Nigeria regulates AI agents through its sector supervisors and its data protection law. The Central Bank of Nigeria oversees banks and payment firms, SEC Nigeria covers capital market operators, and NAICOM covers insurers. The Nigeria Data Protection Commission enforces the Nigeria Data Protection Act 2023, which governs agents' use of personal data, including decisions made by automated means.
What do the rules require, in plain words?
The CBN. Banks, microfinance banks, payment service providers and other licensed institutions must manage risk, protect customers, keep accurate records and maintain sound IT and cyber security. Customer protection rules require fair treatment, clear disclosure and effective complaint handling. Outsourcing does not move accountability: the licensed institution answers for services provided on its behalf.
SEC Nigeria. Capital market operators must know their clients, give suitable advice, avoid misleading clients and keep records. Firms using technology to serve clients remain responsible for what that technology does.
NAICOM. Insurers must treat policyholders fairly, settle claims properly and manage operational risk. Claims and underwriting decisions remain the insurer's responsibility.
The Nigeria Data Protection Act 2023. Personal data must be processed lawfully, fairly and transparently, for specified purposes, minimised, accurate, kept no longer than needed and secured. Controllers need a lawful basis such as consent, contract, legal obligation or legitimate interest. People have rights of access, correction, erasure, objection and data portability, and a right not to be subject to decisions based solely on automated processing that significantly affect them, subject to exceptions and safeguards. Controllers must assess high-risk processing, notify breaches promptly and use processors only under written terms. Controllers of major importance face registration and extra duties.
Who does it apply to?
CBN rules apply to licensed banks and payment institutions; SEC Nigeria rules to capital market operators; NAICOM rules to insurers and intermediaries. The NDPA applies to controllers and processors established in Nigeria, and to those outside Nigeria processing personal data of people in Nigeria.
What does this mean when the system is an agent that acts?
Several features of the Nigerian market shape how these rules reach agents.
Agents meet customers on many channels. Agents answering on messaging apps, USSD menus and voice handle high volumes of short requests: balance enquiries, failed transfer queries, reversals and card issues. Failed and disputed transfers are a frequent source of complaints. An agent can find the transaction and explain its status, but any reversal or refund must follow CBN customer protection and dispute rules, with the institution accountable.
Identity checks come first. Account takeover through social engineering is a known risk. The agent must receive a verified customer status from your authentication process before it reads or discloses account information.
Automated decisions are restricted by statute. An agent that declines credit, restricts an account or rejects a claim on its own can engage the NDPA's protection against solely automated decisions with significant effects. Our article on NDPA automated decision-making and AI agents sets out the safeguards.
Cross-border processing needs a basis. Many agent platforms and model providers process data outside Nigeria. The NDPA permits transfers only where adequate protection or another permitted basis exists.
The sector picture is developed in AI agents for operations leaders in insurance in Nigeria and AI agents for compliance teams in payments in Nigeria.
How do you meet the rules?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| CBN: accountability for outsourced services | Agent platform assessed, contracted and monitored | Due diligence; contract; review records |
| CBN: customer protection and complaints | Agent logs and routes complaints; reversals follow dispute procedures with a person deciding | Complaint logs; dispute records |
| IT and cyber security | Agent identity, scoped access, logging and testing | Access maps; logs; test reports |
| SEC Nigeria: suitability | Agent drafts recommendations; a qualified person approves | Approval records |
| NAICOM: claims fairness | Agent prepares claims files; decisions on denial held for a person | Hold records |
| NDPA: lawful basis and notice | Each agent purpose recorded with its basis and in the notice | Processing records; notice versions |
| NDPA: automated decisions | Significant decisions held for a person, or exception and safeguards documented | Hold records; assessments |
| NDPA: transfers | Basis recorded for each country where agent data is processed | Transfer assessments |
| NDPA: breach and rights | Agent stores searchable and erasable; incidents assessed for notification | Request files; breach records |
What will the CBN, SEC Nigeria, NAICOM or the NDPC ask?
- Which customer-facing processes use agents, and who is accountable for each?
- How does the agent confirm a customer's identity before disclosing anything?
- Show us how a failed transfer complaint raised with an agent was handled.
- Can any agent decline, restrict or deny without a person?
- Where is the agent's data processed, and on what basis is it sent abroad?
- Has a data protection impact assessment been done for each agent that handles personal data at scale?
What do these rules not cover?
Nigeria has no AI-specific statute governing agents, no registration of AI systems and no list of prohibited AI practices. Sector circulars continue to develop, so check for new guidance from your supervisor. Firms with customers abroad face those markets' rules as well; compare how AI agents are regulated in India and how AI agents are regulated in Canada. For the full map, see AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
Pryme's Context Protocol stamps every fact with its provenance. A transaction status from the core banking ledger arrives as sealed; a customer's account of what happened is declared. An agent handling a failed transfer can explain the sealed status, but a declared or external claim cannot authorise a reversal, and reversing a settled payment on our own rail is withheld for every agent.
Questions people ask
Does the NDPA require consent for every agent use of personal data?
No. Consent is one lawful basis. Performance of a contract, legal obligation and legitimate interests are others. Many customer service uses rest on contract, but the purpose must be stated and the processing kept to it.
Can a bank in Nigeria use an agent platform hosted abroad?
The NDPA allows transfers where adequate protection or another permitted basis exists, and CBN rules may add expectations on data location and outsourcing. Check both, and record the basis before data leaves.
Who is responsible if an agent gives a customer wrong information?
The licensed institution. Supervisors treat what an agent says on the institution's behalf as the institution's own communication, so content must be controlled and errors corrected.