Cameroon ANTIC: 3,914 Fintech Vulnerabilities Identified in Audits

• Cameroon's National Agency for Information and Communication Technologies (ANTIC) recently identified 3,914 security vulnerabilities across 108 fintech operator audits.
• These findings, presented by ANTIC Director General Prof. Ebot Ebot Enaw, highlight weaknesses in areas like data protection, access controls, and security policies.
• Earlier audits in November 2025 had already revealed over 6,500 vulnerabilities within Cameroon's broader financial sector, including banks and payment providers.
• The new personal data protection law, effective December 2024, mandated compliance by June 2026, making the identified data protection weaknesses particularly critical.
• Despite issuing recommendations, ANTIC has not disclosed the number of critical vulnerabilities or how many have been corrected by operators.

The new personal data protection law, which became effective in December 2024, imposed an 18-month compliance period that concluded in June 2026, making the identified data protection weaknesses particularly critical for fintech operators.

The National Agency for Information and Communication Technologies (ANTIC) in Cameroon has recently unveiled a substantial number of security vulnerabilities within the nation's burgeoning fintech sector. According to figures presented by ANTIC Director General, Professor Ebot Ebot Enaw, at the Digitise Cameroon Forum held in Mbankomo on October 28, 2026, a total of 3,914 security weaknesses were identified across 108 audits of various fintech operators. These critical findings highlight widespread issues impacting the overall fintech security Cameroon relies upon.

The scope of these identified Cameroon ANTIC fintech vulnerabilities is broad, encompassing several key operational areas. Specific deficiencies were noted in the implementation and adherence to security policies, the level of staff expertise in cybersecurity matters, the robustness of access controls, the efficacy of data protection mechanisms, and the resilience of business continuity plans. These categories collectively point to systemic challenges that could potentially expose sensitive financial data and disrupt essential services.

These recent discoveries are not isolated incidents but rather reflect a persistent pattern of cybersecurity concerns within Cameroon's financial landscape. Just over a year prior, in November 2025, a comprehensive Cameroon cybersecurity audit program had already uncovered an even larger number of vulnerabilities. That earlier initiative reported more than 6,500 security flaws following 119 audits conducted across a wider array of financial institutions, including traditional banks, microfinance institutions, and various payment providers. The continuous identification of such high numbers of weaknesses underscores an ongoing need for enhanced security protocols.

The stakes are particularly high given the significant role of digital financial services in the country. Mobile Money, for instance, generated a substantial FCFA135.8 billion in revenue during 2024, supported by an impressive 11.4 million active subscriptions, as reported by the telecommunications regulator. This widespread adoption of mobile money security Cameroon services means that any vulnerability could have far-reaching consequences for a large segment of the population and the national economy.

The timing of these findings coincides with a crucial period for regulatory compliance in Cameroon. A new personal data protection law came into effect in December 2024, introducing stringent requirements for how personal information is handled. This legislation included an 18-month compliance period, which concluded in June 2026. The identified weaknesses in data protection, as highlighted by ANTIC's audits, directly intersect with the mandates of this new law, making their rectification an urgent priority for all affected operators.

Lawyers advising fintech operators in Cameroon should therefore meticulously review ANTIC's recommendations and thoroughly assess their clients' cybersecurity postures. Particular attention must be paid to ensuring robust Cameroon data protection law compliance, especially given the high number of vulnerabilities identified and the now-passed June 2026 deadline. Failure to address these gaps could lead to significant legal and operational repercussions for fintech entities operating within the country.

Following its extensive audit, ANTIC has issued specific recommendations to the implicated fintech operators, urging them to implement necessary improvements to bolster their security frameworks. While the agency, under the leadership of ANTIC Director General Ebot Enaw, has provided these directives, it has not publicly disclosed critical details regarding the severity of the identified Cameroon ANTIC fintech vulnerabilities. Specifically, there has been no information released on how many of the 3,914 vulnerabilities were classified as critical, nor has there been an update on how many of these issues have since been successfully corrected by the operators. This lack of transparency leaves key questions unanswered about the current state of security remediation efforts.

Lawyers advising fintech operators in Cameroon should review ANTIC's recommendations and assess client cybersecurity postures, particularly concerning data protection law compliance, given the high number of identified vulnerabilities and the upcoming June 2026 deadline for the new personal data protection law.

Source: Original reporting via regulatory disclosures.