CBN Enforces January 2027 Deadline for Payment Data Localisation, Puts Financial Institutions on Compliance Notice

• CBN Begins Data Migration, Insists on January 2027 Deadline

The Central Bank of Nigeria (CBN) has reaffirmed January 1, 2027, as the deadline for financial institutions and fintech companies to migrate payment transaction data generated in Nigeria to local hosting infrastructure, insisting that the date will not be extended.

The directive, contained in a circular dated June 15, 2026, is aimed at strengthening data sovereignty and ensuring that payment transaction data generated within the country is hosted and managed locally.

Speaking at the CloudReady Nigeria Financial Services Roundtable in Lagos, Babatunde Ajiboye, Assistant Director in the CBN’s Payments Systems Supervision Department, said the regulator had commenced migrating sensitive payment transaction data hosted by external partners outside Nigeria.

According to him, the requirement applies to the CBN as well as the financial institutions it supervises, underscoring the regulator’s commitment to implementing the policy.

Ajiboye acknowledged that the migration could present technical and operational challenges but maintained that these would not automatically justify an extension. He added that the CBN would begin reviewing compliance from January 1, 2027.

The directive requires affected institutions to consider the entire data lifecycle, including data creation, processing, storage and eventual disposal. Consequently, compliance is expected to involve more than transferring information to a local data centre.

Financial institutions will need to assess their existing technology infrastructure, cloud arrangements, outsourcing agreements and third-party service providers to determine whether their operations meet the applicable requirements.

They must also consider cybersecurity, data integrity, access management, disaster recovery and business continuity as part of their migration plans.

Industry participants at the roundtable highlighted the importance of reliable local infrastructure in supporting the transition.

Lynda Saint-Nwafor, Chief Enterprise Business Officer at MTN Nigeria, said the company had the infrastructure and local engineering expertise to manage substantial data workloads.

Ayotunde Coker, Chief Executive Officer of Open Access Data Centres, highlighted the company’s infrastructure capabilities and Payment Card Industry Data Security Standard certification.

Representatives of Nobus Cloud and Layer3 also discussed investments in locally developed cloud platforms, engineering capacity and cybersecurity services.

Temitope Osunrinde, Executive Director of Africa Hyperscalers, said successful implementation would require clear guidance, appropriate data classification, resilient infrastructure, trusted providers and coordinated regulatory engagement.

For compliance officers and risk managers, the deadline places greater emphasis on regulatory readiness, third-party oversight and demonstrable implementation.

Institutions will need to identify affected data, establish appropriate local hosting arrangements, assess service providers and document progress towards compliance. Migration testing should also address data integrity, security, service availability and recovery arrangements.

With the deadline approaching, financial institutions and fintech operators face mounting pressure to resolve outstanding technical, contractual and governance issues.

The CBN’s position signals that data localisation should be treated as a regulatory compliance priority, supported by effective management oversight and verifiable controls.

Affected institutions should review the original circular and applicable regulatory guidance to confirm the precise obligations relevant to their operations.