SERAP Threatens as CBN directs banks to investigate their clients’ social media presence.

The CBN said the initiative would strengthen customer due diligence measures and combat money laundering and terrorism financing.

The Central Bank of Nigeria has issued a directive mandating financial institutions to collect social media handles, email addresses, phone numbers, places of residence, and other relevant details from its consumers.

According to the company, this programme would boost clients’ due diligence processes and combat money laundering and terrorism funding.

But the Socio-Economic Rights and Accountability Project (SERAP)- a non-governmental organisation, has described the directive as unlawful and a violation of “Nigerians’ rights to freedom of expression and privacy.”

CBN’s directive

In its recently released Customer Due Diligence Regulations, 2023, Nigeria’s apex bank said money deposit banks must obtain comprehensive information about their customers, including their social media handles.

The regulation, it claimed, contained measures that “are designed to improve the ability of financial institutions to identify and monitor potential risks linked to customer activities.”

CBN said the requirement applies to both individuals and legal entities.

The new regulation states, in part, that; “By including social media handles as part of the customer identification process, banks seek to gain further insights into customers’ online presence and activities, helping to assess potential risks and monitor for suspicious behaviour.

“For individuals, the CDD process now encompasses gathering information such as legal name, addresses (permanent and residential), contact details (telephone, email, and social media handles), date and place of birth, Bank Verification Number (BVN), Tax Identification Number (TIN), nationality, occupation, public position held, name of employer, official personal identification number, and a unique identifier contained in a valid government-issued document bearing the customer’s name, photograph, and signature”.

CBN said the decision to include customers’ social media handles recognises the roles online platforms play in communication and transactional activities.

In the case of corporate entities, CBN said the CDD process entails gathering information such as the institutions’ name, mailing address, email and social media addresses, phone numbers, registration number, registered address, business address, valid identification (e.g., tax identification number), nature and purpose of business or activities, and certified true copies of documents confirming legal existence (e.g., certificate of incorporation), memorandum and articles of association, list of directors and shareholders, among others.

Meanwhile, CBN has assured customers that banks will handle the collected information in accordance with applicable data protection regulations and ensure the security of customers’ data.

SERAP kicks

In its statement issued on Sunday morning, SERAP called on the CBN Acting Governor, Folashodun Shonubi, to remove the controversial provisions in the regulations, even as it gave a three-day ultimatum

SERAP’s statement, signed by its Deputy Director, Kolawole Oluwadare, reads in part, “We would be grateful if the recommended measures are taken within three days of the receipt and publication of this letter. If we have not heard from you by then, SERAP shall take all appropriate legal actions to compel you and the CBN to comply with our request in the public interest.

“The mandatory requirement of social media handles or addresses of customers does not serve any legitimate aim. Such information may be used to unjustifiably or arbitrarily restrict the rights to freedom of expression and privacy”.

The organisation said collecting social media information could impede citizens’ online rights, “potentially leading to misuse of personal data for political or unlawful purposes.”

SERAP urged the CBN to fulfill its statutory duty while upholding the rule of law and human rights “rather than undermining or violating them.”

The organisation emphasises that identification methods such as passports, driver’s licenses, and Bank Verification Numbers already serve the purpose of ‘Know Your Customer’ requirements.

It warned that obtaining social media information as a means of identification would disproportionately infringe upon freedom of expression and privacy rights.

The organisation expressed concern that the CBN’s directive could restrict constitutional and international rights, as well as victim rights to justice and effective remedies.

It argued that the CBN has failed to demonstrate how collecting social media handles would enhance banks’ ability to implement customer due diligence regulations effectively.