SEC Gives Capital Market Operators Until November 5 to Submit Cybersecurity Assessments

A Short Window for a Full Self Assessment

The timetable is the story as much as the requirement itself. A circular dated Monday, November 2 asks every regulated capital market operator, from stockbrokers and fund managers to registrars and exchanges, to file a complete picture of its cybersecurity risk profile by Thursday, November 5. Firms have to work through the Cybersecurity Module on the SEC e-Portal and submit information that accurately reflects their current arrangements, which in practice means risk, compliance and technology teams assembling evidence on access controls, third party technology exposure, incident response and business continuity at short notice.

The breadth of the request signals what the regulator is really building. This is not a routine returns exercise. The assessments will be pooled into a sector-wide view of where the financial system's cyber weaknesses sit, which threats are emerging, and how well firms could coordinate if a significant incident hit several operators at once.

Why the Push Comes Now

The timing tracks the market's own growth. Trading and account opening have shifted decisively toward digital channels: NGX Group recently reported that transaction fees more than doubled in the first nine months of 2026 as more retail investors onboarded through digital self service platforms, and equity market capitalisation reached ₦163.10 trillion at the end of September. Every new app based account and online trading portal widens the surface that operators and regulators have to defend, and a breach at a single mid sized broker could now reach far more retail investors than it would have a few years ago.

The exercise sits with the Financial Services Regulation Coordinating Committee's cybersecurity group, which brings financial regulators together with institutions, law enforcement and critical infrastructure operators. Its work programme covers a strategic risk management framework, common standards, better information sharing, and coordinated responses to major incidents. The November 5 filings are the raw material for that programme: regulators cannot set proportionate standards until they know what defences operators actually run today.

What Operators Should Expect After Filing

Firms that treat the assessment as a form filling exercise are likely to find the follow up uncomfortable. A sector-wide dataset lets the SEC benchmark operators against peers, and firms whose profiles show thin incident response plans or heavy unmanaged third party exposure are the natural candidates for closer supervisory attention once the framework and standards emerge.

For investors, there is no market moving number in this directive, and no operator has been named or sanctioned. The significance is structural. Cyber resilience is joining capital adequacy as a standing supervisory test for Nigerian market operators, and the cost of meeting it will fall hardest on the smaller firms that already face higher minimum capital requirements by June 2027. The standards that follow from these filings will show how far the SEC intends to take it.