The National Cyber Security Fund – A Brief Overview

The Cybercrime (Prohibition, Prevention, etc) Act 2015 (as amended) was first passed into law in Nigeria in May 2015. The Act was deemed necessary as a result of the ever-rising influence of technology and the realization that 21st century technology, especially easy-to-access social media could, as much as it was a way of bringing the world together for ease of communication and business, also be a breeding and fertile ground for scams, frauds, bullying and other related illegal activities. This fertile ground for illegal activities has actually been on a constant rise since the late 1990s, when online scams started to become commonplace in Nigeria. The steady increase and predominance of online fraud, monetary scams amongst other related illegal activities in the country led to the need for specific legislation to curb these crimes.

Following the enactment of the Cybercrime (Prohibition, Prevention Amendment) Act 2024, the Central Bank of Nigeria (CBN) issued a directive based on Section 44 of the Act which establishes a National Cyber Security Fund (“the Fund”). The purpose of this Fund is to effectively boost the financial resources of the Federal Government and its agencies as regards the tackling of cybercrimes and other related matters through a coordinated system at a national level.

Sources of the Fund

According to Section 44 (2) of the Act, this Fund is to be comprised of monies gotten from:

•  a levy of 0.5% (0.005) equivalent to a half percent of electronic transactions value by the business specified in     the Second Schedule to the Act.
• grants-in-aid and assistance from donor, bilateral and multilateral agencies;
• all other sums accruing to the Fund by way of gifts, endowments, bequest or other voluntary contributions by persons and organizations: Provided that the terms and conditions attached to such gifts, endowments, bequest or contributions will not jeopardize the functions of the Agency;
• such monies as may be appropriated for the Fund by the National Assembly; and
• all other monies or assets that may, from time to time accrue to the Fund.

The Levy shall be remitted directly by the eligible businesses or organizations into the Fund domiciled in the Central Bank within a period of 30 days, and the Office of the National Security Adviser is tasked with administering and keeping proper records of the accounts, as well as ensuring compliance monitoring mechanism. There has been widespread rumours that the law will affect private individuals daily transactions. However, this is completely false. According to the Second Schedule of the Act, the following businesses fall under the net of remitting this levy:

• GSM Service providers and all telecommunication companies;
• Internet Service Providers;
• Banks and other Financial Institutions;
• Insurance Companies;
• Nigerian Stock Exchange

Transactions Exempted from the Levy

1.     Loan disbursements and repayments;

2.     Salary payments;

3.     Intra-account transfers between customers of the same bank;

4.     Intra-bank transfers between customers of the same bank;

5.     Other Financial Institutions (OFIs) instruction to their correspondents;

6.     Interbank placements;

7.     Banks’ transfers to CBN and vice-versa;

8.     Inter-branch transfers within a bank;

9.     Cheques clearing and settlements;

10.  Letters of Credits (LCs);

11.  Banks’ recapitalization related funding – only bulk funds movement from collect accounts;

12.  Savings and deposits including transactions involving long-term investments such as Treasury Bills, Bonds and Commercial Papers;

13.  Government Social Welfare Programs transactions e.g, Pension payments;

14.  Non-profits and charitable transactions including donations to registered non-profit organizations or charities;

15.  Educational Institutions transactions, including tuition payments and other transaction involving schools, universities or other educational institutions;

16.  Transactions involving bank’s inter accounts such as suspense accounts, clearing accounts, profits and loss accounts, inter-branch accounts, reserve accounts, nostro and vostro accounts and escrow accounts.

In this paper, we shall be considering a few legal issues from the provisions of the Act pertaining to the Fund vis-à-vis the provisions of the Constitution of the Federal Republic of Nigeria 1999 (as amended) (“the Constitution”).

To start with, the power of the CBN to issue such a directive originates from the fact that banking and related matters are under the Exclusive List in the Constitution.[1] The enactment of the CBN Act by the National Assembly in 2007 was in line with the matters in the Exclusive List preserved for regulation by the Federal Government.

By the provision of Section 162 (1) of the 1999 Constitution, all revenues collected by the Government of the Federation, except the proceeds from the personal income tax of the personnel of the armed forces of the Federation, the Nigeria Police Force, the Ministry or department of government charged with responsibility for Foreign Affairs and the residents of the Federal Capital Territory, Abuja shall be paid into a special account to be called “the Federation Account”. What this means is that all revenues collected by the Federal Government (except the exceptions listed) must go into the Federation Account first, before they may go on to be disbursed to the Agencies, Ministries and Organizations as may be needed. Nevertheless, Section 44 (4) of the Cybercrimes Act provides that the levy to be imposed shall be remitted directly by the affected businesses or organizations into the Fund domiciled in the Central Bank within a period of 30 days. This is a clear contradiction to the provisions of the Constitution, which is the grundnorm of all laws in Nigeria and must maintain its supremacy.[2]

Furthermore, Section 80 (1) of the Constitution also provides that all revenues or other money raised or received by the Federation (not being revenues or other moneys payable under this Constitution or any Act of the National Assembly into any other public fund of the Federation established for a specific purpose) shall be paid into and form one Consolidated Revenue Fund of the Federation. This would, on the face of it and if the provisions of Section 162 of the Constitution did not exist, gives full credibility to Section 44 (4) of the Cybercrimes Act. At best, we have a situation of clearly conflicting constitutional provisions. At worst, it is a lacuna with potentially far-reaching effects. This gap needs to be bridged to prevent ambiguities.

Notwithstanding the potential legal issues which have yet to be addressed by the Federal Government, the directive from the CBN is to be treated as valid and subsisting. On the 13th of May 2024, the President of the Federal Republic of Nigeria issued a directive suspending the implementation of the CBN directive and we consider it expedient that the issues highlighted above are taken into due consideration accordingly to enable a seamless implementation.

Penalty upon Failure to comply

There is no law without consequences when breached. It is important to point out that upon conviction of the offence of the failure to remit the levy as provided, any such defaulter will be liable to a fine of not less than 2% of the annual turnover of the defaulting business. Furthermore, failure to comply with the penalty shall lead to a closure of the defaulting business or a withdrawal of the defaulting business’ operational licence.

[1] See Part 1 of Schedule 2 of the 1999 Constitution

[2] See Section 1 of the 1999 Constitution