Nigerians lost N25.85 billion to digital payment fraud in 2025, according to Central Bank of Nigeria (CBN).

Though the figure represents a significant decline from the N52.26 billion recorded in 2024, CBN, said the losses remained substantial for payment service providers (PSPs).

According to the report, although the value of digital payment fraud declined significantly year-on-year, when compared to the N52.26 billion recorded in the previous year, the losses remained substantial for Payment Service Providers (PSPs), underscoring the need for stronger fraud prevention measures across the industry.

In the report, the CBN, also identified systemic risks, cyber threats, the dominance of a few systemically important payment service providers, and the activities of unlicensed payment companies as major concerns confronting the financial sector.

According to the report, although the value of digital payment fraud declined significantly year-on-year, the losses remained substantial for Payment Service Providers (PSPs), underscoring the need for stronger fraud prevention measures across the industry.

Advertisement

“Digital payment fraud in Nigeria stood at N25.85 billion in 2025,” the apex bank said.

It noted that while this represented a considerable improvement from the N52.26 billion lost in 2024, the amount remained significant.

“Though this was lower than N52.26 billion in the preceding year, it represented a substantial loss for PSPs,” the report stated.

The CBN attributed the reduction in fraud losses to enhanced security measures implemented across the financial sector.

It said, “The lower losses in 2025 reflected improvements in monitoring, BVN-NIN integration, and tighter controls.”

Advertisement

Beyond fraud, the report warned that Nigeria’s rapidly expanding digital payments landscape faces increasing systemic vulnerabilities as banks and fintech companies become more interconnected through shared payment infrastructure.

According to the report, a major operational failure involving a single payment service provider could quickly spread across the financial system because of the growing dependence on integrated payment platforms.

The CBN observed that despite ongoing efforts to strengthen payment system integration, interoperability remains a significant challenge.

It disclosed that about half of fintech stakeholders continued to express dissatisfaction with the current level of system-wide interoperability.

The report stated that “about 50.00 per cent of fintech stakeholders continued to rate system-wide interoperability as poor, primarily due to the lack of universal APIs and data-sharing standards.”

Advertisement

The apex bank also expressed concern over the concentration of payment activities among a few Systemically Important Payment Service (SIPS) providers, warning that operational failures involving any of them could have widespread consequences.

It explained that the failure of such providers could trigger a “domino effect”, where insolvency or operational glitches in one payment service provider spread rapidly to others, disrupting the smooth functioning of the financial system.

Cybersecurity also featured prominently among the risks identified in the report.

The CBN warned that payment service providers remain vulnerable to ransomware attacks, data breaches and credential theft, noting that cybercriminals are becoming increasingly sophisticated in targeting financial institutions.

According to the report, “Banking and fintech institutions remained prime targets for ransomware, data leaks, and credential theft.”

Advertisement

It added that, “Cyber threats in Nigeria are no longer random cybercrimes, but increasingly targeted, organised, and identity-driven campaigns.”

The report further cautioned Nigerians against transacting with unlicensed payment companies, stressing that such entities operate outside regulatory oversight and expose users to significant financial risks.

It warned that customers using unlicensed PSPs are not protected by existing regulatory safeguards and that such operators could facilitate illicit financial activities.

“Users of unlicensed PSPs are not covered by regulatory protection that comes with effective oversight and supervision,” the CBN said.

It further warned that, “Unlicenced payment companies are gateways for money laundering which could undermine regulatory efforts and corrode public trust.”

Advertisement

The report underscores the growing importance of strengthening fraud detection systems, improving payment infrastructure interoperability, enhancing cybersecurity resilience, and intensifying regulatory oversight as Nigeria continues to expand its digital payments ecosystem.

Nigeria Revenue Service (NRS) yesterday announced that medium and large companies in Nigeria that earn income from cryptocurrency and other virtual asset transactions will now be subject to a 30 per cent corporate income tax.

NRS stated this in its new guidelines setting out a tax framework for cryptocurrency and other digital asset transactions.

The guidelines cover registration, record-keeping, valuation, and tax treatment for VASPs, P2P operators, and individuals in the virtual asset space.

NRS said the move is aimed at encouraging voluntary compliance and improving transparency as Nigeria’s digital asset sector grows.

The Guidelines on the Taxation of Virtual Assets, provide a comprehensive framework for the taxation of virtual asset transactions and businesses operating within Nigeria’s digital economy.

Advertisement

The guidelines apply to companies, individual taxpayers, Virtual Asset Service Providers (VASPs), peer-to-peer (P2P) marketplace operators and other participants in the virtual asset ecosystem

The latest framework follows the signing of the Presidential Executive Order on Virtual Assets Coordination, 2026 by President Bola Tinubu, which established a coordinated regulatory structure for cryptocurrencies, stablecoins, tokenised assets and other digital assets across government agencies.

According to the NRS, companies that derive profits from virtual asset activities will be taxed under the provisions of the Nigeria Tax Act (NTA), 2025. While small companies will continue to enjoy applicable tax exemptions under the law, medium and large companies will be liable to the standard 30 per cent corporate income tax rate.

The agency stated that taxable income under the guidelines covers a broad range of virtual asset-related activities, including cryptocurrency trading, the operation of virtual asset exchanges, transaction fees, brokerage commissions, custody and wallet services, token issuance, mining, staking, decentralised finance (DeFi) activities, investment gains and other virtual asset business operations.

According to the guidelines, “Applicable rates under the NTA include progressive rates for individuals, and 30 per cent for companies other than small companies.”

Advertisement

The NRS said the guidelines were introduced to provide clarity, certainty and consistency in the administration of Nigeria’s tax laws as they apply to virtual assets, adding that the framework is intended to improve transparency, encourage voluntary tax compliance and support the development of an efficient tax regime for the digital asset sector.

The agency also clarified that merely holding cryptocurrencies or other virtual assets does not constitute a taxable event.

Any appreciation in the value of a digital asset while it remains in a taxpayer’s possession will not attract income tax until the asset is sold, exchanged or otherwise disposed of through a taxable transaction.

Similarly, transfers of cryptocurrencies or other virtual assets between wallets owned and controlled by the same individual are exempt from income tax, provided there is no change in beneficial ownership.

This means that moving digital assets such as Bitcoin or Ether between personal wallets will not trigger a tax liability.

Advertisement

However, the exemption does not extend to transfers involving companies, partnerships, trusts, unincorporated associations or other legal entities, where different tax rules may apply.

The NRS further explained that although these non-taxable transactions do not attract immediate tax, they establish the acquisition cost for future disposals.

Consequently, taxpayers are required to maintain adequate records of acquisitions, transfers and disposals to facilitate accurate tax computations when taxable events occur.

The guidelines also reaffirm that unrealised gains on cryptocurrencies and other virtual assets are not subject to income tax. Instead, tax liability arises only when a taxable disposal takes place, aligning Nigeria’s approach with internationally recognised principles for the taxation of digital assets.

The issuance of the guidelines is expected to provide greater regulatory certainty for investors, businesses and digital asset service providers, while strengthening the government’s efforts to expand the tax base and improve compliance in Nigeria’s growing virtual asset ecosystem.

Advertisement

Federal Capital Territory High Court has ordered Stanbic IBTC Bank Limited to pay N15 million in damages to two former customers after finding that the bank unlawfully retained and processed their personal information after they had terminated their banking relationship.

In a judgment delivered on July 29, Justice Kayode Agunloye also directed the bank to erase all personal data belonging to the claimants that it is not legally required to retain and restrained it from further processing or using such information without lawful authority or the customers’ consent.

The court held that the bank breached the Nigeria Data Protection Act (NDPA) 2023, the claimants’ constitutional right to privacy under Section 37 of the 1999 Constitution (as amended), and provisions of the Federal Competition and Consumer Protection Act (FCCPA).

The suit, marked CV/2190/25, was filed by David Ogundipe and Salami Tolulope Ibrahim, who argued that Stanbic IBTC continued to process their personal data for marketing purposes even after they had closed their corporate account with the bank.

According to the claimants, the account was shut following unresolved issues with the bank.

Advertisement

Despite the closure, they alleged that Stanbic IBTC continued sending promotional emails and text messages to their personal and corporate email addresses as well as their telephone numbers.

The customers said their solicitors later wrote to the bank demanding that all marketing communications cease and that their personal data should no longer be processed for promotional purposes.

Although the bank reportedly acknowledged the request and assured them that the messages would stop, the unsolicited communications allegedly continued, prompting them to seek judicial intervention.

In his ruling, Justice Agunloye held that once the banking relationship had ended and the customers had withdrawn their consent, the bank no longer had any lawful basis to process their personal data for marketing activities.

The judge ruled that the continued use of the claimants’ information amounted to an infringement of their constitutional right to privacy and constituted an unfair trade practice under the FCCPA.

Advertisement

The court consequently ordered Stanbic IBTC to delete all personal information relating to the claimants that it is not legally required to retain and to cease every form of data processing except where permitted by law or regulatory obligations.

Justice Agunloye also granted a perpetual injunction restraining the bank, its officers and agents from retaining, processing, transmitting or using the claimants’ personal data for marketing, promotional or any other unauthorised purpose.

While the claimants sought N250 million as damages, the court awarded N15 million as general damages, describing the amount as adequate compensation for the persistent unsolicited communications, the bank’s failure to honour requests for data erasure and the violation of the customers’ privacy rights.

The bank was further ordered to pay N500,000 as the cost of the suit, while the claim for N7 million as litigation expenses was dismissed for lack of sufficient proof.

Justice Agunloye directed that all monetary awards would attract 10 per cent post-judgment interest annually until fully settled.

Advertisement

However, the court declined to order the complete deletion of every record relating to the claimants, holding that banks remain under statutory obligations to retain certain customer records in compliance with financial regulations and anti-money laundering laws.

Reacting to the verdict, counsel to the claimants, O.E. Oluwadamisi of Earnest Attorneys LP, described the decision as a landmark judgment for data protection in Nigeria.

He said the ruling reinforces the mandatory nature of compliance with the Nigeria Data Protection Act and makes it clear that organisations cannot continue processing customers’ personal information after consent has been withdrawn unless authorised by law.

One of the successful claimants, David Ogundipe, welcomed the judgment, saying it represented a victory not only for the litigants but also for millions of Nigerians whose personal information is held by corporate organisations.

He expressed hope that the ruling would encourage institutions across the country to strengthen compliance with data protection laws and place greater respect on customers’ privacy rights.

Advertisement