CBN Sets Jan 1, 2027 Payment Data Local Storage Rule

In Short

• The Central Bank of Nigeria, CBN, is moving to enforce a data localisation directive for critical payment transaction data, with a January 1, 2027 deadline.
• Banks, fintechs, and other regulated financial institutions must store and manage this data within Nigeria.
• A NITDA and CBN survey found that only 59% of financial institutions showed readiness for the January deadline.

What Happened

The Central Bank of Nigeria, CBN, is pushing Nigeria’s financial services industry to store and manage critical payment transaction data inside the country by January 1, 2027.

The directive applies to banks, fintechs, and other regulated financial institutions. It requires critical payment transaction data to be stored and managed within Nigeria, in line with regulatory requirements.

Regulators have framed the policy as a way to strengthen financial system stability, improve oversight, and protect sensitive financial information. But the policy is raising concerns across the industry, especially among institutions that rely heavily on foreign cloud infrastructure and offshore data centres.

A bank official told Nairametrics that compliance is more than copying databases into local servers. The official said it involves reviewing entire technology architectures, identifying affected workloads, renegotiating service arrangements, and ensuring locally hosted systems meet security, reliability, and availability standards.

Why It Matters

CBN officials say the policy is tied to national sovereignty, regulatory visibility, and financial system resilience.

Dr Rakiya Yusuf, Director of the CBN’s Payment System Supervision Department, said the regulator’s objective is to have adequate visibility and oversight of critical production data within the Nigerian financial system. She said, “It’s about our sovereignty, it’s about clarity, it’s about visibility over our production data, localisation was also tied to financial system stability, which is the CBN’s mandate.”

The CBN’s view is that when critical financial data is hosted and processed outside Nigeria, domestic regulators may face limits in accessing information needed to monitor transactions, investigate incidents, and respond to disruptions.

Yusuf also said the regulator is working with institutions to address implementation challenges and provide support. She added that where there is a “deliberate attempt,” sanctions will follow.

The pressure is expected to be higher for smaller operators, including payment companies and microfinance banks, with some indicating they may struggle to meet the deadline.