The Central Bank of Nigeria (CBN) has reaffirmed that banks, fintech companies and other licensed payment operators must store and manage all payment transaction data generated in Nigeria on local infrastructure by January 1, 2027, with no extension to the deadline.
Key Highlights
- CBN maintains January 1, 2027 as the deadline for payment data localisation.
- Banks, fintechs and other payment operators must store Nigerian payment data locally.
- The directive covers banks, mobile money operators, switching companies and payment service providers.
- CBN says the deadline has not changed despite industry concerns over the migration timeline.
- Financial institutions are expected to audit, classify and migrate covered data.
- Industry executives warn that rapid migration could create operational and cybersecurity risks.
- Data centre operators expect the policy to boost investment in Nigeria’s digital infrastructure.
CBN Confirms Payment Data Localisation Deadline
The directive is contained in Circular PSS/DIR/PUB/CIR/001/004, issued on June 15, 2026, by the CBN’s Payments System Supervision Department and signed by its Director, Dr Rakiya Yusuf.
The circular requires financial institutions and payment ecosystem participants operating in Nigeria to ensure that payment transaction data generated within the country is stored and managed in Nigeria in line with applicable data protection laws and regulations.
Full compliance is required by January 1, 2027.
The directive covers deposit money banks, microfinance banks, mobile money operators, switching and processing companies, payment terminal service providers, payment solution service providers, super agents and other licensed participants in Nigeria’s payments ecosystem.
The circular also introduced separate measures relating to market structure and beneficial ownership disclosure, although those provisions have different compliance timelines.
CBN Says Deadline Has Not Changed
The CBN reaffirmed the January 1 deadline at the CloudReady Nigeria Financial Services Roundtable organised by Africa Hyperscalers in Lagos.
Dr Yusuf, represented at the event by Assistant Director Babatunde Ajiboye, said the compliance date “hasn’t changed”.
According to the CBN, affected institutions are expected to address the entire data lifecycle, covering data creation, processing, storage and disposal.
Financial institutions are also expected to undertake comprehensive data audits, classify relevant information, establish suitable local infrastructure arrangements, identify and mitigate risks, conduct testing and obtain independent verification.
The policy is part of Nigeria’s broader data sovereignty objectives and aligns with the Nigeria Data Protection Act and national cloud policies.
Why CBN Wants Payment Data Stored Locally
The CBN’s position is aimed at reducing reliance on foreign infrastructure for systemically important payment information while strengthening regulatory oversight of Nigeria’s financial system.
Keeping sensitive payment information within Nigeria could also give regulators greater visibility over critical financial data and reduce some of the risks associated with dependence on overseas infrastructure.
However, the implementation is expected to require significant changes to the technology architecture of some financial institutions.
Read also:
- 5 Months to CBN Deadline: How Nigeria’s Tech and Data Companies Are Racing to Keep Payment Data at Home
- Fintechs To Disclose Ownership: CBN Tightens Grip on Banks, Digital Payment Firms With New Rules
- CBN Opens Applications for Second Cohort Of Regulatory Sandbox Programme
Banks, Fintechs Raise Migration Concerns
Industry participants have generally acknowledged the policy direction but raised concerns over the short period available for compliance.
At the GrowthX by Techeconomy conference in Lagos in late September, industry executives noted that significant volumes of Nigerian payment data are currently hosted on overseas cloud platforms.
They warned that completing large-scale migrations within a limited timeframe could create operational, cybersecurity and resilience risks if the process is not carefully managed.
Blessing Ehize, Chief Technology Officer at First City Monument Bank, highlighted the need for broader engagement with the Committee of Bank CIOs and clearer guidance on which categories of data must be completely hosted in Nigeria and what could remain under approved hybrid arrangements.
Hakeem Adeniji-Adele, Deputy Managing Director at eTranzact, described the migration requirement as substantial and advocated a phased approach that could separate computing infrastructure from data storage rather than requiring all systems to be moved simultaneously.
Industry stakeholders have also raised concerns about potential effects on service continuity within Nigeria’s high-volume digital payments ecosystem.
Local Data Centres Prepare for Increased Demand
Data centre operators see the CBN directive as an opportunity to accelerate investment in Nigeria’s domestic digital infrastructure.
Nigeria currently has about 17 operational data centres, with additional facilities under development.
Providers such as Open Access Data Centres have indicated readiness to accommodate workloads that financial institutions may need to migrate from overseas infrastructure.
The expected increase in demand could drive further investment in data centres, cloud services, disaster-recovery infrastructure and connectivity.
Financial institutions, however, will also need to assess their core banking systems, backup arrangements, disaster recovery capabilities and international network connections as they prepare for the deadline.
CBN Warns of Possible Sanctions
The CBN has said it will monitor compliance with the data localisation requirement and may impose supervisory sanctions where necessary.
However, the June circular does not provide a specific penalty schedule for non-compliance.
With less than three months remaining until January 1, 2027, affected banks, fintechs and payment companies are expected to accelerate preparations by identifying covered data, mapping their existing infrastructure, confirming local hosting arrangements and beginning necessary migrations.
The implementation of the policy will test both the resilience of Nigeria’s digital payments ecosystem and the capacity of the country’s domestic data infrastructure to handle a significant increase in critical financial workloads.
For more fintech and banking news, follow us on X.
