CBN Rejects Extension of January 2027 Data-Storage Deadline, Putting Banks and Fintechs Under Pressure
By Simpson Global Media News Desk
The Central Bank of Nigeria (CBN) has ruled out an extension of its January 1, 2027 deadline requiring covered financial institutions and payment service providers to store and manage payment transaction data generated in Nigeria locally, increasing pressure on banks, fintech companies and other payment businesses to complete their compliance preparations.
The regulator reiterated its position at the CloudReady Nigeria Financial Services Roundtable in Lagos, where it urged affected institutions to accelerate their data migration plans and prepare for full compliance before the deadline.
Dr Rakiya Opemi Yusuf, Director of the CBN’s Payments System Supervision Department, communicated the regulator’s position in remarks delivered on her behalf by Assistant Director Babatunde Ajiboye.
“The compliance date hasn’t changed. It is 1 January 2027,” Yusuf said, according to a report published by Punch on October 12, 2026.
The requirement follows a CBN circular issued on June 15, 2026, directing covered institutions to keep payment transaction data generated within Nigeria on domestic infrastructure. The regulator’s latest clarification leaves affected organisations with limited time to assess their technology systems, review contracts with service providers, classify relevant information and complete the necessary migration and testing.
The policy is intended to strengthen domestic control over sensitive financial information and encourage investment in Nigeria’s cloud computing, data-centre and digital infrastructure sectors.
However, the transition could involve substantial technical and financial work. Institutions must address not only where databases are physically hosted but also the wider systems used to process transactions, maintain records and support payment operations.
Sources: Punch | The Guardian Nigeria | THISDAY
What the CBN Directive Requires
At the centre of the directive is a requirement for covered financial institutions and payment service providers to store and manage Nigerian payment transaction data locally.
Data localisation means keeping specified information within the country rather than relying on infrastructure located exclusively outside Nigeria. In the context of the CBN’s policy, the requirement extends beyond moving a database to a Nigerian data centre.
According to the regulator’s position reported by Punch, institutions must consider the full lifecycle of payment data, from its creation and processing to storage and eventual disposal.
That means organisations need to identify the systems that create, transmit, process and retain transaction information. They must also examine supporting records, including transaction logs, audit trails and metadata, as well as the technology arrangements underpinning payment services.
The practical implications will differ between organisations.
A large bank may operate several interconnected systems, use multiple technology vendors and maintain complex relationships with international cloud providers. A fintech company may depend on third-party platforms for payment processing, customer records, fraud detection or other services.
Both must establish which systems and data fall within the applicable requirements and determine how they will meet them.
Simply purchasing space at a local data centre may not be enough if relevant processing systems, records or supporting services remain outside the required arrangement.
Institutions therefore need a documented understanding of their technology architecture, contractual obligations and data flows.
They must also establish how compliance will be demonstrated and maintained after migration is complete.
The CBN has emphasised that institutions should not treat the deadline as a routine technical upgrade. The transition involves regulatory compliance, operational resilience and the protection of financial records.
Why the January 1 Deadline Matters
The deadline gives affected organisations a fixed date by which they must complete the necessary work.
For institutions that have already assessed their systems and begun migration, the remaining task may involve finishing the transition, resolving technical problems and verifying that their arrangements meet the requirements.
For organisations that have yet to begin, the timetable may be more demanding.
Data migration can involve identifying sensitive records, reviewing how information moves between systems, assessing infrastructure capacity, renegotiating vendor contracts and testing applications after changes have been made.
Large-scale payment systems must also remain dependable during the process. A poorly planned transition could introduce delays, data inconsistencies or interruptions to services relied upon by customers and businesses.
The CBN’s position makes clear that covered institutions should plan around the existing date rather than assume that additional time will be granted.
The directive was issued in June, giving institutions several months to prepare. But the amount of work required will depend on each organisation’s starting point, the complexity of its systems and its dependence on technology providers operating outside Nigeria.
The regulator’s insistence on the deadline also signals that data localisation is being treated as a substantive regulatory requirement rather than an optional technology project.
For bank executives, fintech founders and compliance officers, the immediate task is to determine the remaining work, assign responsibility and ensure that the transition can be completed without compromising payment services.
A Wider Shift Towards Digital Sovereignty
The CBN’s policy is part of a broader discussion about digital sovereignty: a country’s ability to exercise meaningful control over its digital infrastructure, sensitive information and technology-dependent services.
Financial transactions generate information that can reveal patterns of economic activity, business relationships and consumer behaviour. The institutions processing these transactions therefore have responsibilities to protect records and maintain reliable systems.
Keeping specified data within Nigeria may give domestic regulators clearer oversight and encourage greater investment in local infrastructure.
It may also support the development of Nigerian data centres, cloud services, cybersecurity businesses and specialist technology jobs.
The Guardian reported on October 9 that the CBN considers data localisation an important element of national economic security and digital sovereignty.
That position reflects a policy objective extending beyond the immediate location of stored information. The regulator is seeking to strengthen the domestic environment in which financial data is managed and processed.
Nevertheless, local storage alone does not guarantee security. Data held in Nigeria can still be exposed to cyberattacks, poor access controls, inadequate backups or weak operational procedures.
Effective protection requires strong cybersecurity, controlled access, reliable disaster recovery and continuous monitoring, regardless of where the infrastructure is located.
The policy’s longer-term value will therefore depend on whether local infrastructure can meet the reliability, security and performance requirements of the financial sector.
Banks Face Complex Migration Decisions
Commercial banks operate systems that support account management, transfers, card payments, mobile banking, fraud monitoring and other essential services.
These systems may be interconnected with domestic and international vendors, cloud platforms and financial networks. Changing where data is stored or processed can therefore affect more than one application or department.
Before migration, a bank needs to understand where relevant information is held, which systems depend on it and how data is exchanged between platforms.
It must then determine the infrastructure and contractual arrangements required to comply with the directive.
Testing is especially important. A system may appear to function normally during initial checks but encounter problems under heavy transaction volumes or when interacting with other applications.
Banks also need to preserve the accuracy and completeness of financial records. Transaction histories, audit trails and supporting information are essential for resolving disputes, detecting fraud and meeting applicable reporting obligations.
A migration that leaves gaps in records or produces inconsistencies could create operational and compliance problems even if the data is technically hosted within Nigeria.
The CBN has warned institutions to preserve service continuity and data integrity throughout the transition.
For banks, this means planning migration schedules carefully, maintaining appropriate backups and establishing procedures for identifying and correcting problems.
The transition may also require coordination among information technology teams, risk managers, compliance officers, legal departments and external service providers.
Senior management will need visibility into progress and unresolved risks rather than leaving the deadline entirely to technical teams.
Fintech Companies and Payment Providers Must Act
Fintech businesses have helped expand digital payments and financial services in Nigeria. Many depend on technology arrangements that allow them to process transactions and serve customers without maintaining every part of their infrastructure themselves.
That flexibility can support innovation, but it can also create compliance challenges when data and services are distributed across different providers and jurisdictions.
A payment company may use one provider for transaction processing, another for customer communications and a separate service for data storage or security monitoring.
The company must understand how those arrangements interact and which parts fall within the CBN’s requirements.
This may require reviewing contracts, identifying the location of relevant information and determining whether existing service providers can support the necessary domestic arrangements.
Where they cannot, businesses may need to negotiate changes or move to alternative providers.
Such decisions require careful evaluation. Switching providers can involve integration work, staff training, additional expenditure and operational risks.
Smaller fintech companies may face particular pressure if they have limited technical teams or financial resources.
However, the regulator’s latest clarification means affected businesses cannot safely plan on the assumption that the compliance date will be postponed.
They need to identify their obligations, seek appropriate technical and legal guidance and document the steps being taken to meet them.
The exact scope of obligations will depend on the applicable regulatory requirements and each institution’s activities. Businesses should therefore assess their own position rather than assume that every organisation faces identical technical arrangements.
Local Data Centres Could Gain New Business
The directive could create opportunities for Nigerian data-centre operators and cloud service providers.
If covered institutions must move specified information and related workloads to domestic infrastructure, demand may increase for secure storage, computing capacity, network connectivity, backup systems and technical support.
Data-centre businesses could benefit from new contracts as banks, fintech companies and payment providers assess their infrastructure needs.
Cloud service providers may also find opportunities to supply hosting, migration assistance, cybersecurity services and ongoing system management.
These opportunities could support investment in facilities, equipment and skilled personnel.
However, the extent of the benefit will depend on whether local providers can deliver the capacity and reliability required by financial institutions.
Banks and payment companies need infrastructure that can support large volumes of transactions, protect sensitive records and remain available during technical failures or emergencies.
They may also require strong connectivity between data centres and the networks used to deliver payment services.
Providers will need to demonstrate that their facilities and services are suitable for the needs of regulated financial businesses.
This could encourage competition among domestic infrastructure companies, but it may also expose gaps in available capacity or specialist expertise.
The directive does not automatically guarantee that all new demand will translate into profitable business for local providers. Institutions will evaluate service quality, costs, security, performance and contractual terms before committing to arrangements.
Even so, the policy provides a clear regulatory reason for covered businesses to examine domestic hosting options more closely.
Costs Could Rise Before Benefits Become Clear
Compliance is likely to require expenditure, although the amount will vary by institution.
Potential costs include local hosting capacity, migration specialists, software changes, cybersecurity improvements, additional network connections, backup infrastructure and independent verification.
Some institutions may already have sufficient domestic infrastructure for part of their operations. Others may need to make substantial changes to existing arrangements.
Contractual changes could also create costs if providers charge for migration, local hosting or revised service arrangements.
Organisations will need to compare those costs with the resources required to maintain existing systems while building or moving to compliant alternatives.
The financial impact may be particularly important for smaller providers operating on narrow margins.
Businesses could attempt to reduce costs through shared infrastructure or managed services, where those arrangements meet the applicable regulatory and security requirements.
However, cost reduction should not come at the expense of service reliability or the protection of customer information.
The policy’s longer-term economic effects will depend partly on whether investment in local infrastructure produces competitive services and reduces reliance on arrangements that do not meet Nigeria’s regulatory objectives.
It is too early to conclude that data localisation will automatically lower costs for banks or customers. The immediate transition could increase spending, while any later efficiency gains would depend on market conditions, infrastructure quality and how providers price their services.
The Risk of Service Disruptions
One of the most significant operational concerns is the possibility of disruption during migration.
Payment services are used for everyday activities, including transferring money, paying suppliers, receiving salaries and purchasing goods. Even temporary problems can affect households and businesses that depend on timely transactions.
A migration can introduce technical difficulties if systems are not adequately tested or if dependencies between applications are overlooked.
Data may also become inconsistent when information is transferred between platforms or when several systems continue operating during a transition.
To manage these risks, institutions should develop detailed migration plans, test changes before implementation and establish procedures for responding to failures.
They must also protect the integrity of historical records and ensure that the new arrangements can support normal transaction volumes.
The CBN has specifically highlighted the importance of preserving continuity and data integrity.
That emphasis indicates that meeting the location requirement is only one part of the challenge. Institutions must also ensure that their services remain dependable and their records accurate.
Customers should not assume that disruption is inevitable, but financial institutions need to prepare for technical risks rather than treating migration as a simple transfer of files.
The quality of planning and testing will be important in determining whether the transition can be completed smoothly.
Cybersecurity Must Remain a Priority
Moving information to domestic infrastructure does not remove the need for robust cybersecurity.
Financial institutions remain exposed to threats such as phishing, credential theft, malicious software, unauthorised access and attacks on the systems supporting payment services.
Data localisation must therefore be accompanied by effective security controls.
These may include strong identity verification, access restrictions, encryption where appropriate, continuous monitoring, vulnerability management and reliable backup arrangements.
Institutions also need procedures for detecting suspicious activity and responding to incidents.
Where external service providers remain involved, responsibilities for security and incident reporting should be clearly defined.
The location of infrastructure is one element of a broader risk-management framework. The quality of security depends on how systems are configured, maintained and monitored, as well as how people use them.
Banks and fintech companies should also consider whether staff and contractors have access only to the information necessary for their responsibilities.
Independent assessments can help identify weaknesses that internal teams may overlook.
As institutions prepare for the deadline, they will need to ensure that migration does not introduce new vulnerabilities or weaken existing safeguards.
The regulator’s objective of strengthening control over financial information will be better served if domestic hosting arrangements are accompanied by strong operational and cybersecurity practices.
Experts Have Raised Questions About the Timetable
The policy has also prompted concerns about the time available for implementation.
The Guardian reported on September 24 that industry experts and cybersecurity analysts had questioned whether the six-month timetable was feasible for all affected organisations.
Concerns cited in that report included infrastructure constraints, the complexity of technical migration, compliance costs and the need for greater engagement between the regulator and industry participants.
Those concerns highlight the differences between institutions. A company with an established domestic data environment may face a different challenge from one whose systems rely heavily on overseas platforms.
Large organisations may have the resources to run parallel systems during migration, while smaller firms may have less capacity to manage complex changes.
The CBN’s latest position, however, is that the deadline remains unchanged.
That leaves institutions needing to manage both compliance requirements and the practical challenges of implementation.
Businesses can reduce uncertainty by obtaining clear guidance, documenting the scope of their obligations and engaging technology providers early.
Where technical dependencies or infrastructure gaps remain, those issues need to be identified as soon as possible rather than discovered near the deadline.
The debate is therefore not only about whether the policy’s objectives are desirable, but also about how institutions can implement the requirements while protecting customers and maintaining reliable services.
What Financial Institutions Should Do Now
With the deadline approaching, affected institutions need a structured implementation plan.
The first step is to establish what information is covered and where it currently resides. That requires an inventory of relevant systems, data flows, third-party services and contractual arrangements.
The next step is to assess whether existing domestic infrastructure can meet the applicable requirements. Where gaps exist, institutions need to identify suitable providers, agree on service arrangements and determine how the migration will be carried out.
Testing should be built into the timetable. Organisations need to confirm that systems function properly after migration and that transaction records remain accurate and complete.
They should also maintain clear documentation of decisions, implementation progress and verification results.
Compliance should not be treated as the responsibility of one technical department alone. Senior management, compliance teams, risk officers and legal advisers may all need to contribute, depending on the institution’s structure and obligations.
Institutions should also prepare contingency plans to address potential service interruptions or data inconsistencies.
The objective is to complete the transition without compromising the reliability of financial services or the protection of customer information.
Implications for Customers and Businesses
For ordinary customers, the policy is primarily a regulatory and infrastructure development. Its immediate purpose is not to require individuals to move their personal data or take action independently.
The institutions covered by the directive are responsible for determining and implementing the necessary changes.
Customers may nevertheless be affected indirectly if a provider experiences operational problems during migration or if businesses change the technology arrangements supporting their services.
For companies that rely on digital payments, dependable service is essential to managing sales, paying employees and settling obligations.
Small businesses may be particularly sensitive to interruptions that delay incoming payments or prevent them from completing transactions.
Financial institutions should therefore communicate appropriately with customers if changes affect service availability, while taking steps to minimise disruption.
Over time, a well-implemented policy could support stronger domestic infrastructure and regulatory oversight. But the actual benefits will depend on the quality of implementation and the resilience of the services delivered.
Customers should continue to follow official communications from their banks and payment providers rather than rely on speculation about the deadline.
What Happens Next?
The immediate focus will be on how covered institutions respond to the CBN’s renewed insistence on January 1, 2027.
Banks, fintech companies and payment service providers will need to complete their assessments, finalise infrastructure arrangements, migrate relevant information and verify compliance within the available period.
Local data-centre and cloud-service providers may receive increased interest from businesses seeking domestic capacity, although individual contracts and investment decisions remain matters for the institutions involved.
The transition will also test whether Nigeria’s digital infrastructure can support the requirements of a highly connected financial sector without compromising reliability, security or customer service.
The CBN has made its position clear: the compliance date has not changed. The next stage will be implementation, with institutions expected to demonstrate that their arrangements meet the applicable requirements.
For Nigeria’s financial sector, the issue is now how to achieve local data control while keeping digital payments secure, accurate and dependable.
Sources and further reading
Comments
Post a Comment