The Central Bank of Nigeria (CBN) has mandated all banks, fintechs, mobile money operators, and payment service providers to store payment transaction data generated in Nigeria on local servers by January 1st, 2027. The directive, outlined in a circular signed by Rakiya Yusuf, Director of the CBN's Payments System Supervision Department, requires that all locally generated transaction data remain within the country in compliance with Nigerian data protection laws. This move is intended to enhance regulatory oversight, improve consumer protection, and reduce risks tied to offshore data storage. Companies using foreign cloud infrastructure or cross-border data processing systems will need to restructure their operations significantly within the six-month compliance window. In addition to data localisation, the CBN is enforcing new transparency rules requiring payment service providers to disclose their ultimate beneficial owners—the individuals who ultimately control or own a company, even through layered corporate structures. The regulator said this will support anti-money laundering efforts and reduce risks linked to hidden ownership. The CBN also introduced systemic oversight measures that may subject key payment operators to stricter supervision based on their role in Nigeria's financial infrastructure. The framework reflects the bank's broader push to strengthen governance, accountability, and resilience in the digital payments sector, which has become integral to banking, commerce, and public services. Nigeria is among the world's largest markets for instant payments, and the CBN's latest actions signal an intensified effort to assert control over the digital financial ecosystem.
The CBN's data localisation order gives companies nearly six years to comply, suggesting the regulator anticipated such delays due to technical or financial constraints. Requiring fintechs to disclose ultimate beneficial owners exposes gaps in prior oversight, given how long many of these firms have operated without full transparency. Nigerian payment firms built on foreign cloud platforms now face costly overhauls just to meet basic regulatory expectations. The January 2027 deadline implies the CBN knew this was unavoidable but waited until growth could no longer mask weak foundational controls.
Editorial note: AI-assisted opinion, not established fact. Full disclaimer →
