By Annette Ikponmwonba | October 12, 2026
Key Points
· The Central Bank of Nigeria has ruled out any extension of the January 1, 2027 deadline for locally storing and managing payment transaction data generated in Nigeria
· The position was reiterated at the CloudReady Nigeria Financial Services Roundtable in Lagos by CBN’s Payments System Supervision Department
· The requirement comes from a circular issued on June 15, 2026, covering payment service providers and other covered institutions
· Compliance must extend beyond database location to transaction logs, audit trails, metadata and supporting systems
· Institutions are warned to preserve service continuity and data integrity throughout migration
· Industry players say the policy could create opportunities for Nigerian cloud providers, data centre operators and cybersecurity firms
Main Story
The Central Bank of Nigeria has ruled out an extension of the January 1, 2027 deadline for financial institutions to store and manage payment transaction data generated in Nigeria locally, putting pressure on banks, fintechs and payment service providers to complete their migration plans. The position was made known at the CloudReady Nigeria Financial Services Roundtable in Lagos, hosted by Africa Hyperscalers Company in partnership with 100 Women in Digital Infra, Open Access Data Centres, Layer3, Nobus Cloud Services and the National Information Technology Development Agency.
Director of the CBN’s Payments System Supervision Department, Dr Rakiya Yusuf, whose remarks were delivered by Assistant Director Babatunde Ajiboye, reiterated the stance. “The compliance date hasn’t changed. It is 1 January 2027,” she said. The requirement was set out in a circular issued on June 15, 2026, directing payment service providers and other covered institutions to keep payment transaction data generated within Nigeria in the country.
Yusuf said institutions must look beyond the physical location of their databases, with compliance work covering transaction logs, audit trails, metadata and the systems supporting payment operations. “The practical sequence is to audit and classify the data, agree on the local architecture and contracts, then migrate, test, and independently verify completion,” she stated.
The Issues
The firm deadline leaves affected institutions with limited time to assess their systems, review contracts with technology providers and complete the migration of relevant data. For institutions whose applications are built around overseas cloud platforms, the move may require architectural changes and testing, and can affect costs depending on the complexity of the workload.
There is also a risk that compliance on paper could undermine operations in practice. Yusuf warned that a migration that meets the location requirement but disrupts payment services or compromises records would not adequately address the operational risks involved. Cross-border transactions add another layer, as institutions must keep covered records compliant while accounting for the needs of foreign counterparties.
Beyond compliance, the policy raises questions about readiness of local infrastructure. Open Access Data Centres CEO Dr Ayotunde Coker said local data centre space is only one part of the picture, with connectivity, redundancy, reliable power and disaster recovery equally important. Providers’ claims also need to be assessed against technical evidence and resilience arrangements, particularly their ability to maintain services during an outage.
What’s Being Said
Africa Hyperscalers Executive Director Temitope Osunrinde noted that Nigeria has taken important steps toward greater control of its digital infrastructure through the National Cloud Policy, the National Sovereign Cloud Policy, the Nigeria Data Protection Act and the CBN’s data localisation requirements. He said the challenge is no longer setting policy direction but helping institutions implement it, which will require clearer guidance on data and workload classification, resilient infrastructure, trusted providers and regulatory coordination.
Nobus Cloud COO Stephen Okoye argued that locally developed cloud technology can support institutions moving workloads into Nigeria while keeping the technical controls regulated operations require. He cited the company’s two availability zones, ISO, PCI DSS and Nigeria Data Protection Act credentials, and a claimed 100 per cent uptime. Coker urged institutions to assess their needs and risks before deciding what to migrate, rather than treating localisation as a simple relocation exercise.
The Nigerian Data Protection Commission, represented by Ibukunoluwa Owa on behalf of National Commissioner Dr Vincent Olatunji, stressed data protection impact assessments, third-party risk assessments and proper data processing agreements. Owa also highlighted breach reporting, transparent privacy policies, remedies for possible downtime and disaster recovery plans.
What’s Next
Institutions experiencing difficulties are expected to show the progress they have made, identify outstanding gaps and present credible plans to close them. The CBN also urged them to review agreements with cloud and technology providers to establish where data is stored, how it is processed and backed up, and whether current arrangements can meet the new requirements.
With the January 1, 2027 date fixed, attention will turn to how many banks, fintechs and payment service providers complete migration in time, and whether local cloud providers and data centre operators can demonstrate the security, reliability and capacity financial institutions need.
Bottom Line
The CBN has made clear there is no wiggle room on its data localisation deadline, leaving banks, fintechs and payment providers with a tight window to migrate safely, while opening a major opportunity for Nigerian cloud and data centre providers able to prove they can handle regulated financial workloads.
