomes by a thousand little bites. Taxation should not be seen as a punishment but as a citizen’s obligation to national development, security, and social harmony. However, if the basis of the tax is difficult to understand, taxation without representation becomes tyranny. Fiscal policy analysts have argued that the Committee’s efforts at streamlining taxation would be lame if the government habitually charges levies on every deposit or income in sight to balance a serially leaky fiscal book. Rather than impose levies on electronic financial transactions, economists have recommended that the government look for cost savings in its activities and increase the budget of the ONSA to cover the cost of cybersecurity (see illustration 4 below).
The recent cybersecurity levy circular by the Central Bank of
Nigeria (CBN) was one circular that was one too many. It drove a sharp dagger
into the hearts of bank depositors as it added another layer of costs to an
already overburdened bag of levies and taxes, which includes stamp duties,
value-added tax (VAT), account maintenance fees, and electronic transfer fees
charged by banks. According to one bank customer who requested anonymity, ‘With the new bank levy, you get a surreal feeling of being
serially raped by fiscal gangsters.’ The crucial issues that require addressing include, but are not
limited to, the following:
levies with the CBN as the collecting agent?Can the Office of the National Security Adviser (ONSA)
receive unappropriated funding for activities?Since banks already charge fees for electronic transfers,
does the electronic transfer levy for cybercrime protection not represent
double taxation?Since cybercrime goes beyond bank accounts, would the levy
not result in the problem of ‘free riders’, where people who do not
conduct digital transactions are shielded from paying the levy while
others bear the total cost of financial and digital identity protection?
Should the levy not be seen as regressive since
it penalises people for electronic/digital transactions that can be
monitored while encouraging the use of anonymous cash, the primary source
of funding illicit activities?Should ONSA be allowed to be a revenue-generating arm of
government?Public officers miss the point about the cybercrime
protection levy. It is not the size that is worrisome, but the notion that
account holders will pay the government for a service already covered by
financial institutions in their digital transfer charges. Besides,
depositors’ funds up to N5m are already covered by the Nigeria Deposit
Insurance Company (NDIC); why can’t the NDIC not manage deposit
protection, whether cyber or noncyber, in collaboration with the ONSA?How is it operationally feasible for banks to identify
wage/salary payments for informal employment or activities for exceptions?How
do we reconcile the disparities in the levy quoted in the 2018 and
2015/2024 circular (see illustration 1
below)?
Considering that bank customers have to deal with the consequences of
double-digit inflation, that takes a swipe at the actual value of their savings
and the depreciation of the naira in the foreign exchange (FX) market, which
raises the cost of domestic goods and services, the fiscal authorities’
decision to pile an additional levy on individuals and households is like ‘kicking a critically injured lion to death. According to the
earlier bank depositor, the Act is neither brave nor worthy. Nevertheless, it
must be understood that the Act imposing the levy is not new, as it was first
passed into law in 2018 and then amended in 2024; however, the logic behind the
Act and the governance implications have been generally seen as undesirable,
high-handed, and disruptive. The levy announcement has stirred sections of
society to react. For example, an economist and macroeconomic policy strategist
wondered why the legislature would approve a bill that allows a federal
government office through the CBN to levy charges on bank depositors for
amounts not subject to appropriation and approval by the National Assembly
(NASS). According to the economist, ‘You easily get lost
in a maze of fiscal banditry and questionable public sector logic. For example,
who decides how the Office of the National Security Adviser (ONSA) spends the
funds raised? What are the budget head items for the spending? How is spending
accountability assured? How constitutional is funding a national security
office through bank deposit debits? Will bank deposits be the only areas of
cyber protection?’. Analysts note that If cyber protection goes beyond bank
deposits, why should the funding of ONSA rely on money in customers’ deposit
accounts and electronic transactions from these accounts? Proshare analysts observe that global best practice is to
establish a ‘black budget’ for cyber protection-related issues, which has
Senate Security Committee oversight. The funding is a fiscal arrangement based
on standard operating protocols (SOPs) and does not distort the pricing of
commercial activities such as electronic transactions on customer deposit
accounts. To stretch the argument, if the naira were to come under a currency
attack, would the CBN levy depositors’ bank accounts to repel the action of
foreign currency speculators? If it did, how legal would it be? Fiscal
intentions may be good, but policy execution frameworks are equally crucial;
killing a child to solve the problem of a headache gets the job done but leaves
a bigger ethical problem. Therefore, fiscal policy observers believe there is something
viscerally wrong with the CBN levying customers’ bank accounts to fund a
government office or agency’s activities. According to a Public Sector Finance
lecturer at one of the local universities, ‘the monetary
authorities appear to be internalising a fiscal externality by getting the CBN
to cover expenses for an activity unrelated to banking directly’. He notes that banks
already spend hefty sums protecting their operations from cyber threats, and
the ONSA’s role should be to provide a broader canopy of protection funded
through a regular budgetary process. For context, the levy supposedly aims to improve cybersecurity
efforts in Nigeria through the ONSA. However, with a significant proportion of
bank capital expenditure (capex) already invested and still being invested in
cybersecurity infrastructure and compliance as mandated by the CBN, analysts
question the need for an additional levy and the efficacy of cybersecurity
efforts by entities other than financial sector operators. More so, the right of the ONSA to raise extra-budgetary revenue
directly from Nigerians without the National Assembly’s approval as a
government agency becomes difficult to accept. Analysts have also questioned
the benefits to Nigerians of the social contract inherent in the levy: Is there
a guarantee of minimal or no cyberattacks on Nigerians because the ONSA cyber
levy has been charged to bank depositors? This is unlikely. Furthermore, Public Sector economists have argued that diverting
funds directly to the ONSA bypasses established best-practice financial oversight mechanisms.
One analyst argued that with the large volume of electronic
payment transactions at a record high of N600trn in 2023, a levy of 0.5% would
mean a sum of between N1trn and N1.5trn would be debited (adjusting for transaction exemptions – see illustration 5), of which a significant proportion would be allocated to ONSA
with little to no audit oversight. This would mean transforming the national
security office into an income-generating body, which would eventually become a distraction
from its vital security roles. The imposition of the cybersecurity levy also contradicts the
CBN’s initiative to promote cashless transactions and enhance cybersecurity
measures within the banking sector. Instead of incentivising digital payments,
the levy imposes an additional financial burden on customers with high
transaction costs. Banks and the Cybersecurity Whirlpool Technological
evolution drives innovation, growth, and development in Nigeria, allowing
cybercrimes to thrive. Multiple cyberattacks have occurred at deposit money
banks and payment service providers, with significant funds/amounts lost.
According to the Nigeria Interbank Settlement Systems, Nigerian banks lost
N159bn between 2000 and 2013 and recently lost N50.5bn between 2019 and July
2023. To show
the prevalence of cybercrime, some banks included the amount lost to fraud and
forgery in the FY 2023 audited financial statement: Access Corp had the highest
loss at N6.15bn, followed by Fidelity Bank at N2.09bn, Wema had N685.60m, and
GTCO had N198.88m. The data provided shows the high frequency of attacks and
low recovery compared to previous years. This consistent rise in cyberattacks
raises questions about the quality of cybersecurity measures and the alignment
of cybersecurity measures to new technologies (see Table 1
below). Table 1: According
to the Risk-Based Cybersecurity Framework and Guidelines for DMBs and PSBs
implemented in January 2019 and revised on February 24, 2024, DMBs and PSBs
must have a stand-alone cybersecurity budget. The private enterprise adopting a
budgetary approach to tackling cybersecurity should be adequate; an extra tax
levy on vulnerable Nigerians for cybersecurity seems heavyhanded and a fiscal
overkill. It implies that citizens’ accounts are debited (the amount cannot be
quantified or audited) to develop cybersecurity measures, which should be the role of
financial sector operators and their regulators, as is the practice in other
countries. Funding the ONSAIt is
often believed that there is light at the end of every tunnel. However, it has
become evident that while running through several economic and existential
tunnels, Nigerians do not see the light but the openings of new tunnels. Under the
provision of Section 44 (6) of the Cybercrime (Prohibition, Prevention, etc.)
(Amendment) Act 2024, “the office of the National Security
Adviser shall administer, keep proper records of the accounts and shall ensure
compliance monitoring mechanism.” The amendment has broadened the scope of
functions of the NSA, simultaneously empowering the NSA as the administrator
and record keeper of the National Cybersecurity fund flows and compliance
agency. Proshare analysts
note that administering a 0.5% cybersecurity levy on online transactions has
been a longstanding provision of the Cybercrime Act of 2015. Despite its
inclusion in the legislation, the government has not enforced the levy since
its inception, and rightly so; it smacks of fiscal arm-twisting and public
sector brigandage. The ONSA’s funding must sit within a budgetary framework
with all the necessary guardrails (see illustration 2
below). Illustration 2: While the
cybersecurity levy could potentially improve national cybersecurity
infrastructure, concerns arise regarding its impact on citizens’ financial
situation and the government’s approach to addressing cybersecurity concerns. Citizens
question whether the Act was meant to generate more revenue for the government.
If so, is it not against the Nigerian constitution? Specifically, section
14(2)(b) of the Nigerian Constitution of 1999 [as amended] provides that ”the security and welfare of the people shall be the primary
purpose of government.” Is this provision in line with the security and welfare of the people,
or are there fiscal imperatives behind the amended Act beyond security
concerns? The
guidelines outlined in the CBN Risk-Based Cybersecurity Framework for Deposit
Money Banks (DMBs) and Payment Service Banks (PSBs) stipulate that banks need a
cybersecurity budget to allocate resources toward cybersecurity measures.
Notably, banks within Nigeria’s financial sector are already committing
substantial investments to adopt cybersecurity technologies. Given the
potential ramifications for national security, it is worth questioning why the
government did not opt to incorporate provisions for cybersecurity within the
budget allocated to the National Security Adviser but to put an additional
bullet item on the list of bank levies (see illustration 3
below). Illustration 3: Avoiding a Fiscal Extortion RacketA recent
report by SBM Intelligence revealed that up to 98% of Nigerians operating in
the informal economy are subjected to daily taxes of up to N3,000 for different
groups. Contrary to the narrative of Nigerians paying the lowest taxes anywhere
in the world, this paints a grim picture of the already overtaxed and
overburdened population, particularly the low-income earners. Amidst
the current runaway food inflation (40% in March 2024) and headline inflation
(33.20% in March 2024), depreciating FX, and high cost of living, analysts have
expressed concerns over the government’s unsubtle tax moves. In the current
low-income situation, these levies further burden poor Nigerians struggling to
make ends meet. Analysts believe introducing more levies could reverse the
progress recorded in the country’s financial inclusion drive. Coincidentally,
FBNH, like other banks, recently explained to customers that it is
reintroducing fees for deposits exceeding N500,000 for individuals and
corporate account holders. Such charges on customer transactions have already
driven some Nigerians out of the banking system, with individuals opting to
hold more significant cash balances. As a temporary relief, the CBN, in a May
6, 2024 circular, extended the suspension of such deposit processing fees until
September 30, 2024, which suggests moving the (evil) days forward. The
cumulative effect of these charges, alongside existing taxes such as stamp
duty, transfer commission, VAT, levies, and SMS fees, has exacerbated the
financial strain on individuals and businesses, especially SMEs reliant on
electronic money transfers for daily transactions. With the proposed cybersecurity
levy in the next two weeks, analysts warn that the government’s approach
resembles nothing short of a public extortion racket. Critics
have also pointed out that the Taiwo Oyedele-led Presidential Committee on
Fiscal Policy and Tax Reforms should have been consulted to see how the new
levy fits into a harmonised national tax system that does not nibble away at
Nigerian incomes by a thousand little bites. Taxation should not be seen as a
punishment but as a citizen’s obligation to national development, security, and
social harmony. However, if the basis of the tax is difficult to understand,
taxation without representation becomes tyranny. Fiscal policy analysts have
argued that the Committee’s efforts at streamlining taxation would be lame if
the government habitually charges levies on every deposit or income in sight to
balance a serially leaky fiscal book. Rather than impose levies on electronic
financial transactions, economists have recommended that the government look
for cost savings in its activities and increase the budget of the ONSA to cover
the cost of cybersecurity (see illustration 4
below).
