CBN gives banks, fintechs 6 months to store customers’ transaction data within Nigeria

The Central Bank of Nigeria (CBN) has directed all financial institutions and payment operators to store and manage payment transaction data generated within Nigeria on local servers, giving the industry until January 1, 2027, to achieve full compliance.

The directive, contained in a circular signed by Rakiya O. Yusuf, Director of the Payments System Supervision Department, was addressed to deposit money banks, microfinance banks, mobile money operators, switching and processing companies, payment terminal service providers, payment solution service providers, super agents, and other licenced payment operators.

The CBN said the localisation requirement must align with Nigeria’s data protection laws and regulations and that it would monitor compliance and impose supervisory sanctions where necessary.

The circular, referenced PSS/DIR/PUB/CIR/001/004 and dated June 15, 2026, also introduced market structure requirements that cap any single institution’s market share in card issuing or merchant acquiring activities at 25%, with a further restriction that any entity crossing that threshold cannot simultaneously hold more than 15% in the other activity.

Affected institutions must comply with the market structure rules by December 31, 2026, one day before the data localisation deadline kicks in.

The CBN said the broader package of measures was designed to address concentration risk, improve transparency, and promote a fair and resilient payments ecosystem, noting that the rapid growth of digital payments had produced operators with substantial market presence across key payment activities in ways that raised structural concerns.

The circular also requires all financial institutions with digital payments footprints to disclose the ultimate beneficial ownership of significant shareholders, keeping accurate and up-to-date records available to the CBN upon request.

Read also: CBN PSV 2028: How Nigeria is using eNaira and stablecoins to bank 50 million people

What would local storage actually cost?

The data localisation requirement arrives at a moment when Nigeria’s digital infrastructure landscape is still catching up with the transaction volumes the payments industry already processes.

For institutions that currently rely on offshore cloud infrastructure, whether through global hyperscalers like AWS, Google Cloud, or Microsoft Azure, compliance will mean either migrating workloads to local data centres or negotiating local availability zones with those same providers, neither of which is a straightforward or inexpensive exercise.

The costs fall into at least three categories.

• The first is capital expenditure, covering the physical or contracted local storage capacity that many smaller fintechs, microfinance banks, and payment solution service providers do not currently have and cannot easily absorb.
• The second is operational, covering the ongoing management, security certification, and audit requirements that local data hosting introduces.
• The third and least visible is transition risk, the period between now and January 2027, during which institutions must migrate live transaction data without disrupting the payment rails that millions of Nigerians depend on daily.

For larger institutions with existing technology infrastructure, the runway to January 2027 is manageable, though not comfortable.

CBN governor, Yemi Cardoso

For the long tail of licenced operators, including super agents and smaller switching companies, the directive effectively sets a compliance clock without an accompanying framework for how costs will be absorbed or whether any technical assistance will be available.

The CBN’s framing, centred on data sovereignty and regulatory oversight, is legitimate and mirrors similar moves by regulators in India, Kenya, and elsewhere on the continent.

The practical question is whether the local data centre market, still dominated by a limited number of providers, can scale quickly enough and at competitive enough pricing to serve the full breadth of the payments ecosystem before the deadline arrives.

What the circular does not address is whether institutions will be permitted to use international cloud providers operating local availability zones within Nigeria as compliant infrastructure, a distinction that could significantly change the cost calculus for much of the industry and one that the CBN will likely need to clarify before compliance planning can proceed with any precision.