The Central Bank Of Nigeria’s Localisation Directive: Data Protection Compliance Implications For Financial Institutions And Participants In Nigeria’s Payments Ecosystem.

On 15 June 2026, the Central Bank of Nigeria (CBN) issued a circular directing all financial institutions and other participants in the Nigerian payments ecosystem to ensure that payment transaction data generated within Nigeria is stored and managed in accordance with applicable Nigerian data protection laws and regulations. All affected institutions are expected to fully comply with this requirement with effect from 1 January 2027. This data localisation requirement will apply to deposit money banks, microfinance banks, mobile money operators, and payment solution providers.

What is Data Localisation?

Data localisation refers to the practice of ensuring that data generated within a specific jurisdiction remains within its geographical boundaries. This may be achieved through data centres, servers, and cloud infrastructure located within the country.

Why is this CBN Directive Important?

1. Stricter Controls -Keeping payment transaction data within Nigeria enables regulators and relevant government authorities to exercise greater oversight over how such data is accessed, stored, processed, and shared. It also reduces the risk of unauthorised access, misuse, or exposure of sensitive financial information to jurisdictions outside Nigeria.
2. Economic Implications and Digital Sovereignty – The localisation requirement is expected to stimulate investment in domestic data centres, cloud services, and digital infrastructure. This, in turn, can create employment opportunities, encourage technological advancement, and reduce Nigeria’s reliance on foreign technology providers. More broadly, it reinforces Nigeria’s digital sovereignty by ensuring that critical financial data remains under national control.
3. Law Enforcement and Regulatory Compliance- Storing payment transaction data locally will enable law enforcement and regulatory authorities to access information more efficiently when required for investigations or compliance purposes. It can also expedite investigations relating to financial crimes, cybercrimes, and other unlawful activities by reducing delays associated with obtaining data stored in foreign jurisdictions.

 Not a Novel Introduction

This directive is not the first of its kind. Over the years, several regulatory bodies have introduced policies and guidelines that promote data localisation and strengthen Nigeria’s control over sensitive data. For instance, the Nigerian Information Technology Development Agency (NITDA)’s Guidelines for Nigerian Content Development³ imposes obligations on entities that handle sovereign data to host and store it within Nigeria. The referenced Guidelines further provide that sovereign data must not, for any reason, be hosted outside the country without the express approval of NITDA. Such approval will only be granted in compliance with the Nigeria Data Protection Act (NDPA) 2023, taking into consideration the implications of the Nigeria Cloud Policy² and subject to adequate data security measures, non-disclosure commitments, and periodic audits.

With less than six months to the compliance deadline set by the CBN, an important question arises: Does Nigeria currently have the necessary infrastructure to support the storage and hosting of the vast amount of payment transaction data that will be required to remain within the country? Equally important is whether financial institutions and other participants in the Nigerian payment ecosystem are adequately prepared to transition to local infrastructure within the prescribed timeline.

These are critical questions that require immediate attention. The directive is not merely a compliance exercise; it is a call for regulators, infrastructure providers, and financial institutions to act swiftly to ensure that Nigeria’s digital ecosystem is capable of supporting this transition before the 1 January 2027 deadline.

The Way Forward for Every Financial Institutions and Payment Participants

1. Map and Classify Data Flows: Financial institutions and payment platforms should begin by identifying and mapping the flow of transaction data across their systems to determine which datasets are subject to regulatory requirements. Given that transaction data may contain personal data and, depending on its nature and context, may reveal or include sensitive personal data, organisations should ensure that such data is stored locally in accordance with the CBN’s directive. In addition, any cross-border data transfers must comply with the adequacy and safeguard requirements under the NDPA.
2. Strengthen Data Governance Frameworks- Organisations should establish a comprehensive data governance frameworks that integrate data privacy, cybersecurity, and operational risk management. This includes developing internal data handling and management policies, appointing a competent Data Protection Officer (DPO), and embedding privacy-by-design principles into products and services to ensure that privacy and security are considered from the outset.
3. Conduct a Data Protection Impact Assessment (DPIA) – The transition to locally based data infrastructure may present significant risks if not properly managed. Accordingly, organisations should conduct a Data Protection Impact Assessment (DPIA) to identify and mitigate potential risks associated with the transition. Engaging a licensed Data Protection Compliance Organisation (DPCO) will also be essential to ensure compliance with the provisions of the NDPA and the General Application and Implementation Directive (GAID) 2025³.
4. Review and Update Third-Party Agreements– Existing agreements with third parties involved in the processing of transaction data should be reviewed and updated to reflect the CBN’s directive. Organisations should also incorporate appropriate data residency obligations and data localisation clauses into all relevant agreements.
5. Implement Effective Data Retention Practices– Organisations should establish robust data retention mechanisms and retain only datasets that are required by law or regulation. Unnecessary data should be deleted to reduce storage burdens and improve compliance efficiency. Effective data retention practices can also lower storage and processing costs while simplifying compliance audits.
6. Leverage Local Infrastructure Providers– To mitigate the costs associated with migrating from international cloud providers to local infrastructure, organisations should consider partnering with Nigerian providers that offer managed cloud services and compliance-ready infrastructure. This approach may facilitate faster implementation and support timely compliance with the CBN’s requirements.

In conclusion, financial institutions and payment participants should immediately begin preparations and put in place the necessary governance, technical, and operational measures to meet the deadline set by the CBN. Early action will not only ensure regulatory compliance but will strengthen data security, enhance operational resilience, and support Nigeria’s broader digital sovereignty objectives.

Footnotes

1 https://nitda.gov.ng/wp-content/uploads/2020/11/GNCFinale2211.pdf

2 https://nitda.gov.ng/wp-content/uploads/2020/11/NCCPolicy_New1.pdf

3 https://ndpc.gov.ng/wp-content/uploads/2025/07/NDP-ACT-GAID-2025-MARCH-20TH.pdf