The CBN RBCF CSAT deadline of 28 February 2026 has passed.
For banks that missed the deadline, submitted incomplete evidence, or are unsure of submission quality, the situation now requires immediate attention.
While many institutions treat compliance as a periodic task, the Central Bank of Nigeria (CBN) treats it as a continuous supervisory requirement. As a result, any gaps in submission are no longer theoretical but formally recorded.
At the same time, the regulatory environment has evolved. CBN has strengthened its oversight structure and now applies cybersecurity supervision with the same rigour as financial and AML compliance.
In 2026, this shift is clear. Banks must demonstrate a credible cybersecurity posture, supported by documentation, governance, and a defined roadmap. Because of this, the CBN RBCF CSAT deadline is now a critical regulatory checkpoint.
As a result, institutions must treat cybersecurity compliance as an operational priority, not a one-time submission exercise
The CBN RBCF CSAT is a mandatory annual cybersecurity self-assessment required for all Deposit Money Banks and Payment Service Banks in Nigeria.
It requires:
– A full cybersecurity maturity assessment – Identification of gaps across RBCF domains – A documented roadmap toward a target state – CISO endorsement – Executive management sign-off
The submission is not advisory. It is a formal regulatory requirement used by CBN to evaluate institutional cybersecurity posture.