CBN Data Localisation Rule Raises Skills, Security Concerns
Nigeria’s financial technology and banking sectors are preparing for the Central Bank of Nigeria’s (CBN) directive requiring payment transaction data generated within the country to be stored and managed locally from January 1, 2027.
While industry stakeholders say Nigeria has sufficient data-centre capacity to support the policy, they have raised concerns about shortages of specialised technical skills, migration costs and the security of the fibre infrastructure supporting local data facilities.
The concerns were raised during a technology roundtable in Lagos focused on the practical implications of the CBN’s data localisation requirement for banks, fintech companies and other payment service providers.
The directive was issued by the CBN’s Payments System Supervision Department in a circular dated June 15, 2026. It requires financial institutions and other participants facilitating payments in Nigeria to ensure that payment transaction data generated within the country is stored and managed in Nigeria in line with applicable data protection laws.
The regulation is expected to take effect fully from January 1, 2027, giving affected institutions a limited period to review their existing infrastructure, migration arrangements and data-management systems.
Stakeholders at the Lagos session said the country’s growing digital payments market makes reliable infrastructure essential to the success of the policy.
Electronic payment transactions reached N284.99 trillion in the first quarter of 2025, according to data attributed to the Nigeria Inter-Bank Settlement System. Point-of-sale transaction value also rose to N10.45 trillion during the period, highlighting the increasing volume of data generated by the financial system.
Head of Research at Kickoff Africa and moderator of the session, Ayobami Olajide, said financial institutions would need to approach the migration as a major technology and operational exercise rather than a routine upgrade.
He noted that Nigeria’s largest banks spend significant amounts on cloud and information technology services, making the transition potentially costly if systems have to be significantly reconfigured.
Technical Adviser to the Chief Executive Officer of the National Identity Management Commission, Fola Olatunji-David, however, said the policy had not necessarily come before the market was ready.
He pointed to NIMC’s national identity database, which he said contains more than 140 million records, including about 100 million biometric records, as an example of large-scale localised data management.
Olatunji-David also stressed the importance of developing specialised skills to support the migration, urging the CBN to ensure that personnel handling the process are properly certified.
Another concern raised by industry participants was the security of Nigeria’s fibre infrastructure.
Stakeholders warned that vandalism or disruption of fibre networks could affect the reliability of financial services if critical systems become increasingly dependent on locally hosted infrastructure.
The debate comes as Nigeria’s data-centre industry continues to expand. Industry officials have said existing infrastructure has capacity to support the localisation policy, while the regulation is also expected to encourage further investment in data centres, cloud services and related digital infrastructure.
The CBN has said the localisation requirement is intended to strengthen oversight of Nigeria’s rapidly expanding payments ecosystem and ensure that transaction data generated within the country remains subject to Nigerian data-protection laws and regulatory supervision.
As the January 2027 deadline approaches, banks, fintechs and other payment operators are expected to continue assessing their infrastructure, technical capabilities and compliance arrangements ahead of the implementation of the new requirement.
