- Nigeria Tightens Control Over Digital Payments With Data Localisation Directive
Nigeria’s central bank has ordered banks, fintech companies and payment service providers to store and manage payment transaction data within the country by January 1, 2027, in a major regulatory move aimed at strengthening oversight of Africa’s largest digital payments market.
The Central Bank of Nigeria directive applies to financial institutions and participants facilitating payments within Nigeria, including banks, mobile money operators, switching and processing companies, payment terminal service providers, payment solution service providers, super agents and other licensed operators in the payments ecosystem.
The policy forms part of a broader regulatory overhaul covering data localisation, ownership disclosure, competition safeguards and systemic oversight in Nigeria’s fast-growing payments industry.
According to the CBN, all payment transaction data generated within Nigeria must be stored and managed domestically in accordance with the country’s data protection laws and regulations.
“All Financial Institutions and participants facilitating payments within Nigeria shall ensure that payments transaction data generated within Nigeria are stored and managed in Nigeria in accordance with data protection laws and regulations applicable in Nigeria,” the circular said.
Affected institutions are expected to fully comply with the requirement by January 1, 2027.
The directive is one of the most consequential technology and compliance interventions in Nigeria’s digital finance sector in recent years.
Nigeria’s payments market has expanded rapidly, driven by mobile money, bank transfers, point-of-sale transactions, digital wallets, merchant payments and fintech platforms. That expansion has improved efficiency, accelerated financial inclusion and reduced dependence on cash in many parts of the economy.
But it has also raised new regulatory concerns around data control, operational dependence, ownership transparency and the concentration of market power among a few large operators.
The CBN said the growth of electronic payments and digital financial services had created “significant structural developments” within the payments ecosystem, including the emergence of operators with substantial market presence across key payment activities.
The regulator said the new measures are intended to enhance transparency, promote competition, reduce systemic vulnerabilities and strengthen the resilience of the payments system.
At the centre of the directive is data sovereignty.
By requiring payment transaction data to be stored and managed inside Nigeria, the CBN is seeking to ensure that sensitive financial information generated in the country remains subject to Nigerian law and regulatory access.
For regulators, this could improve supervision, speed up investigations, strengthen consumer protection and reduce reliance on offshore data infrastructure.
For banks and fintechs, however, the rule could require major changes to technology architecture, cloud hosting arrangements, data governance systems and vendor contracts.
Many digital financial service providers rely on global cloud infrastructure, offshore processing arrangements or regional technology stacks to manage transactions efficiently.
Moving or duplicating data infrastructure into Nigeria could raise compliance costs, require new local partnerships and increase operational complexity.
The directive will also affect cloud service providers and data centre operators.
If banks and fintechs must localise payment data, demand for domestic cloud services, secure hosting, disaster recovery systems and compliance-grade data infrastructure could rise sharply.
This could create new opportunities for Nigeria’s local technology infrastructure industry.
But it could also expose gaps in domestic capacity, including power reliability, cybersecurity standards, resilience, redundancy and cost competitiveness.
The success of the policy will therefore depend not only on regulatory enforcement, but also on whether Nigeria has sufficient local infrastructure to support the scale, security and speed required by its payments ecosystem.
Beyond data localisation, the CBN has also introduced stricter ownership disclosure rules.
Financial institutions involved in payment services must maintain accurate and up-to-date records of their ultimate beneficial owners and make that information available to the regulator when requested.
The requirement is designed to improve transparency and support anti-money laundering, counter-terrorist financing and anti-proliferation financing obligations.
In a sector where fintech investment often involves complex ownership structures, cross-border investors and layered corporate arrangements, beneficial ownership disclosure is becoming a critical regulatory tool.
It allows supervisors to know who ultimately controls institutions that handle large volumes of financial transactions and customer data.
The new framework also introduces competition-related safeguards to prevent excessive market dominance and reduce dependence on a small number of operators or infrastructure providers.
That aspect of the policy reflects growing concern that digital payment ecosystems can become systemically important very quickly.
A large payment operator may begin as a fintech innovator but eventually become critical to daily commerce, household payments, merchant transactions and financial inclusion.
Once that happens, operational failure, governance weaknesses, cyber incidents or ownership opacity can become risks not only to customers, but to the wider financial system.
Nigeria’s approach therefore signals a regulatory shift from encouraging digital finance growth to managing the systemic risks created by that growth.
For years, African regulators have promoted fintech innovation as a way to close financial inclusion gaps. But as transaction volumes have grown, the focus has increasingly moved toward resilience, data protection, competition and national control over critical digital infrastructure.
Nigeria is not alone in this direction. Around the world, regulators are paying closer attention to where financial data is stored, who controls payment rails, how cloud infrastructure is managed and whether dominant platforms could create systemic vulnerabilities.
For Nigeria, the stakes are particularly high.
The country is home to one of Africa’s most dynamic fintech markets, with millions of users relying on digital wallets, instant transfers, payment terminals and mobile-based banking services. Any disruption in the payments system can quickly affect small traders, households, transport operators, merchants and formal businesses.
The CBN’s directive seeks to reduce these vulnerabilities by ensuring that core payment data is within regulatory reach.
However, implementation will be closely watched.
A January 2027 deadline gives operators a limited transition window to review technology systems, negotiate with vendors, migrate data, test local hosting arrangements and ensure compliance with data protection rules.
Large banks and well-capitalised fintechs may be able to adapt more quickly. Smaller operators may find the cost and technical requirements more difficult.
The regulator will also need to clarify how the rule applies to cross-border payments, cloud backups, disaster recovery arrangements, fraud monitoring systems and global technology vendors that support local payment services.
Without detailed implementation guidance, firms may face uncertainty over what qualifies as domestic storage and management.
Still, the policy direction is clear.
Nigeria wants payment data generated in Nigeria to remain under Nigerian jurisdiction.
For the fintech sector, this marks a new phase of regulatory maturity.
Innovation will remain important, but it will now be judged alongside data governance, transparency, local compliance and systemic resilience.
For banks and fintechs, the next six months will require urgent preparation.
For cloud providers and data centre operators, the directive could unlock a major new market.
For regulators, the challenge will be to enforce sovereignty without weakening innovation.
Nigeria’s payment data deadline is therefore more than a technical compliance rule.
It is a statement about who controls the infrastructure, information and risks behind the country’s digital financial future.
