Reps Move to Tighten Data Sovereignty, Propose N1bn Fine for Banks, Fintechs

• Proposed legislation threatens 10-year jail term, N500m fine for unauthorised offshore data transfers; banks and payment firms face mandatory local data storage requirements

The House of Representatives is considering a proposed law that could significantly reshape Nigeria’s financial technology and digital payments landscape, introducing a minimum N500 million fine and up to 10 years’ imprisonment for unauthorised transfers of strategic payment transaction data outside the country.

The proposed legislation also seeks to impose a minimum N1 billion fine on banks, financial technology companies, payment service providers and other financial institutions that fail to maintain their primary payment data infrastructure within Nigeria.

Sponsored by Lanre Okunlola, representing Surulere II Federal Constituency of Lagos State, the bill seeks to establish the National Payment Data Protection and Sovereignty Commission as the principal authority responsible for protecting and regulating payment transaction data generated within Nigeria.

Titled A Bill for an Act to Establish the National Payment Data Protection and Sovereignty Commission, the proposed legislation is designed to strengthen Nigeria’s control over its financial information infrastructure, address cybersecurity threats and reduce dependence on offshore data storage and processing facilities

Introduced during a plenary session of the House last week, the bill is expected to come up for legislative debate in the coming weeks.

Under Section 23, any person who transfers strategic payment data outside Nigeria without regulatory authorisation would commit an offence and, upon conviction, face imprisonment for up to 10 years, a fine of not less than N500 million, or both.

Section 22 separately proposes a minimum N1 billion fine for institutions that fail to comply with the proposed data localisation requirements, alongside additional daily penalties for continuing violations.

A major provision of the bill is its proposed classification of all payment transaction data generated within Nigeria as a Strategic National Economic and Security Asset.

Section 9 requires such data to be stored within Nigeria, compelling banks, fintech companies, payment service providers, switching companies and settlement system operators to maintain their primary payment data infrastructure locally.

The proposed law also seeks to make domestic payment processing through infrastructure physically located in Nigeria the default requirement.

However, it recognises the need for international financial transactions and provides a framework for authorised cross-border data transfers.

Under Sections 18 and 19, transfers of strategic payment data outside Nigeria would require approval from the proposed commission, alongside the Central Bank of Nigeria, subject to specified conditions.

These include the necessity of the transfer for international settlement obligations, protection of national security interests and the existence of adequate data protection safeguards.

The bill further proposes classifying payment transaction infrastructure as Critical National Information Infrastructure, empowering the proposed commission to establish minimum cybersecurity and operational resilience standards.

If enacted, the legislation could have significant implications for financial institutions that rely on international cloud computing platforms, offshore data centres, global payment networks and cross-border technology service providers.

It could also introduce additional compliance, infrastructure and operational costs for businesses required to migrate or restructure their payment data systems.

The proposal comes amid growing concerns over data sovereignty, cybersecurity and the protection of sensitive financial information as Nigeria’s digital payments ecosystem expands.

ness.