The Nigerian Senate is initiating a fresh move to amend the Banks and Other Financial Institutions Act (BOFIA) 2020, barely five years after its initial signing into law by then-President Muhammadu Buhari. This legislative effort aims to better 'accommodate fintech' and has raised significant questions regarding the comprehensiveness and foresight of the original legislation, which was once celebrated as a historic achievement in financial regulation.

Senator Adetokunbo Abiru's assertion is central to this renewed legislative push, as he states that fintech companies now pose systemic risks that are equal to or even greater than those posed by traditional banks. This admission implies a critical oversight in the 2020 Act, suggesting that despite its much-touted provisions for financial technology regulation, it failed to adequately anticipate or address the explosive growth and evolving nature of Nigeria's digital finance ecosystem.

When BOFIA 2020 was enacted, it introduced explicit provisions for regulating fintech companies, marking a significant first in Nigerian banking law. Section 57 prohibited entities from engaging in specialized banking or other financial institution businesses, including fintech operations, without being duly incorporated in Nigeria and holding a valid Central Bank of Nigeria (CBN) license. Furthermore, Section 69 mandated that fintech businesses operate only if incorporated and licensed under the Act, detailing the application process for such licenses. The 2020 law expanded the CBN's regulatory breadth, explicitly capturing fintech companies under its banking supervision and applying the full weight of Chapter A provisions, including offences, penalties, and CBN powers, to these entities with necessary modifications. It also granted the CBN Governor authority to appoint directors for supervisory functions and addressed cybersecurity concerns, information display, website advertisements, and penalties for regulatory violations.

However, despite these foundational provisions, the current situation in December 2025 sees the Senate declaring that large fintech operators have evolved into systemic risks capable of destabilizing the national economy. This suggests that the existing laws, including BOFIA 2020, no longer accurately reflect the true influence or interconnectedness of these digital financial entities. Senator Abiru's description of the problem is particularly revealing: mobile money operators, digital lenders, switching and settlement companies, wallet providers, and payment service banks now serve tens of millions of Nigerians, process immense transaction volumes daily, and control vast stores of sensitive behavioral and financial data.

The implication is that BOFIA 2020, despite its explicit intent to regulate fintech activities, has become obsolete within a mere five years. This is not a simple matter of routine updating but indicates that the 2020 framework was built on assumptions about fintech scale and systemic importance that proved fundamentally incorrect almost immediately after its implementation. The Senator’s warning that some fintech entities now operate at scales rivaling mid-sized banks, with data holdings carrying national security implications, exposes a significant gap in BOFIA 2020. While the Act required licensing and imposed supervisory requirements, it apparently lacked the necessary mechanisms for designating certain fintech operators as systemically important institutions (SIIs) subject to enhanced oversight.

The proposed amendment seeks to rectify these critical deficiencies by creating a statutory basis for such designations. It aims to establish a national registry to ensure traceability and beneficial ownership disclosure, empower the CBN with enhanced prudential tools specifically tailored for digital institutions, strengthen data sovereignty protections, and bolster consumer protection frameworks. These are not minor technical adjustments; rather, they represent core regulatory infrastructure that should have been robustly embedded in BOFIA 2020 if lawmakers had truly grasped the complex and rapidly evolving fintech challenge at the time.

Further demonstrating the insufficiency of BOFIA 2020's regulatory tools was the April 2024 incident cited by Senator Abiru, where the CBN temporarily halted customer onboarding by several fintech firms due to Know Your Customer (KYC) compliance failures, anti-money laundering (AML) red flags, and suspicious transactions. This episode was characterized as evidence that the scale of these institutions had outgrown existing regulatory tools, which were only four years old. This suggests that the drafters of BOFIA 2020 either failed to envision the rapid expansion of fintech or intentionally created a permissive framework that inadvertently prioritized innovation over systemic stability.

Senator Abiru's concerns extend to issues of foreign ownership structures, offshore data storage, and opaque beneficial ownership networks operating beyond adequate regulatory visibility. He starkly noted that Nigeria cannot ascertain with certainty where all financial and behavioral data processed by some institutions is stored, who has access to it, or which foreign jurisdictions may claim it. This represents a profound sovereignty crisis unfolding in real-time. BOFIA 2020 empowered the CBN to regulate fintech companies, but critically omitted mandates for data localization, transparency in beneficial ownership, or restrictions on foreign-controlled infrastructure. These omissions now pose significant threats to national security, according to the Senate sponsor of the new amendment.

Interestingly, Senator Abiru’s rejection of proposals for a standalone fintech regulatory agency, instead arguing for integrating oversight within the Central Bank, aligns with the philosophical underpinning of BOFIA 2020, which already placed fintech regulation under the CBN’s authority. What has changed, however, is the stark recognition that the CBN requires far more robust powers and advanced tools than BOFIA 2020 initially provided. Abiru invoked international best practice favoring the integration of fintech oversight within central banks, yet the very fact that Nigeria is now scrambling to catch up suggests that international best practice in 2020 should have been more thoroughly incorporated into BOFIA 2020 itself. This legislative catch-up implies that Nigeria initially adopted a light-touch regulatory model when a more assertive and comprehensive framework was demonstrably needed to safeguard its financial system and national interests.