Nigeria’s Payment Data Localisation Deadline Puts Data Centres, Skills and Fibre Infrastructure Under Pressure
Nigeria’s rapidly expanding digital payments industry is entering a critical phase as banks, fintech companies and other payment operators prepare to meet a Central Bank of Nigeria requirement that payment transaction data generated within the country be stored and managed in Nigeria.
With the January 1, 2027 compliance date approaching, industry stakeholders are increasingly focusing not only on whether Nigeria has enough data-centre space, but also on the availability of specialised technology professionals, reliable electricity, resilient fibre networks, cybersecurity and the cost of moving complex financial systems.
The latest discussion has added an important dimension to the debate. At a technology roundtable in Lagos, industry executives and government officials said Nigeria’s existing data-centre infrastructure has enough capacity to support the transition, while warning that infrastructure capacity alone will not resolve the operational challenges involved.
The discussion was reported by The PUNCH on September 28 following a three-hour roundtable organised by SPARK, organisers of the African Technology Expo, in partnership with B4B Partners. Representatives from MTN Nigeria Communications, Patrick Gold Microfinance Bank and the National Identity Management Commission took part in the session.
The Central Bank’s directive, issued on June 15, gives affected institutions just over six months to bring their payment-data arrangements into compliance. As of September 28, 2026, 95 days remain until the January 1 deadline.
The policy affects a wide part of Nigeria’s payments ecosystem, including deposit money banks, microfinance banks, mobile money operators, switching and processing companies, payment terminal service providers, payment solution service providers, super agents and other licensed operators.
What the CBN directive requires
The requirement is contained in Circular PSS/DIR/PUB/CIR/001/004, issued by the CBN’s Payments System Supervision Department on June 15, 2026.
The circular introduced several measures covering market structure, data localisation, ultimate beneficial ownership disclosure and systemic oversight in Nigeria’s payments system.
Its data-localisation provision requires financial institutions and participants facilitating payments in Nigeria to ensure that payment transaction data generated within the country is stored and managed within Nigeria in accordance with applicable Nigerian data-protection laws and regulations.
The measure is part of a wider regulatory effort around Nigeria’s increasingly important electronic payments infrastructure.
The CBN has also introduced market-structure requirements and beneficial-ownership disclosure obligations through the same circular. Those provisions are separate from the technical question of where payment information is hosted, but together they represent a broader regulatory approach to the country's payments industry.
For technology departments, however, data localisation is the part likely to require the most extensive operational work.
Moving a payment platform is not simply a matter of transferring a database from one server to another.
Modern financial systems can involve primary databases, backup environments, disaster-recovery systems, cloud applications, analytics platforms, fraud-detection systems, application logs, monitoring systems, third-party processors and connectivity infrastructure.
A transaction can therefore create multiple pieces of information across different systems.
That is why the practical meaning of the phrase “stored and managed in Nigeria” has become an important technical issue for banks and fintech companies.
Why the January deadline matters
The CBN issued its circular in June, but implementation is now becoming more urgent because financial institutions have to make decisions about infrastructure, vendors, software architecture, disaster recovery and connectivity well before the deadline.
BusinessDay reported on September 24 that Nigeria’s cloud infrastructure has enough capacity to support migration of payment data, while noting concerns about specialised talent and fibre security.
The report also said the deadline was placing scrutiny on cloud and information-technology spending by major banks, citing a reported figure of about N200 billion in quarterly cloud and IT spending by Nigeria’s 10 largest banks. That spending figure is an industry-reported estimate rather than a CBN-published aggregate, and should therefore be treated as such.
The underlying technological challenge is broader than expenditure.
Banks have to determine which workloads are affected, where their payment information is currently stored, which systems generate or replicate that information, and whether existing arrangements with international cloud or technology providers satisfy the new requirement.
They must also consider how business continuity will work if a primary Nigerian facility becomes unavailable.
A system that meets a residency requirement but lacks adequate backup, redundancy or network resilience could still face operational difficulties.
Nigeria has data-centre capacity, but capacity is only one part of the equation
The latest industry discussion produced a relatively clear assessment on physical infrastructure: Nigeria already has significant data-centre capacity.
At the Lagos roundtable, industry participants said the country’s infrastructure could support the localisation requirement.
That assessment is consistent with comments from Ayotunde Coker, chief executive of Open Access Data Centres, who has argued that Nigeria has capacity that can be expanded as demand grows.
In a September 22 interview with Nairametrics, Coker said the CBN policy was already generating greater interest in local colocation and cloud services among fintech and banking platforms. He also pointed to the potential for further data-centre development outside Lagos, including in Abuja and Port Harcourt.
Nigeria’s data-centre market has expanded considerably in recent years, particularly around Lagos.
The concentration of subsea cable connections, technology companies, financial institutions and existing digital infrastructure has helped make Lagos the country’s principal data-centre market.
But that concentration also presents a resilience question.
If too much critical infrastructure is concentrated in one geographic area, institutions may need additional facilities in other locations to provide effective disaster recovery.
Coker said the industry was looking at locations including Abuja and Port Harcourt, while noting that Lagos would remain an important hub because of its connectivity to international subsea cable systems.
The issue is therefore not simply whether there are enough racks or enough physical space.
It is whether the country can provide enough resilient computing capacity, power, network connectivity, cooling, security, technical expertise and redundancy for financial institutions operating systems that cannot easily tolerate prolonged outages.
The hidden complexity of moving payment data
One of the most difficult aspects of localisation is that financial information does not necessarily remain in one place.
A bank may have its main payment database in one environment while maintaining a backup elsewhere. Its fraud-monitoring system may be separate. Analytics workloads may run through another platform. Application logs may be stored separately.
A fintech may rely on several third-party technology providers.
A payment transaction may therefore pass through a chain of systems even when the institution itself has a clear understanding of where its main database is located.
A September analysis by AAT Intelligence highlighted this distinction, describing localisation as a lifecycle issue involving data creation, persistence, computation, access, egress and retention rather than simply the physical location of a primary database.
That distinction is significant for compliance teams.
If a financial institution moves its principal database into Nigeria but continues to replicate payment information into an overseas disaster-recovery environment, for example, it would need to determine whether that arrangement is compatible with the CBN requirement.
Likewise, institutions need to understand how data is handled by fraud-detection tools, monitoring platforms, customer-service systems and external technology suppliers.
The technical audit therefore becomes an important part of the compliance exercise.
Cloud computing faces a new test
Cloud computing has transformed how Nigerian financial institutions build technology systems.
Instead of purchasing and operating every server themselves, institutions can use cloud infrastructure to obtain computing power, storage, networking and software services according to demand.
The model can provide flexibility and scalability, but it also makes data location more complicated.
A cloud application may have components distributed across multiple environments. Backups and disaster-recovery services can also be geographically separated.
For institutions now required to keep Nigerian payment transaction data within Nigeria, technology teams must understand precisely where relevant information is stored and processed.
BusinessDay reported that the localisation requirement was putting existing bank cloud strategies under scrutiny as financial institutions assess which workloads can be moved to domestic infrastructure.
Nairametrics reported that local data-centre operators were seeing increased discussions around colocation and cloud services from fintech platforms and core banking operators following the CBN directive.
This could increase demand for Nigerian cloud services.
It could also encourage technology providers to expand domestic infrastructure.
But greater demand could expose limitations if capacity, power and skilled personnel do not expand at a similar pace.
The specialised-skills question
One of the strongest concerns emerging from the latest industry discussions is human capacity.
Data-centre infrastructure can be expanded relatively quickly compared with the time required to develop highly specialised professionals.
Large financial institutions need engineers and architects who understand databases, cloud infrastructure, networking, cybersecurity, disaster recovery, encryption and high-availability systems.
The migration of payment workloads requires professionals capable of mapping existing architecture, identifying dependencies, testing new environments and ensuring that critical systems continue to operate during the transition.
The PUNCH reported that stakeholders at the Lagos roundtable identified shortages of specialised talent as one of the challenges that could complicate implementation.
This is an important distinction for Nigeria’s technology sector.
The localisation policy could create additional demand for Nigerian technology workers, but the demand must be matched by sufficient numbers of people with the particular skills required for financial infrastructure.
Training programmes can help over time, but banks and fintech companies have an immediate regulatory timetable.
That creates pressure to recruit experienced professionals, retrain existing technology teams and work with infrastructure and cybersecurity providers.
Fibre networks become critical infrastructure
Another issue receiving greater attention is the security and resilience of Nigeria’s fibre-optic infrastructure.
Data centres can have sophisticated security systems, backup power and redundant equipment, but financial services still depend on communications networks connecting data centres to banks, payment processors, telecommunications networks and customers.
If those links are damaged, disrupted or unavailable, the physical presence of data inside Nigeria does not by itself guarantee uninterrupted service.
At the September roundtable, technology executives raised concerns about the security of fibre infrastructure.
The PUNCH reported that stakeholders highlighted the possibility of fibre vandalism and other disruptions affecting the connectivity needed between data centres and financial institutions.
The Federal Government has classified telecommunications infrastructure as critical national infrastructure, according to comments reported at the event.
The discussion also referenced initiatives including Project BRIDGE, which is intended to expand national fibre connectivity, as well as satellite connectivity options.
For the financial sector, the quality of the network connecting two data centres can be almost as important as the computing equipment inside the facilities.
A highly available payment system needs multiple routes where possible, alternative connectivity providers and tested disaster-recovery arrangements.
Electricity remains central to the data-centre equation
Data centres are among the most electricity-intensive components of the digital economy.
Servers must operate continuously. Cooling systems must remove heat. Security and monitoring systems must remain active. Network equipment must continue running.
For a financial institution moving more workloads into Nigerian facilities, the reliability of the domestic power environment becomes a direct technology concern.
Industry participants have therefore linked data localisation to Nigeria’s wider electricity challenge.
Business Metrics reported comments from Coker that reliable power supply and additional data-centre capacity would remain important to meeting the CBN requirement.
The issue is not unique to Nigeria.
Globally, the growth of cloud computing and artificial intelligence has increased demand for electricity-intensive data-centre infrastructure.
For Nigeria, however, power reliability is particularly important because data-centre operators may need to combine grid electricity with other sources and backup systems to maintain continuous operation.
That increases operating costs.
The localisation requirement could therefore create additional demand for power infrastructure alongside data-centre investment.
Cybersecurity becomes more important, not less
Keeping payment information inside Nigeria does not automatically make it secure.
Localisation determines where data is stored and managed. It does not remove the possibility of cyberattacks, insider threats, credential theft, ransomware, software vulnerabilities or physical attacks on infrastructure.
Indeed, as more critical financial data becomes concentrated in domestic facilities, those facilities could become increasingly important targets.
This means localisation has to be accompanied by strong cybersecurity controls.
Banks and fintechs need secure network architecture, encryption, identity and access management, continuous monitoring, incident-response systems and tested backup arrangements.
They also need to ensure that employees and third-party service providers have only the access required to perform their responsibilities.
The challenge is particularly important because payment systems operate continuously.
A security incident can affect not only an individual institution but potentially customers, merchants and other parts of the payments ecosystem.
The debate over the six-month implementation period
While some stakeholders say Nigeria has enough physical capacity to support the policy, other industry voices have questioned the implementation timetable.
The Guardian reported on September 24 that technology, banking and cybersecurity professionals argued that the six-month transition period was too aggressive, citing infrastructure limitations, technical migration complexity and compliance costs.
A separate Guardian report on September 25 said industry participants had raised concerns about consultation and the clarity of some regulatory requirements, while expressing reservations about the January 2027 deadline.
These concerns represent industry views rather than evidence that the CBN has suspended or changed the deadline.
The CBN’s circular remains scheduled to take effect for the data-localisation requirement on January 1, 2027, according to the regulatory timeline recorded by Digital Policy Alert.
That leaves institutions with a relatively short period to complete assessments and migrations.
The practical question for technology teams is therefore no longer whether localisation is coming.
It is how each organisation will implement it while keeping financial services available.
What localisation could mean for Nigeria’s technology industry
The requirement could have effects beyond the banks and fintech companies directly covered by the regulation.
Local data-centre operators may see increased demand for colocation services.
Cloud providers operating domestic infrastructure may see opportunities to expand.
Network providers may receive additional demand for secure, redundant connectivity.
Cybersecurity companies may be required to provide more advanced monitoring and protection.
Technology consultants may be called upon to conduct architecture reviews and migration projects.
Training providers may see demand for courses in cloud architecture, cybersecurity, databases, data engineering and infrastructure management.
The policy could therefore create a larger domestic market around financial technology infrastructure.
Nairametrics reported that data-centre operators were already seeing greater interest from fintechs and core banking platforms following the directive.
But the economic impact will depend on how the market responds.
If demand grows faster than capacity, infrastructure prices could increase.
Smaller fintechs could face higher compliance costs than larger institutions.
Technology providers may also need to invest in additional facilities, power systems, network links and skilled staff before they can absorb new workloads.
Implications for smaller fintech companies
Large banks generally have established technology departments, significant budgets and existing relationships with infrastructure providers.
Smaller fintechs can face a different situation.
A company that has built its platform around overseas cloud infrastructure may need to redesign part of its architecture.
That can involve migration costs, engineering time, contractual changes and new security requirements.
The Business Times reported earlier in September that the localisation rule could increase cost pressure on smaller fintech operators and potentially contribute to consolidation pressures in the payments market. That is an industry analysis, rather than a confirmed CBN forecast.
For smaller companies, the important question will be whether local infrastructure providers can offer affordable services that meet the required technical and regulatory standards.
If domestic hosting becomes significantly more expensive than previous arrangements, some operators may have to reconsider their technology architecture or business models.
If competition among local infrastructure providers increases, however, prices and service offerings could evolve as the market responds.
Data sovereignty and the wider digital economy
The CBN policy is also part of a broader global conversation about data sovereignty.
Governments increasingly want greater control over strategically important information, particularly data connected to financial services, government systems, health and critical infrastructure.
Nigeria has its own data-protection framework, while financial regulators have specific responsibilities for the payments system.
The CBN’s localisation requirement places payment transaction data within a more explicitly domestic infrastructure framework.
The policy therefore has significance beyond server geography.
It raises questions about who controls financial information, which legal system governs its storage and processing, how regulators obtain access when necessary, and how resilient the domestic infrastructure is.
Legal and technology analysts have described the policy as part of a broader movement towards greater domestic control of financial data.
At the same time, data sovereignty depends on more than legislation.
A country needs reliable infrastructure, skilled personnel, cybersecurity capabilities and competitive technology providers if domestic data storage is to produce durable technological capacity.
What happens between now and January 1
With 95 days remaining until the deadline, financial institutions are entering the implementation stage.
The first step for many organisations is likely to be a detailed technology inventory.
That means identifying where payment transaction data is created, stored, copied, processed and backed up.
The next step is architecture assessment.
Technology teams must determine which workloads can be transferred directly, which require redesign and which depend on third-party systems.
Disaster-recovery arrangements require particular attention.
An institution that moves its primary environment into Nigeria must also determine how it will maintain service if the primary facility becomes unavailable.
Connectivity must be assessed at the same time.
Banks and payment operators need to know how their systems communicate with local data centres, telecommunications networks, payment processors and other critical infrastructure.
Cybersecurity testing will also be important.
Migration can create temporary vulnerabilities if systems are improperly configured or access controls are not reviewed.
Finally, organisations need documentation demonstrating how their systems meet the applicable regulatory requirement.
The next phase for Nigeria’s data-centre industry
The January deadline could become an important test of Nigeria’s digital infrastructure market.
If institutions successfully migrate payment data while maintaining reliable service, the policy could stimulate further investment in local data centres, cloud infrastructure, connectivity and technology skills.
If infrastructure constraints become significant, the transition could expose areas requiring additional investment.
Either way, the policy is likely to make data infrastructure more visible to the wider Nigerian economy.
For years, many consumers have interacted with digital financial services without thinking about where the underlying servers are located.
A bank transfer completed on a smartphone, a point-of-sale payment in a shop or a mobile-money transaction can appear instantaneous to the customer.
Behind each transaction are databases, networks, authentication systems, processors and security controls.
The CBN’s requirement is bringing that underlying infrastructure into sharper focus.
A technology transition with financial consequences
Nigeria’s digital payments industry has grown into an essential part of everyday economic activity.
The scale of electronic payments means that technology infrastructure is now closely connected to the functioning of businesses, consumers and financial institutions.
The CBN’s decision to require domestic storage and management of payment transaction data therefore represents a significant technology transition.
The immediate debate is about readiness.
Industry participants broadly agree that Nigeria has developed substantial data-centre infrastructure, but they differ on whether capacity, skills, connectivity, power and migration timelines are adequate for the January deadline.
The latest Lagos roundtable added a more nuanced assessment: physical data-centre capacity may be available, but successful implementation depends on the wider technology ecosystem.
That ecosystem includes engineers, cloud architects, cybersecurity professionals, data-centre operators, telecommunications companies, electricity providers and financial technology teams.
The coming months will test how effectively those parts of the system can work together.
For banks and fintech companies, the immediate task is compliance and continuity.
For technology providers, it is an opportunity to expand domestic infrastructure and services.
For policymakers, the challenge is ensuring that regulatory objectives are matched by infrastructure, clarity and effective oversight.
And for Nigeria’s digital economy, the outcome will provide a practical measure of whether the country can keep increasingly important financial technology infrastructure operating reliably within its own borders.
The January 1, 2027 deadline is therefore more than a data-storage date.
It is becoming a test of Nigeria’s ability to combine regulation, infrastructure, cybersecurity, technical skills and digital resilience as the country’s payments economy continues to expand.
Comments
Post a Comment