CBN Data localization rule: Only 59% of banks, fintechs ready for January deadline

A survey conducted by the National Information Technology Development Agency (NITDA) has revealed that only 59% of banks, fintechs and other financial institutions in Nigeria are ready to meet the January 2027 deadline set by the Central Bank of Nigeria (CBN) for them to host all payment data locally.

The findings of the survey were released on Wednesday during an Executive Regulatory Dialogue on the implementation of the National Sovereign Cloud Initiative and Data Localisation jointly organized by NITDA and the CBN.

The report showed that 26 of the 44 financial institutions that responded to the readiness question had completed or were likely to complete the required actions before the deadline, while 15 institutions said completion was unlikely or very unlikely, while three could not assess their readiness.

NITDA highlights gaps in readiness

Speaking on the survey, Special Assistant on Policy to the Director-General of NITDA, Dr Muhammad Lawal, said there are gaps in the financial sector’s preparedness for the data localisation deadline.

• ‘’The survey also revealed that 22 of the 44 institutions had yet to begin implementation, with budgeting, contract negotiations and system migration among the outstanding tasks.
• “79 per cent of digital infrastructure providers surveyed were ready to accommodate new workloads from the financial sector.
• ‘’Which means that the challenge extends beyond infrastructure availability to deployment, contracting and migration’’, he said.

According to him, the initiative seeks to strengthen Nigeria’s control over critical digital infrastructure, improve data security and expand domestic capacity for hosting essential services.

Lawal said that respondents also called for stronger coordination among CBN, NITDA and the Nigeria Data Protection Commission (NDPC), alongside access to reliable local infrastructure.

He said the survey, conducted between Oct. 13 and Oct. 27, received responses from 47 financial institutions and 42 digital infrastructure providers, although the number of responses varied across individual questions.

He said the findings were self-reported, anonymised and aggregated and did not amount to a compliance assessment.

CBN insists on data localisation

In her keynote address, Dr Rakiya Yusuf, Deputy Governor, Financial System Stability, CBN, said financial institutions must ensure that critical payment transaction data was stored and managed within Nigeria in line with applicable regulatory requirements.

• She said that the Jan. 1, 2027 deadline was intended to strengthen regulatory visibility, improve resilience and safeguard critical financial data.
• The deputy governor, however, cautioned that data localisation alone would not guarantee security.
• She said there was the need for robust cybersecurity, business continuity, disaster recovery and risk-management arrangements.

According to her, financial institutions will remain accountable for risks arising from their relationships with cloud and other third-party technology providers.

The CBN official called for collaboration among regulators, financial institutions and technology providers to address implementation challenges without undermining innovation or the competitiveness of Nigeria’s financial sector.

NITDA harps on Nigerian Sovereign Cloud

Also speaking at the event, Director-General of NITDA, Mr Kashifu Inuwa, said that the Nigerian Sovereign Cloud Initiative was designed to strengthen the country’s digital self-determination by developing domestic capacity for critical technologies and infrastructure.

He said Nigerian companies spent more than 850 million dollars annually on cloud services, adding that developing local capacity could create jobs, retain more economic value within the country and reduce exposure to external disruptions.

Inuwa said the initiative aligned with the Federal Government’s Nigeria First policy, which prioritises local capacity development and value creation, rather than isolating the country from global technology.

He also cited the 2024 submarine cable disruptions as an example of the vulnerabilities associated with dependence on digital infrastructure beyond Nigeria’s control.

CBN’s data localization directive

In June this year, Earlier this month, the CBN issued a directive mandating banks, fintech firms, mobile money operators and other payment service providers to store all payment transaction data generated within Nigeria on local servers.

• This came as part of a broader regulatory push to strengthen oversight, improve transparency and reduce concentration risks in the country’s fast-growing digital payments ecosystem.
• The directive was contained in a circular issued by the apex bank on Monday and signed by the Director of the Payments System Supervision Department, Rakiya O. Yusuf.

According to the circular, all financial institutions and payment system participants facilitating transactions in Nigeria must ensure that payment transaction data generated within the country are stored and managed locally in compliance with Nigerian data protection laws and regulations. The CBN stated that affected institutions must fully comply with the requirement by January 1, 2027.