Why CBN’s data localization policy will hit fintechs harder than banks—SATH MD

The Managing Director of Signal Alliance Technology Holdings (SATH), Kenneth Ufomba has said that the Central Bank of Nigeria’s (CBN) directive requiring banks and fintech companies to host critical data within Nigeria by January 2027 will have a greater impact on fintech firms than traditional banks.

Speaking during the 30th anniversary media parley of SATH in Lagos, Ufomba said while most top-tier banks have already aligned with the regulator’s expectations over the years, many fintechs built on cloud-first models will face more complex migration challenges.

His comments come as financial institutions prepare to comply with the CBN’s data localization policy, which requires regulated entities to ensure that critical customer and financial data are hosted locally as part of efforts to strengthen data sovereignty and regulatory oversight.

What the SATH MD is saying

According to Ufomba, while the cloud nature helps the fintechs to be more agile than the traditional banks, it will make compliance with the new directive more difficult for them,

• “The people that this impacts most are those fintechs, those companies who are born in the cloud, who are very agile in their strategy and do not have the liberty of housing Tier III or Tier IV data centres,” he said.

He noted that while many banks continue to use global cloud platforms such as Microsoft Azure and Amazon Web Services (AWS), they have already ensured that the categories of data required by regulators remain within Nigeria.

• “Most of the top tier banks have complied with this over the years. Even though they are possibly in Microsoft Azure or AWS, they have complied just to ensure that the particular data the regulator says cannot stay outside Nigeria is localized,” he added.

Ufomba said SATH is already engaging fintech companies to assess the implications of the directive and help them determine which categories of data fall under the localization requirement before developing migration strategies.

He added that the company, which partners with Huawei, is leveraging local data centre infrastructure to support organizations seeking to comply with the new rules.

Backstory

The CBN in June directed all financial institutions and licensed payment operators to store and manage payment transaction data generated within Nigeria on local servers by January 1, 2027.

Affected institutions include deposit money banks, microfinance banks, mobile money operators, switching and processing companies, payment terminal service providers, payment solution service providers, super agents, and other licensed payment operators.

The timing of the CBN’s directive coincides with a period of unprecedented growth in demand for computing infrastructure globally.

The policy has also raised capacity concerns among stakeholders, with many arguing that the country does not have the capacity to house all its data, a claim local data centre operators have debunked.

More insights

Also speaking at the event, Chairman of Signal Alliance, Collin Onuegbu, backed the CBN’s policy, describing it as a necessary step toward strengthening Nigeria’s data sovereignty.

According to him, critical national and financial data should remain within the country, even though it may not be practical to localize all forms of digital traffic.

• “There’s something called data sovereignty, where you have to own your data because it’s the new real estate,” Onuegbu said.

He noted that while emails and other internet traffic naturally pass through global networks, countries should ensure that sensitive and critical information is protected through local hosting arrangements.

Onuegbu added that policies encouraging the development of more data centres across Nigeria and Africa would improve digital resilience while reducing dependence on foreign infrastructure.

AI adoption requires governance

Speaking on artificial intelligence adoption, Ufomba warned that many organizations are rushing to deploy AI tools without establishing governance and compliance frameworks.

According to him, AI governance should precede implementation to ensure organizations deploy the technology responsibly and derive measurable business value.

He said many businesses remain focused on generic AI applications without identifying the specific use cases that can improve operational performance.

• “When Microsoft Copilot came up, I used to tell people that it was AI 101. The danger is remaining in AI 101 when people are already moving to AI 201, AI 301 and today we’re talking about agentic AI,” he said.

Ufomba added that organizations need structured AI adoption strategies that begin with governance and compliance before identifying business-specific applications capable of delivering meaningful impact.

What you should know

Meanwhile, the Chief Executive Officer of Open Access Data Centre (OADC), Dr. Ayotunde Coker, has dismissed concerns over Nigeria’s capacity to comply with the CBN’s payment data localisation directive, insisting that the country’s data centre infrastructure is sufficient to support the transition.

According to Coker, Nigeria’s data centre market is supported by more than $2 billion in projected investments by 2027, with OADC alone investing $240 million in a 24 megawatt hyperscale facility in Lekki.