Cameroon’s Banks and Microfinance Institutions Under Siege: The Triple Notification Imperative

The scenario is one every IT Director dreads: a cybersecurity breach at a Cameroonian bank. The incident response protocol is activated. But then comes the cold realization — this single event triggers not one, not two, but three separate notification obligations to three distinct authorities, each operating under its own legal framework, each with its own threshold, each with its own timeline.

Three Authorities. Three Legal Texts. Three Siloed Channels.

The ANTIC must be notified — Decree No. 2012/1643/PM, Article 7 requires that any private or public agency notify ANTIC of any computer security incident affecting its network. No threshold. No materiality test. Every incident triggers the obligation.

The COBAC must be notified — Regulation R-2024/01, effective January 1, 2025, introduces a new mandatory notification regime for banks, microfinance institutions, and payment institutions across the CEMAC region. But here, the trigger is a “significant” incident — defined by quantitative thresholds including losses exceeding 0.5% of core capital (minimum CFAF 5 million), impact on 10% or more of clients or transactions, system unavailability exceeding 24 hours, or any breach of sensitive data.

The APDP may also need to be notified — Law No. 2024/017 mandates that data controllers notify the APDP of any personal data breach likely to pose a risk to the rights and freedoms of the individuals concerned.

The Regulatory Collision

Herein lies the challenge that I have dissected: the COBAC sees only a financial threshold (0.5% of core capital) where ANTIC demands notification for every technical incident — regardless of loss. The APDP adds yet another layer when personal data is compromised. What constitutes a “significant” incident under COBAC may not align with what ANTIC considers notifiable. And the APDP’s risk-based threshold introduces yet another variable.

The Microfinance Blind Spot

This is where the exposure becomes most acute. Cameroon is home to 385 microfinance institutions (EMF) — and the country accounts for over 62% of all mobile money accounts in the entire CEMAC region. These institutions are now subject to the same COBAC notification requirements as the largest commercial banks. Yet many lack the dedicated cybersecurity and compliance resources to navigate this tripartite notification maze.

What Articles 4, 26, 29, and 34 of Regulation R-2024/01 Actually Require

• Article 4: Establishes the scope and the obligation to classify IT assets based on criticality
• Article 26: Mandates mechanisms for detecting abnormal behavior or attacks
• Article 29: Requires annual vulnerability testing on critical systems
• Article 34: Addresses governance and oversight obligations

The Operational Notification Matrix

The question is no longer whether to notify, but whom to alert, in what order, and on what legal basis. A single incident may trigger multiple obligations simultaneously. Your response plan must anticipate this — not discover it in the midst of a crisis.

A practical approach:

1. Immediate internal escalation — activate the incident response team
2. ANTIC notification — for any computer security incident (no threshold)
3. COBAC notification — if the incident meets the “significant” thresholds
4. APDP notification — if personal data is compromised and poses a risk
5. Follow-up reports — COBAC requires an interim report within one week and a synthesis report within one month

The Compliance Challenge

The central question: Do Cameroonian banks and microfinance institutions have the resources to simultaneously comply with COBAC’s prudential requirements and national cybersecurity obligations?

The answer is far from straightforward. The 12-month transition period for banks and payment institutions, and the 18-month period for microfinance institutions, offer some breathing room — but only if institutions start now.

The Way Forward

This is not merely a compliance exercise. It is about operational resilience in a digital economy where Cameroon’s financial sector is increasingly the target of sophisticated cyber threats. The regulatory framework is evolving rapidly. Those who wait will find themselves reacting to a crisis while discovering their obligations. Those who prepare will turn compliance into competitive advantage.

What’s your view? Do Cameroon’s banks and microfinance institutions have the resources to meet these converging regulatory demands?