Analytical Study of Cybersecurity Regulatory Compliance Challenges in Nigerian Fintech Startups

Nigerian fintech startups face overlapping cybersecurity regulatory requirements from CBN, NDIC, and NITDA, yet the specific compliance challenges they face and the evidence base for addressing them is inadequate. This study analytically examined cybersecurity regulatory compliance challenges in Nigerian fintech startups through systematic review and original primary research. A scoping review of nine databases identified 31 publications from 2020 to 2024 on fintech regulatory compliance in sub-Saharan Africa, of which only 3 were from Nigeria addressing cybersecurity compliance. Original survey research was conducted with 60 fintech startup founders, CTOs, and compliance officers in Lagos and Abuja. Results showed that 73.3 percent found overlapping CBN and NITDA requirements confusing or contradictory. Compliance cost was rated as prohibitive by 58.3 percent of startups with fewer than 20 employees. Most (78.3 percent) relied on ad hoc consultants rather than in-house expertise for regulatory navigation. Only 31.7 percent had achieved full CBN Cybersecurity Framework compliance. The study identifies four analytical dimensions of the compliance challenge: regulatory fragmentation, proportionality mismatch, skills scarcity, and cost burden disproportionality. A Regulatory Sandbox Cybersecurity Compliance Tier framework is proposed as an original contribution, and CBN-NITDA harmonisation of fintech cybersecurity requirements is recommended as the primary structural reform to reduce compliance burden on early-stage Nigerian fintech companies.

Keywords: regulatory compliance, fintech startups, CBN cybersecurity, Lagos, compliance challenges