ACs shall ensure the following:
- Entrench an appropriate risk management regime;
- Have a secure configuration management system;
- Ensure network security for all connections;
- Ensure appropriate management of access rights and user privileges;
- Conduct user education and awareness;
- Deploy malware prevention and detection tools;
- Implement system monitoring to detect actual or attempted attacks on systems and business services; and
- Restrict use of removable/portable storage media.
The API Providers (APs) shall only share information of a customer with an AC, upon presentation of a valid proof of consent by the customer, and shall authenticate such consent to ensure it emanates from its customer.
For consent obtained from a customer to be valid, the following information shall be presented to the customer by the AC:
- Full and legal name of the AC;
- Shortened or brand name of the AC in situations where the AC operates under a different name from its legal registered name;
- The accreditation/registration number or other valid means of identification in the open banking registry;
- The business registration number of the AC with the Corporate Affairs Commission (CAC);
- Compliance with access level to data by service category;
- Nature of request, which shall be explicit and describe the following:
- The type of access the AC shall have on the customer account in line with access level by data and service category;
- Duration/tenor of the consent or the date when the access shall be invalidated;
- Frequency of access to the customer information by the AC or if such access shall be one-off;
- If the request includes the customer’s consent to collect data for anonymous/de-identified data analysis;
- Information regarding the process for withdrawal of consent by the customer including the following;
- A statement that the end-user can withdraw their consent at any point in time if so desired;
- Detailed process for withdrawal of consent by the customer;
- Information on the consequences of withdrawal of such consent to the customer, if any.
- Information about redundant data including the following touchpoints;
- ACs general policy in relation to decision making on the deletion or de-identification of redundant data in accordance with extant laws and regulations;
- An outline of the customer’s rights to elect for deletion of their redundant data and information on how to exercise such rights.
If the customer’s data will be disclosed to an outsourced service provider including non-Nigerian participants, the approval of the Bank shall be obtained, and the following additional information shall be required:
- A statement indicating that the data would be used or disclosed in such manner;
- A guarantee that the customer can obtain further information about such disclosures from the policy or on request to the participant, if they so wish.
Intellectual Property Preservation
Participants’ intellectual property in proprietary and protectable software source and object codes, aggregate data, and aggregate services among other protectable information shall be protected under the applicable laws in Nigeria.
No Party shall unlawfully acquire any proprietary rights, title, or interest in or to any Intellectual Property Rights of another Party, or any other Participant pursuant to the participation in Open Banking in Nigeria.
All ownership rights in any open data or other information shall at all times remain with the Party, or Participant from which such open data or other information originated, whether the open data or other information is in human or machine-readable form.
Participants shall be allowed to grant royalty-free license for their intellectual property in aggregated data, subject to the satisfaction of the consent requirement, for use by other participants to such extent as may be required for Open Banking in Nigeria.