Frameworks / Nigeria Open Banking Regulatory Framework (CBN, 2023) / NGOB-1 Nigeria Open Banking Regulatory Framework (CBN, 2023)
Registry and Tiering
Nigeria Open Banking Regulatory Framework (CBN, 2023) NGOB-1: Open Banking Registry Participation, Tiered Categorisation, and KYP Comply with the Nigeria Open Banking Regulatory Framework issued by the Central Bank of Nigeria (CBN) March 2023 + Operational Guidelines for Open Banking December 2023. Register as Open Banking participant (API Provider or API Consumer or both) via the Open Banking Registry (OBR) administered by CBN. Apply tiered API risk categorisation: Tier 0 Product Information (PIST) + Tier 1 Merchant Information (MIT) + Tier 2 Personal Financial Data (PIFT) + Tier 3 Scoring and Analytics (PAST). Conduct Know-Your-Partner (KYP) due diligence on API counterparties including identity verification + corporate structure + regulatory licensing + cyber security maturity + financial soundness.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 231 controls across 83 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
GDPR-Art.10 Processing of personal data relating to criminal convictions GDPR-Art.11 Processing which does not require identification GDPR-Art.15 Right of access by the data subject GDPR-Art.19 Notification obligation regarding rectification, erasure or restriction GDPR-Art.35 Data protection impact assessment GDPR-Art.9 Processing of special categories of personal data ISMSP-MS-02 Risk Management ISMSP-PI-01 Personal Information Collection ISMSP-PI-04 Cross-Border Transfer ISMSP-SYS-02 Encryption Implementation ISMSP-SYS-04 Vulnerability Management BB-DPA-14 Section 15 - Right to Data Portability BB-DPA-16 Section 22 - General Principle for Transfers BB-DPA-20 Sections 50-60 - Registration and Responsibilities BB-DPA-21 Sections 61-69 - Data Privacy Officer ISO23894-6.3 AI Risk Assessment ISO23894-6.3.1 AI Risk Identification ISO23894-6.3.3 AI Risk Evaluation ISO23894-A.5 Privacy and Data Protection in AI NISTSP122-4 PII Minimisation, Purpose Limitation, and Pseudonymisation NISTSP122-5 PII Security Controls - Encryption, Access Control, Storage, Audit NISTSP122-6 PII Breach Response and Incident Handling NISTSP122-8 Continuous Monitoring, Training, and Privacy Programme Governance APPI-A23 Security Control Measures APPI-A24 Supervision of Employees APPI-A33 Request for Disclosure of Retained Personal Data APP-1 APP 1 - Open and transparent management of personal information APP-3 APP 3 - Collection of solicited personal information APP-5 APP 5 - Notification of the collection of personal information AT-DSG-11 Sections 42-45 - Data subject rights (law enforcement) AT-DSG-13 Section 36 - Scope of law enforcement processing AT-DSG-14 Section 38 - Lawfulness of law enforcement processing AZ-DPA-12 Article 13 - Cross-border transfer AZ-DPA-14 Article 16 - Liability for violations AZ-DPA-15 Article 17 - Dispute resolution BSI-13 Risk assessment procedures BSI-15 Security categorization BSI-17 Continuous monitoring strategy UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10) UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21) UAE-PDPL-Art.4_5 Lawful basis and principles for processing personal data (UAE PDPL Articles 4-5) 27557-3 Terms and definitions 27557-4.3 Individual impact consideration 27557-6.3 Privacy risk assessment 29100-6.10 Information security 29100-6.5 Use, retention and disclosure limitation 29100-6.9 Accountability 29134-1 Scope 29134-3 Terms and definitions 29134-9.1 PIA report structure NISTSP30-3 Threat Source and Threat Event Identification NISTSP30-4 Vulnerability and Predisposing Condition Identification NISTSP30-6 Risk Determination, Uncertainty, and Sensitivity Analysis NORWAY-4 DPIA, Privacy by Design, Records of Processing NORWAY-5 Security of Processing, Encryption, Pseudonymization, Access Control NORWAY-8 Breach Notification, Complaints, Compliance, Enforcement AUPRV-4 APP 10-11 Quality, Security of Personal Information AUPRV-6 Sensitive Information, PIA, Privacy by Design, Children AUPRV-7 Notifiable Data Breaches (NDB) Scheme, Incident Response CRM-1 AML/CFT Compliance CRM-4 Business Risk Assessment UAEVARA-1 Activity Licensing (Advisory, Exchange, Custody, Broker-Dealer, etc.) HE-1 Financial institution status of higher education USGLBAHIGHER-1 Qualified Individual and Risk Assessment USGLBAHIGHER-3 Continuous Monitoring, Testing, Vendor Oversight API1164-07 Remote Access API1164-24 Vulnerability assessment for critical systems CPS230-11 Identification, Assessment and Management of Operational Risk CPS230-40 Mandatory Minimum Classification of Material Service Providers IS.D.OR.205 Information Security Risk Assessment IS.I.OR.205 Information Security Risk Assessment FTC-Safeguards-Program-Qualified-Individual Comprehensive Information Security Program + Qualified Individual (16 CFR 314.3, 314.4(a)) FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2) FDBR-ControllerObligations-DPA-Notice Controller + Processor Obligations + Data Protection Assessments (Fla. Stat. 501.707, 501.708, 501.71, 501.711) FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704) Sapin2-Pillar3-Risk-Mapping Pillar 3 - Corruption Risk Mapping (Cartographie des Risques) Sapin2-Pillar4-ThirdParty-DueDiligence Pillar 4 - Third-Party Due Diligence (Clients, Suppliers, Intermediaries, M&A) ICAO-ANX17-Chap2-ThreatAssessment-RiskManagement-Cyber-GASeP ICAO Annex 17 Chapter 2 - Threat Assessment + Risk Management + Cyber Threats to Critical Aviation Systems (Amendment 17/18) ICAO-ANX17-Chap4-Cargo-Mail-Catering-Stores-Supplies-RegulatedAgent-KnownConsignor ICAO Annex 17 Chapter 4 - Cargo + Mail + Catering + Stores + Supplies Security + Regulated Agent + Known Consignor + Supply Chain IEC62443-07 Personnel risk assessment IEC62443-24 Vulnerability assessment for critical systems ISO27003-6.1 Actions to address risks and opportunities ISO27003-8.2 Information security risk assessment ISO27019-07 Personnel risk assessment ISO27019-24 Vulnerability assessment for critical systems 27400-5.4 Data and privacy risks 27400-7.3 Data minimization and purpose limitation NIST-CSF-GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions NIST-CSF-ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use NISTPF-1 Identify-P - Business Environment, Data Processing Inventory, Ecosystem, and Risk Assessment NISTPF-8 Protect-P Information Protection Processes (PR.PO-P) NISTSP37-2 RMF Categorize Step: Information and System Categorisation NISTSP37-3 RMF Select Step: Security and Privacy Control Selection NZISM-1 NZISM Governance, Documentation, and Classification System NZISM-3 Personnel Security, Physical Security, and Cryptography ASTWO-1 Audit Planning, Scaling, Risk Assessment, and Integration ASTWO-3 Entity-Level Controls and Period-End Financial Reporting Process RUSPD-1 Scope, Definitions, Principles under 152-FZ RUSPD-4 Special Categories, Biometric Data 2.4.4 Hazard Analysis and Risk Assessment 2.7.2 Food Fraud Plan PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33 PIPA-Data-Subject-Rights-Access-Correction-Erasure-Portability-Automated-Decisions-Articles-35-37-2 Korea PIPA Data Subject Rights + Access + Correction + Erasure + Portability + Article 35-37 TURKEYKVKK-2 Information Notice and Data Subject Rights TURKEYKVKK-3 Special Categories and Sensitive Data USMCADIGITAL-1 Cross-Border Data Flows and Localisation USMCADIGITAL-2 Personal Information Protection and Consumer Protection VERMONTAICDA-3 Bias Testing, Discrimination Prevention, Transparency VERMONTAICDA-4 Vermont AG Enforcement and Cure VIETNAMCYBER-2 Prohibited Acts (Access, Interception, Forgery, Content) VIETNAMCYBER-4 Incident Reporting and Cooperation AMLCTF-PartA-RiskAssess ML/TF Risk Assessment 4.3.1 Risk Assessment and Impact Analysis AL-DPA-12 International Data Transfers DS-2 Ensure software supply chain security CA-10 Selects and Develops Control Activities ISO-22313-8.2 Business impact analysis and risk assessment ISO-26262-3-7 Hazard analysis and risk assessment (HARA) ISO27799-06 Security management process and risk analysis 27031-7.2 Resource Requirements 29147-5.11 Researcher Safe Harbour and Legal Posture NFPA1600-5.1 Risk Assessment NISTAI600-7 Confabulation, Bias, Information Integrity, Privacy, IP (Risks 2, 4, 5, 6, 7, 8, 10, 11) NISTSP144-1 Cloud Governance, Risk Assessment, and Provider Trust Evaluation NISTSP145-7 Cloud Procurement Standards Aligned to NIST SP 800-145 Definition NISTSP146-1 Cloud Adoption Strategy, Workload Suitability, and Decision Framework NISTSP39-3 Risk Assessing: Organisation, Mission, and System Level Assessments NISTSP66-1 Security Management Process: Risk Analysis and Risk Management for ePHI NISTSP82-2 OT Risk Assessment and Threat/Vulnerability Identification AUNDB-A3 Eligible Data Breach Determination and Serious Harm Threshold OWASPLLM-3 Sensitive Information Disclosure and Privacy (LLM02) PAKPDPB-8 Enforcement, Penalties, Complaints, Retention, Training RIDTPPA-2 Consumer Rights (Access, Correction, Deletion, Portability, Opt-Out) IM8-SEC.4 Vulnerability Management TEFCAREC-1 Common Agreement Conformance and Onboarding CPSC-RA.3 Lifecycle Risk Assessment Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Query this from an agent The graph holds this control, the 231 it maps to, and the evidence behind each claim, over MCP and REST.