AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
A small Lagos office of a US company needs a short list done well: managed devices, two-factor authentication on email and banking, backups, controlled admin rights and a breach plan. Under the Nigeria Data Protection Act 2023, a controller must notify the Nigeria Data Protection Commission within 72 hours of becoming aware of a breach likely to risk people's rights, and tell affected people directly where the risk is high.
The controls that matter most
Most attacks on small offices are not clever. They use stolen passwords, phishing emails, unpatched laptops and shared accounts. The NDPA 2023 s.39 requires appropriate technical and organisational measures to secure personal data, and names measures such as encryption, pseudonymisation and regular testing. In practice, for an office of five to twenty people:
| Control | What good looks like |
|---|---|
| Two-factor authentication | On email, banking, cloud storage and admin accounts; app-based, not SMS where possible |
| Managed devices | Company laptops with full-disk encryption, automatic updates and a screen lock |
| Accounts | One named account per person; no shared logins; access removed the day someone leaves |
| Admin rights | Held by one or two people, not every user |
| Backups | Automatic, off-site or in the cloud, tested by restoring a file each quarter |
| Filtering on; full sender addresses shown; staff trained to check them | |
| Payments | Bank-detail changes verified by call-back; see fraudulent bank change requests |
| Office network | Separate guest Wi-Fi; router password changed from the default |
The FBI's IC3 guidance on business email compromise adds two habits worth copying: verify requests for account changes through a secondary channel, and check the sender's address carefully on mobile devices.
Lagos-specific risks
- Power cuts and generator switching can corrupt drives without backups; see business continuity for power outages.
- Phone theft is common in transit; a stolen phone with banking and email apps open is a direct route in, so use device PINs and remote wipe.
- Staff often use personal phones for work chat; keep company data in company apps you can remove.
- Internet is often shared across offices in serviced buildings; treat that network as untrusted.
What the NDPA requires after a breach
The NDPA 2023 s.2(2) applies to controllers and processors operating in Nigeria and to those outside Nigeria processing data of people in Nigeria, so both the Lagos office and the US parent can be covered. Section 40 sets the breach duties:
- A processor (for example, an outsourced IT or payroll firm) must notify the controller on becoming aware of a breach (s.40(1)).
- The controller must notify the Commission within 72 hours of becoming aware of a breach likely to result in a risk to people's rights and freedoms (s.40(2)). The NDPC's GAID 2025, Article 33, repeats this.
- Where the risk is high, the controller must tell the affected people without delay, with steps they can take (s.40(3)); GAID Article 33(3) says immediately after becoming aware.
- The controller keeps a record of every breach, including those not reported (s.40(8)).
The NDPC's FAQ says the Commission can order remedies, compensation and a remedial fee of up to the greater of ₦10,000,000 or 2% of annual gross revenue for a data controller of major importance, and the greater of ₦2,000,000 or 2% for others. Whether your company is "of major importance" and must register is covered in NDPA registration for a US company.
A breach plan on one page
- Who decides: name one person in Lagos and one in the US.
- Contain: disconnect the device, reset passwords, revoke sessions.
- Assess within 24 hours: what data, how many people, how sensitive.
- Notify: NDPC within 72 hours if there is risk; affected people if high risk; your bank at once if money moved.
- Record: what happened, what you did and why, whatever you decide about notifying.
- Learn: fix the cause and update the control list.
Joiners, leavers and suppliers
Many breaches in small offices start with access nobody removed. Keep a simple access list: every system (email, banking, accounting, cloud drive, payroll) and every person with access. When someone joins, add only what the role needs. When someone leaves, remove access that day, collect the laptop and change any shared passwords they knew. Do the same for suppliers: an IT firm or outsourced accountant with admin access is a processor under the NDPA and should have a written agreement covering security and breach notification, as s.29 expects.
- Review the access list every quarter.
- Turn off accounts that have not been used for 90 days.
- Keep admin passwords in a password manager held by two named people.
A worked budget
Example only. For a ten-person office, a first-year budget might cover business email with two-factor authentication for ten users, encryption and remote wipe on ten laptops and phones, a cloud backup plan, a half-day of staff training and a quarterly check by an outside IT firm. Ask two local IT providers to quote each line; prices vary widely and change with the exchange rate.
Where Pryme fits
Pryme's own security uses an authenticator app rather than SMS codes and a transaction PIN for payments. In a Business Account, the Compliance agent can keep the breach log and deadlines; a person approves any action above a set ceiling.
Questions people ask
How quickly must a data breach be reported in Nigeria?
Within 72 hours of becoming aware, to the Nigeria Data Protection Commission, where the breach is likely to risk people's rights and freedoms (NDPA 2023 s.40(2)).
Does the NDPA apply to a US company's Lagos office?
Yes. Section 2(2) covers controllers operating in Nigeria and those outside Nigeria processing data of people in Nigeria.
What is the penalty for an NDPA breach?
The NDPC FAQ says up to the greater of ₦10 million or 2% of annual gross revenue for a data controller of major importance, and ₦2 million or 2% for others.
What basic cyber controls does a small office need?
Two-factor authentication, encrypted managed devices, named accounts, limited admin rights, tested backups and a one-page breach plan.
Sources
- Nigeria Data Protection Act 2023 (KPMG Nigeria copy) · accessed Oct 2026
- NDPC: Nigeria Data Protection Act General Application and Implementation Directive (GAID) 2025 · accessed Oct 2026
- NDPC: Frequently asked questions · accessed Oct 2026
- FBI IC3: Business Email Compromise · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.