If you run a fintech in Nigeria, "get a pentest" has probably shown up on a compliance checklist without much explanation of what it actually means or how deep it needs to go. Then renewal season comes, or an investor asks for your last security report, or CBN sends a query, and suddenly it matters a lot.
Here's what the regulations actually say, and what to look for in a penetration testing company before you sign anything.
What CBN actually requires
CBN's Risk-Based Cybersecurity Framework and Guidelines apply to Deposit Money Banks and Payment Service Providers, and it's specific about testing, not just "have a security program."
A few things the framework spells out:
- An independent third party has to run a penetration test at least once a year. Not your internal team, not the vendor who built your app. Independent.
- Internal vulnerability scans need to happen at least quarterly.
- Internet-facing systems, meaning your customer app, your APIs, anything a stranger can reach from outside your network, should be tested more often than the once-a-year minimum.
- Your board has to see a quarterly report that includes the status of vulnerability management and penetration testing, along with what got fixed and what's still open.
That last point trips people up. CBN doesn't just want a PDF from a pentest sitting in a drawer. It wants ongoing evidence that someone is finding problems and someone is fixing them, on a cadence the board can see.
NDPR adds a second layer
Nigeria Data Protection Commission's rules cover a different angle: your customers' personal data. BVNs, transaction histories, KYC documents, all of it needs protecting under NDPR.
This is where a lot of automated "scan and generate a PDF" testing falls short. A vulnerability scanner can tell you a server is missing a patch. It usually can't tell you that your API lets User A pull User B's transaction history just by changing an ID in the request, which is a broken access control issue (often called BOLA) and one of the most common ways fintech APIs leak customer data. That's a business logic flaw, and finding it takes a person actually trying to break your app the way an attacker would, not a scanner running a signature list.
If your pentest report is just a list of outdated software versions, you've satisfied the letter of "we did a test" and missed the point of why CBN and NDPR ask for one.
What the test should actually cover
For most fintechs, a real penetration testing engagement should include:
- Web application penetration testing on your customer-facing app and any admin portals
- API penetration testing, since most Nigerian fintech products (savings apps, lending platforms, payment gateways) run on APIs connecting to core banking, BVN verification, or mobile money rails
- Network penetration testing on your internal and internet-facing infrastructure
- Cloud configuration review if you're running on AWS, Azure, or GCP, since a lot of real-world breaches come from misconfigured storage buckets and permissions rather than clever exploits
This is usually called vulnerability assessment and penetration testing, or VAPT, in the region. The "vulnerability assessment" half finds the known stuff. The "penetration testing" half is where a tester manually tries to chain smaller issues into something that actually matters, like account takeover or unauthorized fund transfer.
How to vet a penetration testing company
A few questions worth asking before you sign a scope of work:
- Is this a manual test, or an automated scan with your logo on the cover page? Ask directly. Some providers run a scanner, format the output, and call it a pentest.
- What certifications do the actual testers hold, not the company? OSCP and OSWE are reasonable things to ask about.
- Can they show a sample report (redacted, obviously)? Look for findings tied to your actual business logic, not a generic list of CVEs copied from a scanner.
- Do they retest after you fix things? CBN wants to see remediation evidence, not just a findings list from six months ago that nobody followed up on.
- Have they tested products like yours before? BVN verification flows, USSD banking, mobile money integrations, and Nigerian core banking systems all have quirks a tester who's only worked on generic SaaS apps might miss.
What a good report gives you
A report that actually helps at renewal time has:
- An executive summary your board can read in five minutes, since that's what feeds your quarterly CBN reporting
- Technical findings with clear reproduction steps, so your developers aren't guessing what the tester actually did
- Realistic remediation guidance, not just "patch this"
- A retest section confirming what got fixed and what's still open
If a report doesn't give you at least the first and last of those, it's going to be a liability the next time an auditor or investor asks to see it.