CBN’s January 2027 data localisation deadline puts banks, fintechs under pressure

Nigeria’s financial services industry is facing a major technology transition as the Central Bank of Nigeria (CBN) moves to enforce local storage and management of critical payment transaction data, with a January 1, 2027 deadline drawing closer.

The directive requires banks, fintechs, and other regulated financial institutions to ensure that critical payment transaction data is stored and managed within Nigeria in line with applicable regulatory requirements.

Although regulators have presented the policy as necessary to strengthen financial system stability, improve oversight and protect sensitive financial information, its implementation is generating concerns across the industry, particularly among institutions that depend heavily on foreign cloud infrastructure and offshore data centres.

For many operators, the challenge goes beyond moving databases and applications from overseas facilities to Nigerian data centres.

• “This involves reviewing entire technology architectures, identifying affected workloads, renegotiating service arrangements and ensuring that locally hosted systems can meet the security, reliability and availability standards required of financial institutions,” a bank official told Nairametrics.

According to him, the pressure is particularly acute for smaller operators, including payment companies and microfinance banks, some of which have indicated that they may struggle to meet the deadline.

Already, a survey conducted by the National Information Development Agency (NITDA) and CBN has established that only 59% of financial institutions in the country showed readiness for the January deadline.

Why the CBN wants financial data brought home

The CBN’s position is that data localisation is not merely an infrastructure requirement but a matter of national sovereignty, regulatory visibility and financial system resilience.

Speaking on the policy, Dr Rakiya Yusuf, Director of the CBN’s Payment System Supervision Department, said the regulator’s objective was to ensure that it had adequate visibility and oversight of critical production data within the Nigerian financial system.

• “It’s about our sovereignty, it’s about clarity, it’s about visibility over our production data, localisation was also tied to financial system stability, which is the CBN’s mandate,” Yusuf said.

The argument is that when critical financial data is hosted and processed outside Nigeria, domestic regulators may face limitations in accessing information needed to monitor transactions, investigate incidents and respond effectively to disruptions.

Yusuf said the regulator was working with institutions to address implementation challenges and provide the necessary support.

• “Everybody is hand-holding to be able to achieve the compliance with the regulation. However, where we see that there’s a deliberate attempt, of course sanctions will come,” she said.

Migration is more complex than moving data to local servers

Despite the regulatory rationale, financial institutions say meeting the deadline involves considerable technical and operational work, particularly for operators whose systems are deeply integrated with international cloud platforms.

A fintech player, who would not want to be named because the company’s business is also affected, described the process as significantly more complicated than transferring existing systems from one location to another.

• “​​Migrating this volume of interconnected workloads is not a lift-and-shift exercise,” he said.

According to him, financial institutions will need to identify and classify affected workloads, review existing technology contracts, assess dependencies and, in some cases, redesign cloud-based applications to accommodate local infrastructure.

There are also concerns about maintaining uninterrupted services during the migration.

Banks, fintechs must look beyond the pressure

CEO of Digital Realty Nigeria,Mr. Ikechukwu Nnamani, said financial institutions needed to look beyond the immediate technical implications of the directive and consider the risks of leaving critical business data under foreign jurisdiction.

He argued that data localisation should cover not only where information is stored but also where it is processed.

• “When we are saying there is a need to localise, not just your storage, the processing of some of their data needs to be localised,” Nnamani said.

He warned that financial institutions could expose themselves to business risks if foreign governments could compel overseas technology providers to process or disclose their data under local laws.

Beyond sovereignty, Nnamani said processing and storing data locally could improve service quality by reducing latency, particularly for financial institutions operating digital payment platforms that require fast and reliable transaction processing.

Early engagement with regulators and infrastructure providers

With the deadline approaching, industry stakeholders are urging financial institutions that are not ready to accelerate their engagement with regulators and local infrastructure providers.

Speaking with Nairametrics, Lars Johannisson, CEO of Rack Centre, a Nigerian data centre operator, advised institutions that anticipate difficulties meeting the deadline to seek clarification from the relevant authorities as early as possible.

He specifically recommended engaging the NITDA and the CBN to understand the requirements and identify appropriate implementation pathways.

• “For those that are not ready and believe they will not be ready, I think number one, engage as early as possible NITDA to get the clarification or even the CBN on what that clarification could mean and also engage as soon as possible with either a partner or a communication provider,” Johannisson said.

Nnamani, meanwhile, believes financial institutions should approach the policy from the perspective of managing a broader business risk rather than treating it simply as another regulatory compliance exercise.

For him, the consequences of leaving critical financial data exposed to foreign legal jurisdictions make localisation an issue that Nigeria’s financial industry cannot afford to approach casually.

The coming weeks will therefore be critical for banks, fintechs and other regulated operators as they work to align their infrastructure with the new requirements.

CBN’s data localization directive

In June this year, the CBN issued a directive mandating banks, fintech firms, mobile money operators and other payment service providers to store all payment transaction data generated within Nigeria on local servers.

This came as part of a broader regulatory push to strengthen oversight, improve transparency and reduce concentration risks in the country’s fast-growing digital payments ecosystem.

The directive was contained in a circular issued by the apex bank on Monday and signed by the Director of the Payments System Supervision Department, Rakiya O. Yusuf.

According to the circular, all financial institutions and payment system participants facilitating transactions in Nigeria must ensure that payment transaction data generated within the country are stored and managed locally in compliance with Nigerian data protection laws and regulations. The CBN stated that affected institutions must fully comply with the requirement by January 1, 2027.