Nigeria Requires Financial Institutions to Localize Payment Data From January 1, 2027
Key Facts
Nigeria’s central bank has required financial institutions that facilitate payments within the country to store and manage locally generated payment transaction data in Nigeria, with the requirement taking effect on January 1, 2027, TheCable reported. The decision sets a deadline for banks and payment service providers to arrange local data storage systems and related operations. Ruqayya Yusuf, director of the central bank’s Payment Systems Supervision Department, said localization is necessary to strengthen regulatory oversight and make transaction information available to the regulator when needed. She added that the policy gives regulators “better visibility into transactions” and bolsters financial system stability. The directive is part of an effort to expand the central bank’s ability to monitor payment activity in the Nigerian market.
The directive covers financial institutions and covered payment service providers that facilitate payment transactions in Nigeria; it is not limited to major banks. The data in question is payment transaction data generated within the country, which must be stored and managed locally from the specified date. This means the entities concerned must review their technical arrangements before the requirement takes effect, including how data is managed by service providers. The coverage did not specify a list of institutions, but tied the obligation to the activity of facilitating payments within Nigeria. The sector has less than the time remaining until the start of 2027 to complete its technical and regulatory preparations.
The central bank said a recent survey found that more than half of the institutions that responded were already prepared to meet the localization directive. Other institutions still need clarification and practical support on the requirements, Nigerian Tribune reported. This points to varying levels of readiness among respondents, with questions and obstacles still to be addressed before the deadline. The statement did not give an exact percentage or details on the number of institutions surveyed. The report said regulatory engagement aimed to clarify expectations and address institutions’ concerns, while the bank said it was considering implementation challenges. The rollout is therefore accompanied by regulatory engagement and technical support for institutions working to complete their preparations.
The central bank is not putting sanctions at the forefront of enforcement against institutions making genuine efforts to comply, preferring engagement and technical support, according to the bank official quoted by Nigerian Tribune. She said the circumstances of entities facing implementation challenges would be considered, while sanctions could apply to attempts to deliberately undermine the policy or to explicit noncompliance. The approach combines support for institutions working to meet the requirements with a warning against ignoring or obstructing them. With the implementation date fixed at January 1, 2027, institutions’ progress will form part of the regulator’s dealings with them. According to the statement, sanctions remain tied to deliberate action or clear refusal to comply, rather than simply asking for assistance.
Central Bank Deputy Governor Lamido Yuguda warned of security and operational risks associated with cloud computing, including cybersecurity, operational resilience and reliance on external parties. He said moving data to local storage alone was not enough, calling on institutions to maintain strong frameworks for cybersecurity, business continuity, disaster recovery and risk management. The warning places localization requirements within broader arrangements to protect financial services from outages and disruptions, rather than treating data storage location as sufficient on its own. His remarks also link reliance on technology providers to continuity and risk management. Institutions must therefore treat local storage, protection measures and recovery procedures as interconnected parts of their preparation.
In the broader context of government digital infrastructure, the director general of the National Information Technology Development Agency said 326 federal ministries, departments and agencies spent more than 3.8 trillion naira on information technology between June 2023 and October 2026. This spending is linked to the government’s digital infrastructure agenda and does not represent the cost for banks or payment service providers to comply with the directive. The official said the National Sovereign Cloud Initiative aims to build local capacity to ensure essential digital services continue even if external disruptions affect global technology providers. The initiative places localization of technological capacity among the goals for continuity of government services, alongside the central bank’s requirements for payment transaction data. The effort reflects an interest in building local capacity for digital services, while responsibility for security, business continuity and risk management remains with the institutions concerned.
At the supervisory level, the central bank established the Payment Systems Supervision Department in 2025 to strengthen its oversight of the sector, according to coverage cited by Nigerian Tribune. The payment data directive is part of tighter monitoring of this activity; Yusuf said making transaction information available when needed supports regulatory visibility and financial system stability. The central bank is expected to continue working with the National Information Technology Development Agency and other agencies to align financial sector rules with national digital infrastructure standards. The bank said this cooperation would continue, without specifying an additional deadline or further implementation steps in the published statement. The requirement is still scheduled to take effect on January 1, 2027.