Empirical Analysis of the Predictors of Cybersecurity Policy Compliance Intention Among Nigerian Bank Employees

Understanding the determinants of cybersecurity policy compliance intention among bank employees is critical for designing effective security awareness and enforcement strategies, yet empirical evidence from the Nigerian banking sector is limited. This study empirically examined the predictors of cybersecurity policy compliance intention among employees in commercial banks in Lagos and Abuja using Protection Motivation Theory combined with General Deterrence Theory. A cross-sectional survey was conducted among 380 bank employees from 10 commercial banks selected through purposive sampling, with questionnaires assessing threat appraisal, coping appraisal, sanction severity, sanction certainty, normative beliefs, and compliance intention. Structural equation modelling was applied. Results showed that self-efficacy (beta = 0.41, p < 0.001), response efficacy (beta = 0.38, p < 0.001), and sanction certainty (beta = 0.31, p < 0.001) were the strongest positive predictors of compliance intention. Threat severity showed a significant positive direct effect only when coping efficacy was high. Social norms from peers and supervisors significantly moderated the relationship between self-efficacy and compliance intention. The model explained 52.6 percent of variance in compliance intention. The study fills an important empirical gap in Nigerian financial sector cybersecurity compliance research and recommends security training programmes focused on building self-efficacy, transparent sanctioning practices, and norm-based compliance messaging as the highest-impact interventions for improving bank employee security policy adherence. Keywords: cybersecurity policy compliance, Protection Motivation Theory, General Deterrence Theory, banking sector, Nigeria