SEC Gives Capital Market Operators Two Days To Submit Cybersecurity Risk Reports

The Securities and Exchange Commission (SEC) has directed all capital market operators to submit their cybersecurity risk assessment reports by November 5, 2026, giving them just three days to comply with the regulatory requirement.

The directive, issued in a circular dated November 2, requires operators to complete a designated cybersecurity assessment form through the commission’s electronic portal before the deadline.

The SEC said the exercise would provide regulators with an updated picture of cybersecurity risks across the capital market and help determine the industry’s preparedness to tackle emerging digital threats.

It urged operators to ensure that the information submitted accurately reflects their current cybersecurity risk profiles, stressing the importance of reliable data in assessing vulnerabilities within the financial sector.

The commission explained that the assessment forms part of a broader financial sector initiative being implemented through the Inter-Agency Cybersecurity Technical Working Group of the Financial Services Regulation Coordinating Committee (FSRCC).

The initiative is focused on strengthening cybersecurity risk management and building resilience against attacks capable of disrupting financial institutions and critical services.

Among its objectives is the development of a strategic cybersecurity risk management framework for the financial sector, alongside a comprehensive assessment to identify existing threats, system vulnerabilities and emerging digital risks.

The programme will also promote appropriate cybersecurity frameworks, standards and guidelines to enable financial institutions to better protect their systems, operations and sensitive information.

In addition, the initiative seeks to improve coordination among financial sector institutions and regulators, particularly in responding to significant cyber incidents.

The directive comes as digital technology continues to play an increasingly important role in Nigeria’s capital market, with electronic platforms supporting securities trading, investment transactions and the management of investors’ information.

The growing dependence on these systems has heightened concerns about cyberattacks, data breaches and other digital vulnerabilities that could undermine investor confidence and financial market stability.

The SEC’s latest move signals an increased regulatory focus on ensuring that capital market operators assess their exposure to cyber threats and strengthen their capacity to prevent, detect and respond to security breaches.