Nigeria's CBN Warns Local Data Storage Alone Will Not Secure Payments as 2027 Deadline Nears

More than half of the financial institutions that answered a Nigerian readiness survey say they are prepared to meet the January 1, 2027 deadline for keeping payment data inside the country, according to BusinessDay. The finding came at a Lagos dialogue where regulators also warned that storing data locally is not, on its own, enough to keep the financial system safe.

Contents

01

Regulators Press the Case in Lagos

02

What the Survey Found

03

The Directive and What It Covers

04

Security Warnings and Enforcement

05

The Sovereign Cloud Push

Regulators Press the Case in Lagos

The Central Bank of Nigeria (CBN) and the National Information Technology Development Agency (NITDA) made the push at an Executive Regulatory Dialogue on the National Sovereign Cloud Initiative (NSCI) and data localisation, held in Lagos on Wednesday. The event brought regulators and industry operators together to discuss compliance requirements, implementation challenges and how to ensure payment data generated in Nigeria is stored locally.

Lamido Abubakar Yuguda, the CBN's deputy governor for financial system stability, used the keynote address to describe data as a strategic national asset. He said the resilience of Nigeria's financial system increasingly depends on the reliability and security of the digital infrastructure behind digital payments, fintech, mobile money and digital banking, all of which continue to expand.

NITDA disclosed that its survey of industry preparedness showed more than 50 percent of respondents were ready to work towards compliance. BusinessDay noted that this reflects reported readiness rather than confirmation that the institutions have already fully complied with the directive.

What the Survey Found

The survey, conducted between October 13 and October 27, drew responses from 47 financial institutions and 42 digital infrastructure providers, though the number of responses varied by question. On the readiness question, 44 financial institutions answered: 26 had completed or were likely to complete the required actions before the deadline, 15 said completion was unlikely or very unlikely, and three could not assess their readiness.

Dr Muhammad Lawal, special assistant on policy to the NITDA director-general, said the results point to gaps in the financial sector's preparedness. He said the findings were self-reported, anonymised and aggregated, and did not amount to a compliance assessment. Respondents also asked for stronger coordination among the CBN, NITDA and the Nigeria Data Protection Commission (NDPC), and for access to reliable local infrastructure.

The Directive and What It Covers

The CBN issued a directive requiring banks, fintech firms, mobile money operators and other payment service providers to store all payment transaction data generated within Nigeria on local servers. Under the circular, all financial institutions and payment system participants facilitating transactions in Nigeria must ensure that data generated in the country is stored and managed locally, in line with Nigerian data protection laws. Full compliance is required by January 1, 2027.

Rakiya Opemi Yusuf, director of the CBN's Payment System Supervision Department, said the requirement is needed to strengthen regulatory oversight and ensure the regulator can reach transaction information when required. She contrasted traditional banking, which relied on physical documents, ledgers and vouchers held in bank branches, with the growing digitalisation of financial services, which she said required the CBN to adapt how it supervises.

Yusuf said payment data must remain accessible throughout its lifecycle, from creation to eventual destruction under applicable retention and archiving rules. The regulator needs to see who initiated a payment, what was paid and whether the transaction succeeded, particularly for transactions originating in Nigeria. She clarified that the requirement does not mean foreign recipients of cross-border payments must disclose all information about their own customers. The focus is on keeping payment information generated within Nigeria accessible to the relevant authorities.

Security Warnings and Enforcement

Yuguda cautioned that cloud computing brings efficiency, scalability and innovation but also risks around cybersecurity, operational resilience, dependence on third parties and regulatory visibility. "Localisation alone does not guarantee security," he said, stressing that regulated institutions remain responsible for risks arising from their relationships with cloud and other technology providers. He called on financial institutions and their critical technology providers to maintain strong cybersecurity, business continuity, disaster recovery and risk management arrangements.

On enforcement, the CBN said sanctions would not be its first approach, preferring to work with stakeholders to achieve compliance. It warned, however, that deliberate attempts to disregard the requirements would attract penalties. The CBN said survey responses were being analysed and industry suggestions would be assessed on their merits, and no change to the implementation deadline was announced at the dialogue.

Hajiya Rakiya Shuaibu Mohammed, director of the CBN's Information Technology Department, said the bank was working closely with industry players towards full compliance and that firms still behind needed clearer guidance and practical support. "Our ultimate expectation is that by January 2027, everyone will be on board to have payment data localised," she said. She added that a large share of the CBN's own data is already hosted in Nigeria, with work continuing to bring remaining secondary data onshore, and noted that the bank created its Payment Systems Supervision Department in 2025 to tighten oversight of the payments sector.

The Sovereign Cloud Push

NITDA director-general and chief executive Inuwa Abdullahi framed the initiative around national economic security. He asked what would happen if a major submarine cable disruption or geopolitical crisis cut Nigerian banks off from critical digital infrastructure hosted abroad, saying such an event could raise serious questions about citizens' ability to transfer money, businesses' ability to receive payments and banks' ability to keep processing transactions. "These questions are not technical. They are matters of our national economic security, financial stability and digital sovereignty," he said.

Abdullahi said digital sovereignty does not mean isolation or building every technology locally. He said NITDA and the CBN are working to make the financial sector the first to comply with the national sovereign cloud initiative, with Nigerian technology companies seen as capable of supporting the transition while the government works with global technology providers and major cloud service providers. An assurance framework would draw on existing international certifications while exploring national certification options, and the initiative is intended to reduce the risk of institutions being locked into a particular provider, vendor or country.

Inuwa also said Nigerian companies spend more than 850 million dollars a year on cloud services, and that building local capacity could create jobs, keep more economic value in the country and reduce exposure to external disruptions. He cited the 2024 submarine cable disruptions as an example of the vulnerabilities that come with depending on infrastructure beyond Nigeria's control, and said the initiative aligns with the Federal Government's Nigeria First policy, which prioritises local capacity rather than shutting out global technology.

Yuguda said the CBN would keep working with NITDA and other stakeholders to align financial-sector rules with national digital infrastructure standards. He urged participants to focus on infrastructure readiness, cybersecurity, resilience, implementation challenges, regulatory expectations and the management of third-party and concentration risks. "We must strengthen digital sovereignty while remaining globally competitive; enhance security without constraining innovation; and promote localisation while ensuring that the financial system continues to benefit from efficient and reliable technology," he said.

Finally, WikiFX would like to remind everyone that before using any US stock, futures, or forex brokers, remember to check the platform's regulatory information, trading environment, field inspection reports, user reviews, and overall rating on the WikiFX App. This will help you effectively avoid problematic scam platforms and rogue brokers, safeguarding your capital.