CBN Payment Data Localisation Rule Raises Fintech Concerns

In Short

Nigeria’s central bank has ordered payment firms to store and process payment data inside the country.

The CBN says the rule improves sovereignty and resilience. Fintech operators worry Nigeria’s local data centre capacity and disaster recovery plans may not be ready.

What Happened

The Central Bank of Nigeria, CBN, has issued a directive requiring all payment-related data generated in Nigeria to be hosted and managed domestically. Data localisation means keeping data within a country’s borders, rather than storing it in overseas cloud regions.

The CBN circular was released on June 15, 2026. The policy is expected to start in January 2027, giving banks, payment companies, and fintechs roughly six months to comply.

Many Nigerian fintechs currently rely on global cloud providers like Amazon Web Services and Microsoft Azure for transaction processing, fraud checks, and customer data storage. Under the new directive, cloud services can still be used, but the data must “reside” in Nigeria, meaning it must be stored in data centres physically located in the country.

This shifts more demand to local infrastructure such as carrier and colocation facilities, which are shared data centres where companies rent space for servers. The policy has also triggered questions about migration risk, which is the chance of outages, failed cutovers, or data loss while moving systems from one environment to another.

Why It Matters

Payments systems need high uptime because even a short outage can stop card, transfer, and wallet transactions across merchants and consumers. Fintech executives are concerned that Nigeria’s local data centres may not yet be proven at the same scale as the foreign regions they use today.

There is also the issue of disaster recovery, which is a backup setup that can take over when the main system fails. If firms are required to keep both primary and backup systems in-country, they may need new architectures, extra sites, and more network capacity.

Costs are likely to rise in the short term. Companies may face parallel running, where they pay for old and new infrastructure at the same time during migration, plus compliance work like audits and updated security controls.

For founders and operators, the next six months will be about project planning, vendor selection, and reliability testing. For investors, the key question is whether compliance spend will squeeze margins, or create a new tailwind for local cloud and data centre providers.