CBN Local Data Hosting Rule Tests Nigeria Data Centres

In Short

Nigeria’s central bank, the CBN, wants financial transaction records hosted inside the country.

Banks, fintechs, and payment processors have until January 1, 2027 to stop storing this data on foreign cloud infrastructure.

The deadline could push a large wave of migrations into local data centres, and it will test Nigeria’s capacity, power reliability, and security.

What Happened

The CBN’s local hosting mandate requires transaction data to be stored in data centres located in Nigeria. In simple terms, it is a forced move from overseas servers to servers inside the country.

For many financial institutions, this will mean a cloud migration, which is the process of moving data and applications from one computing environment to another. In this case, it is a shift away from foreign hyperscalers, which are very large cloud providers that run massive global server networks.

The timing matters because Nigeria’s digital payments volume is already very large. TechCabal cited Nigeria Inter-Bank Settlement System (NIBSS) data showing electronic transaction value hit ₦1.07 quadrillion in 2024, up 80% year on year.

Local cloud and hosting providers could see more demand as regulated financial firms look for compliant options. Examples include CloudAfrica, Clouds2africa, and UniCloud Africa.

Why It Matters

This is a major infrastructure stress test. Transaction data needs high uptime, fast response times, and strong security controls, because outages can stop card payments, bank transfers, and POS activity.

A data centre is not just a building with servers. It depends on steady electricity, cooling, physical security, and reliable fibre connectivity. Nigeria’s grid instability means many facilities rely on generators, which raises operating costs.

The rule could increase domestic spending on data centre space, local cloud hosting, and cybersecurity. It may also change how fintechs design systems, for example keeping sensitive payment logs and ledgers in-country while other workloads stay offshore.

For founders and operators, the next 18 months will likely include vendor selection, compliance audits, data migration planning, and testing. Any rushed move increases the risk of downtime and data loss, so the execution timeline will matter as much as the policy itself.