The New CBN Regulation on USSD: Balancing Security and Thriving Innovation

The Central Bank of Nigeria (CBN) recently issued a revised circular on the regulatory framework for Unstructured Supplementary Service Data (USSD) for financial system in Nigeria. This comes on the heels of numerous fraudulent activities being perpetrated via the platform and the attendant geometric increase in fraud complaints reported. Consequently, and in order to reduce customers' expose to the platform, the CBN set daily transaction limit of N100,000.00 and a transaction cap of N20,000.00 above which a combination of PIN and token (2nd factor authentication) will be required to approve transactions effective June 1, 2018. It further required that customers who want to exceed the N100,000.00 daily limit will execute an indemnity with their Deposit Money Banks (DMBs) accepting responsibility for fraud losses arising from such. DMBs and other stakeholders in the USSD payment ecosystem were also required to take measures to ensure security of the platform by implementing encryption and VPN tunneling at all levels/layers of transaction processing.

Gains of USSD technology in Nigeria Banking System

We all agree that the USSD platform has over the years gained momentum in its rivalry over other traditional payment channels such as ATM, POS, Online Banking, mobile banking, web payment and mobile money due to its simplicity and low cost. One of the foremost Deposit Money Banks [DMBs] in Nigeria recently celebrated N1trillion [$2.75bn] milestone in transaction volume on the USSD platform alone. This is indicative of the acceptance, penetration and explosion of the USSD platform in the Nigerian payment ecosystem.

In the light of the inherent risk associated with the platform, which are concerns of undue exposure of customers/cardholder information to theft due to lack of end-to-end encryption and the inability of operators at all levels to comply with PCIDSS requirement on the handling of cardholder data, the following questions beg for answers in resolving impasse that could arise from the regulation by the CBN.

Stakeholders Concerns and Skepticism

  • Is the introduction of daily transaction limit and cap on the platform in addition to token authentication a regulatory overkill with the potential to stiffing innovation, convenience, simplicity and market penetration that the USSD platform has brought to bear in the Nigeria financial system?
  • Do you think stakeholders in the payment ecosystem were duly carried along before issuing this framework or are the CBN in conjunction with the NCC on overdrive and failed to balance security concerns vis-a-vis innovation on the platform?
  • Debate has emerged in several quarters that although the CBN intervention in the USSD operations was well intended due to rising cases of fraud and abuse witness in the system and failure of stakeholders to stem the tide, the policy will stiffing transaction volume, discourage users from using the platform and come to hunt the CBN's own financial inclusion policy, which has greatly leveraged the USSD platform for its success so far. Also, the introduction of 2nd factor authentication (token) for transactions above N20,000.00 will be counterproductive. There is an argument that soft token, which banks and other financial institutions have largely sold to its customers will not be practicable on this platform. This I find to be true. Where a user is running USSD session on the same smartphone that hold his/her soft token software, it will be impossible to quit/minimize the USSD session to go generate the soft token code. The phone won't allowed that except where different phones are used for both operations. Hence, hard token will be required and this will require banks to resume massive sale of hard token devices to customers who already have purchased the soft token meaning additional cost to customers and revenue to DMBs. This will eventually lead to a lot of frustrations.

    The Way Forward

    On the other hand, stakeholders in the USSD payment ecosystem has done little to nothing to alleviate the concerns of customers and regulators on the security of the platform. Given the lack of end-to-end encryption in the platform and the risk it portends to the payment channel, there is an expectation that stakeholders (banks, payment service providers, mobile money operators, mobile network operators/Aggregators) could come together to agree and implement common framework to reduce the risk. Aside Banks, payment service providers/switches and Transaction Aggregators who are required by CBN to be PCIDSS certified/compliant, the TELCOs are not obligated to do so despite processing cardholder data via their network. There is also concerns that they could be storing card data in the process hence, the need for end-to-end encryption of the entire process. Remote encryption key technology (HSM) have not been implemented in some of the USSD payment gateways with secure key management practices that will enhance security. Also, radio signals between the users' mobile GSM device and the base switch centre and Master switching centre are not tunneled via VPN. These are gaps stakeholders need to close to alleviate the concerns of CBN and minimize the risk posed by the platform.

    Hence, the CBN ought to have consulted widely with stakeholders who operate in the USSD space with a view to come up with a sustainable solution to the concerns identified in the USSD platform. This will ensure a collaborative effort and synergy to fix the issue and ensure a thriving platform for all rather than seemingly unilateral and unsustainable approach of stiffing the platform, which has a potential to drastically slow transaction volume and harm the platform.

    Nwabueze Ohia

    (Tech Blogger, Author & Cybersecurity Consultant)

    Will appreciate your questions and contributions on this post. For sponsorship, ad placement, speaking opportunity and training bookings, please Contact US or Send us an email at

    Back To Information and Cyber Security Jobs

    Learn More About Our Valuable IT Audit Programs/Checklists

    Learn More About Our Valuable IT Risk Assessment & Treatment Checklists/Programs

    Learn More About Leading Practices in Internal Audit Function

    Popular Articles

    Investing in Information Technology is pivotal to the success of a business and realization of enterprise goals/objectives. To create value for the business using IT.Learn More
    Fintech applications such as Online Banking has disrupted the traditional "brick and mortar" banking that we all have been accustomed to over the years. Online Banking application brought about easyLearn More
    Protecting Automated Teller Machine (ATM) network end-to-end requires layered approach to security (implementing security at ATM endpoints, physical and logical network)Learn More
    Audit management software are used to automate the process of auditing. Most standardized audit management software come handy with good audit process automation....Learn More
    The 21st century as the information/digital age has presented numerous challenges and opportunities for humanity. From widespread industrial revolution to notable advances in IT.Learn More
    Cloud computing is the practice of using network of remote computing infrastructures hosted on the Internet to store, manage, and process data for end users....Learn More
    The series attempted to answer most of the governance and management questions/concerns and how IT Governance and Management Questions are mapped to COBIT 5 Enterprise GoalsLearn More
    Remote access software are tools used to access or take full control of computing systems from a remote location either to provide support, access files...Learn More
    Privilege access mgt is one of the critical elements of user access mgt for every organization & building controls around them is vital for security of information/IT assets.Learn More
    Cybersecurity threats and attacks are a real-world problem today with thousands of organizational networks and web facing applications being compromised dailyLearn More
    Mobile hacking is an exciting field for cybersecurity enthusiast and at the same time lucrative for hackers. This is given significant rise in the number of mobileLearn More

    IT Audit, IT Risk and Cyber Security eBooks By Nwabueze Ohia

    Auditing Your Information Systems and IT infrastructure: Practical Audit Programs/Checklists for Internal AuditorsGet Now
    IT Infrastructure Risk & Vulnerability Library: A Consolidated Register of Operational & Technology Infrastructure Vulnerabilities for IT Assurance ProfessionalsGet Now
    Auditing Your Payment Cards Processes, Systems and Applications: A Step By Step PCIDSS Compliance Audit Program For Brands, Issuers, Acquirers, ProcessorsGet Now
    Auditing Your Windows Infrastructure, Intranet And Internet Security: A Practical Audit Program for Assurance ProfessionalsGet Now

    Let us know your thoughts post. Leave a Comment below.