On June 15, 2026, the Central Bank of Nigeria issued a circular that most Nigerian fintech users who bank on their phones will never read, titled Introduction of Market Structure Requirements
On June 15, 2026, the Central Bank of Nigeria issued a circular that most Nigerian fintech users who bank on their phones will never read, titled Introduction of Market Structure Requirements, Data Localisation, Ultimate Beneficial Ownership Disclosure, and Systemic Oversight Measures in the Nigeria Payments System.
Buried inside it is a single instruction with outsized consequences for every fintech user in the country: every institution facilitating payments in Nigeria must ensure that payment transaction data generated within the country is stored and managed inside Nigeria, in line with the country’s data protection laws. Full compliance is due by January 1, 2027. Financial institutions have until December 31, 2026, to show they are ready.
Most of the coverage since then has followed the money and the servers, cloud migration costs, the strain on local data centres, and whether providers like Rack Centre, Open Access Data Centres, and Equinix’s MDXi can absorb a sudden wave of demand from banks and fintechs currently running on AWS and Azure.
That is a real and legitimate story, and fintech executives have been candid about the operational risk of a roughly six-month runway for infrastructure that cannot simply be copied from one server to another. But almost none of that coverage answers a more basic question:
What does any of this actually change for the person who opens a savings app on their phone, checks a balance, and moves on with their day?
The day before that circular landed, a coalition of Nigerian civil society organisations, including Media Rights Agenda, Paradigm Initiative, the Digital Rights Lawyers Initiative, Accountability Lab Nigeria, PROMAD Foundation, and DigiCivic Initiative, published a statement warning that Nigerians’ personal data remains vulnerable to abuse despite the country’s existing legal framework.
Their statement was not specifically about the CBN’s payments directive. It pointed to the National Identity Management Commission’s digital identity database, which had enrolled more than 136 million Nigerians as of today. It cited reporting on a breach of INEC’s voter database and on National Identification Numbers being sold online for as little as ₦100. Their core complaint was structural: public institutions holding the largest volumes of citizens’ data face far less scrutiny than the private companies required to file compliance audits with the Nigeria Data Protection Commission.
“Citizens are under-protected from data abuse and over-exposed to state monitoring and punishment,” the coalition said.
That warning was not written with the CBN’s data localisation directive in mind, but it lands squarely on the same underlying question the directive raises for an average fintech user: if a domestic institution is handling more of your data, does that make you safer, or simply relocate the risk?
Nigeria’s Data Protection Act 2023 established data subject rights, access, rectification, erasure, portability, and created the NDPC to enforce them. Those rights exist on paper regardless of where a company’s servers sit. What changes with data localisation is not whether the rights exist, but whether an already strained enforcement system can keep up as more data becomes concentrated at home.
Oladipupo Ige, a data protection and digital rights lawyer who represented the plaintiff in a case that set a precedent for holding organisations liable for mishandling personal data, thinks the asymmetry the coalition describes does not translate into a meaningful new risk from this specific directive.
His first point is that the underlying premise, more government access to citizens’ data, is not new. He argues that government access to citizens’ transaction data has always existed through open banking, credit reporting policies, and the Bank Verification Number system, so relocating servers domestically does not by itself expand what the state can already see.
“There has never been anytime where the government did not have access to citizens’ transaction data,” he said.
His second point is a direct challenge to the “weak guardrails” framing, at least as it applies to private financial institutions. He points to the NDPC’s mandatory audits, registrations, and risk assessment controls, along with a rising number of court cases and judgements against financial institutions, as evidence that enforcement now has real teeth.
He also frames the CBN directive as narrower than critics have suggested, arguing it is simply the CBN enforcing an obligation the Nigeria Data Protection Act already imposes: cross-border data transfers are prohibited outside specific exceptions such as adequacy agreements, binding corporate rules, and standard contractual clauses, and personal data of Nigerians is statutorily meant to stay in Nigeria regardless of this circular.
Data Privacy In his view, Nigerian institutions have leaned on foreign servers less because domestic providers cannot legally or operationally handle the work and more because of what he called “perceived inadequacies,” largely around bandwidth, that he says do not hold up when it comes to actual operations.
Read alongside the coalition’s statement, the two do not fully contradict each other so much as they are answering different-sized versions of the same question. The coalition’s evidence, the NIMC database, the INEC breach, the ₦100 NIN sales – is about public institutions with comparatively little oversight.
Ige’s rebuttal is largely about private financial institutions, where he argues NDPC enforcement has genuinely tightened. Neither side has directly weighed in on the specific mechanics of the CBN’s payments directive itself, which leaves a real gap this piece could not close in the time available: whether the NDPC believes its current enforcement capacity, adequate by Ige’s account for banks and fintechs, extends to the public sector data systems the coalition says remain unscrutinised.
What changes for the average fintech userOn the question this piece set out to answer, ‘What changes for the average fintech user?’, Ige’s answer is almost anticlimactic by design. Most Nigerians, he said, will not feel a difference except potentially in service speed during the migration period. The risk he flags is not government access but operational: data breaches originating from financial institutions themselves, unauthorised access, and the security and access controls of the local server platforms and data centres now under scrutiny.
His practical advice is not to watch for new state monitoring powers but to watch for how seriously institutions treat their own compliance.
“With or without the CBN directive, these institutions will be liable for whatever data protection violations that originate from their processing activities,” he said, adding that what is required from institutions during this migration is a Data Protection Impact Assessment specific to the risks of moving servers domestically and a robust internal policy to match. “Data protection is not that difficult, what is required is just the will to comply.”
Put together, what emerges is not a single clean verdict on whether data localisation makes ordinary Nigerians safer or more exposed but a narrower and more useful finding: the confidence in Nigeria’s data protection framework depends heavily on which part of the system is being asked about. A rights lawyer with direct courtroom experience against private financial institutions sees a framework with real enforcement teeth. A coalition of civil society organisations looking at public sector data systems sees an implementation crisis with almost none. Both can be true at once, and for the fintech user checking a balance on their phone, wherever the servers holding that balance end up sitting, that split verdict may be the most honest answer available right now.
