CBN data localisation: what Nigerian payment firms must move before 1 January 2027

On 15 June 2026 the Central Bank of Nigeria's Payments System Supervision Department issued circular PSS/DIR/PUB/CIR/001/004, and it gave every licensed payment operator in the country a hard date: from 1 January 2027, payment transaction data generated in Nigeria must be stored and managed in Nigeria.

The circular is wider than the headline. It bundles four obligations — data localisation, ultimate beneficial ownership disclosure, market concentration limits and enhanced systemic oversight — and two of them share the same deadline week. If you run payments infrastructure, this is no longer a policy signal to monitor. It is a migration with a date.

What the circular actually requires

The operative sentence is unambiguous:

All Financial Institutions and participants facilitating payments within Nigeria shall ensure that payment transaction data generated within Nigeria are stored and managed in Nigeria in accordance with data protection laws and regulations applicable in Nigeria.

The circular is signed by Rakiya Yusuf, Director of Payments System Supervision, and addressed to deposit money banks, microfinance banks, mobile money operators, switching companies, payment terminal service providers, super agents and all other licensed payment operators. If you touch a payment in Nigeria as a licensed participant, you are in scope.

Four obligations, two deadlines

• Data localisation — 1 January 2027. Transaction data must be stored and managed in-country.
• Market structure limits — 31 December 2026. Concentration caps apply to combined card issuing and merchant acquiring positions, with monthly market share returns to the CBN. As reported, an institution above 25% of card issuing cannot also hold more than 15% of merchant acquiring, and the reverse applies.
• Ultimate beneficial ownership disclosure — ongoing. Ownership must be traceable through holding structures and available to the CBN on request, aligned with existing anti-money laundering rules.
• Systemic oversight — continuous. Operators whose scale makes them critical to the payment system face enhanced supervision.

The sequencing is the part teams underestimate. The market structure deadline falls one day before localisation, so December is not a quiet month.

What "stored and managed in Nigeria" really covers

Localising the primary transaction database is the easy half. The obligations follow the data, not the schema, so the inventory has to include:

• Primary transactional databases and their write-ahead logs.
• Backups, snapshots and point-in-time recovery copies.
• Disaster recovery replicas, including warm standby in another country.
• Application, audit and access logs that carry transaction identifiers or amounts.
• Analytics warehouses, data lakes and the reverse-ETL pipelines that feed them.
• Key material and secrets held in foreign managed services.
• Vendor and support access paths — remote sessions that let a third party read production data from abroad.
• Message queues and event streams retained for reconciliation.

The common failure is a team that localises the ledger, then discovers the fraud analytics warehouse, the log pipeline and the support tooling all still live in Frankfurt. That is still payment transaction data, and it is still in scope.

The question the circular leaves open

Does a hyperscaler's in-country availability zone satisfy the requirement? The circular does not say, and that single ambiguity drives most of the cost difference between a six-week migration and an eighteen-month rebuild.

Until the CBN clarifies, the defensible engineering position is portability: standard database engines, object storage with no proprietary export traps, infrastructure defined as code, and a tested restore path into a Nigerian facility. If the answer turns out to be "local zone is fine", you have lost nothing. If it is "Nigerian-owned infrastructure only", you can move in weeks rather than quarters.

The NDPA is the same track, not a parallel one

The circular explicitly ties localisation to Nigerian data protection law, which means the Nigeria Data Protection Act 2023 is in scope at the same time. Localising data does not discharge NDPA obligations — lawful basis, data subject rights, breach notification, processor contracts and records of processing all still apply, and a migration is exactly when those controls tend to break.

Treat the two as one programme with one evidence pack. Auditors will ask the same questions twice otherwise.

A realistic 60-day sequence

1. Inventory and classify (weeks 1–2). Map every flow that carries transaction data, including the shadow copies nobody owns. Rank by regulatory exposure, not by system importance.
2. Contract review (weeks 2–3). Offshore processing terms, sub-processor lists, exit and data-retrieval clauses. Identify which contracts conflict with in-country storage before you design the target state.
3. Target architecture and capacity (weeks 3–5). Confirm power, cross-connect and latency at the chosen facility, and size for peak, not average. Capacity in Lagos is a commercial negotiation, not a catalogue order.
4. Migration and rehearsal (weeks 5–8). Migrate in dependency order — identity, then ledger, then analytics — and rehearse the cutover and the rollback. A migration plan without a tested reverse path is a hope.
5. Evidence and attestation (continuous). Keep the inventory, the data-flow diagrams, the contract positions and the test results in one place. Anticipate a supervisory request rather than assembling evidence after one arrives.

What it does to infrastructure demand

The Association of Licensed Telecommunications Operators of Nigeria has backed the directive. Its chairman, Gbenga Adebayo, has argued that hosting data abroad adds latency and retrieval cost to every transaction, and that paying for local hosting in naira reduces the foreign exchange exposure baked into most infrastructure contracts.

He also dismisses the readiness objection, pointing to roughly six Tier III data centres already operating in Nigeria, some of which host data for organisations in other jurisdictions. That is a fair point about capability, though it understates the practical constraint: the scarce inputs are power and cross-connects, not floor space, and demand from every bank and fintech at once will test both.

What to watch next

• CBN guidance on cloud regions. Whether an in-country availability zone of a foreign hyperscaler counts is the single most consequential open question.
• Enforcement posture. The CBN has said it will monitor compliance and impose supervisory sanctions. No penalty schedule specific to this circular has been published, which usually means supervisory discretion rather than a price list.
• The Nigerian Fintech Regulatory Commission Bill. A standalone fintech regulator is still moving through the National Assembly. If it passes, the supervisor for part of this estate changes, even if the deadline does not.
• Any slippage. There is no public signal that the date will move, and planning on the assumption that it will is not a strategy.

Frequently asked questions

Who does the directive apply to? Licensed payment participants: deposit money banks, microfinance banks, mobile money operators, switching companies, payment terminal service providers, super agents and other licensed operators facilitating payments in Nigeria.

Does it only cover the primary database? No. The obligation follows payment transaction data wherever it lives, including backups, DR replicas, logs, analytics copies and vendor access paths.

Does using a Nigerian region of a global cloud count? Unresolved. The circular does not address hyperscaler local zones, so design for portability until the CBN says otherwise.

Is localisation a substitute for NDPA compliance? No. The circular requires data to be managed in accordance with Nigerian data protection law, which brings the NDPA 2023 into scope alongside it.

What happens if we miss 1 January 2027? The CBN has said it will monitor compliance and impose supervisory sanctions. The practical risk is supervisory rather than a published fine, which makes it harder to budget and easier to defer — and therefore more likely to hurt.

This is a technical summary for planning purposes, not legal advice. Read the circular and take Nigerian counsel before committing to an architecture.

Sources

• Central Bank of Nigeria — circulars and reforms
• Analysis of the CBN data localisation directive and its deadlines
• Legal analysis of the directive and the road to 1 January 2027
• Nigeria Data Protection Commission