Few pieces of recent Nigerian legislation have caused as much confusion as the Cybersecurity Levy. It was announced, briefly implemented, suspended within weeks after public backlash, and the confusion never fully cleared up. A lot of small business owners are still asking a version of the same question: "do I need to be paying this?"
Here's what the levy actually is, and why the honest answer for most small businesses is different from what the headlines suggested.
Where the levy comes from
The Cybercrime (Prohibition, Prevention, etc.) (Amendment) Act 2024, signed into law in February 2024, introduced a National Cybersecurity Fund, financed by a levy of 0.5% of the value of electronic transactions. The fund sits under the Office of the National Security Adviser.
Who the law actually names as responsible for remitting it
This is the detail that got lost in the public reaction. The Act specifies particular categories of business as the entities required to collect and remit the levy: GSM service providers and telecoms companies, internet service providers, banks and other financial institutions, insurance companies, and the Nigerian Stock Exchange.
The levy is designed to be deducted at the point an electronic transaction passes through one of these named institutions, not separately calculated and filed by every business that happens to receive or send electronic payments. If you run a shop, a consultancy, or a small company that simply uses a bank account, you are not the one remitting this levy to the government. Your bank is.
That distinction is exactly why the announcement caused so much alarm. Read quickly, "a levy on electronic transactions" sounds like something every business needs to register for and file separately. Read against the actual text, it's a deduction handled by specific financial and telecom institutions, not a new compliance task added to a typical SME's to-do list.
Why it was suspended, and where it stands now
A law being suspended after public backlash doesn't mean the underlying legal provision disappeared. It usually means implementation was paused while the mechanics got worked out, which is exactly what happened here.
In May 2024, the Central Bank of Nigeria issued a circular directing banks and payment service providers to begin implementing the levy. Within days, following significant public pushback over the potential cost to ordinary transactions, the House of Representatives directed the CBN to suspend implementation, and the CBN issued a revised circular retracting the directive. The underlying law was never repealed, only its rollout was paused, which is why the levy has resurfaced in guidance and discussion since, and why the compliance obligation for the named institutions hasn't gone away even during periods when public attention moved on.
Given how much this has moved since 2024, treat the current live-implementation status as something to confirm at the time you're reading this, not something to assume from what you remember hearing about it.
What happens if a named institution doesn't remit it
For the businesses the Act actually targets, the consequence isn't minor. A fine of not less than 2% of annual turnover, or potential closure of the business or withdrawal of its operating licence, applies to entities that fail to remit as required.
What this actually means for a typical small business
If you're not a telecom operator, ISP, bank, financial institution, insurer, or the Nigerian Stock Exchange, the direct compliance obligation to remit this specific levy doesn't sit with you. What might affect you indirectly is a bank or payment provider passing through a small transaction charge as part of complying with the levy on their end, which is a pricing question to raise with your bank, not a filing obligation for your business.
Where this genuinely does matter to you is the broader point behind it: Nigeria is actively funding and building out national cybersecurity infrastructure, and separately, your own obligations around data protection and cybersecurity, under the NDPA rather than this specific levy, apply to your business regardless of size. Those are worth getting right on their own terms, not because of this levy.
Do online businesses or e-commerce stores need to remit the levy separately?
No. The obligation to collect and remit sits with the named financial and telecom institutions the electronic transaction passes through, not with the merchant or business receiving payment.
Has the Cybersecurity Levy been permanently cancelled?
No. What was suspended in 2024 was the implementation directive to banks, not the underlying legal provision. Given how this has shifted before, confirm the current status directly rather than assuming it's either fully active or fully cancelled.
If my bank charges me a fee referencing the Cybersecurity Levy, is that legitimate?
It's worth asking your bank to clarify exactly what the charge relates to and how it's calculated. Financial institutions are the entities named in the Act, so a legitimate levy-related deduction can appear on your statement, but it should be identifiable and explained, not just an unexplained line item.
Confirming where you actually stand
The Cybersecurity Levy is a good example of a law that generated far more anxiety than it should have for most small business owners, because the headline ("new tax on electronic transactions") didn't match who the law actually targets. If you're not sure whether a specific regulatory requirement, this one or another, genuinely applies to your business, that's a much cheaper question to get answered directly than to keep guessing at.
Need help with this?
Awal Global Consults helps businesses confirm their actual regulatory obligations, including which levies genuinely apply to them, rather than guessing from headlines.