Despite pleas by banks, fintechs and payment service providers to the Central Bank of Nigeria (CBN) to grant them extension on the completion of their data storage migration plans timeline, the apex bank has ruled out an extension of the 1 January 2027, deadline for them to store and manage payment transaction data generated in their operations locally in the country.
The CBN stated that the operators and financial services providers’ compliance must cover the full lifecycle of payment data, from its creation and processing to storage and eventual disposal, as it continues to rev up its monetary reforms on sensitive financial information and expand the domestic cloud and data centre market.
The Director of the CBN’s Payments System Supervision Department, Dr Rakiya Yusuf, made this disclosure at the CloudReady Nigeria Financial Services Roundtable, hosted by Africa Hyperscalers Company in partnership with 100 Women in Digital Infra, Open Access Data Centres, Layer3, Nobus Cloud Services and the National Information Technology Development Agency (NITDA) in Lagos.
The banker, in her remarks delivered at the forum by Assistant Director, Payments Systems Supervision Division of the apex bank, Mr. Babatunde Ajiboye, maintained that the compliance date had not changed and remained 1 January 2027.
- Advertisement -
According to her, for compliance, the affected institutions must examine more than the physical location of their databases but should broaden their compliance plans to cover transaction logs, audit trails, metadata and the systems supporting payment operations.
Yusuf stressed: “The practical sequence is to audit and classify the data, agree on the local architecture and contracts, then migrate, test, and independently verify completion.”
The Director also cautioned the affected institutions on the need to preserve service continuity and data integrity throughout the transition, adding that any migration that meets the location requirement but disrupts payment services or compromises records will not adequately address the operational risks involved.
The directive provided that for cross-border transactions, financial institutions must ensure that records covered by the Nigerian requirement remain compliant while accounting for the needs of foreign counterparties, while institutions experiencing difficulties are expected to demonstrate the progress they have made, identify outstanding gaps and present credible plans for addressing them.
The apex bank urged financial institutions to review their agreements with cloud and technology providers to establish where data is stored, how it is processed and backed up, and whether existing arrangements can meet the new requirements.
Speaking at the event, Executive Director of Africa Hyperscalers, Temitope Osunrinde, maintained that Nigeria had taken important steps towards greater control over its digital infrastructure through the National Cloud Policy, the National Sovereign Cloud Policy, the Nigeria Data Protection Act, and the CBN’s data-localisation requirements.
The techno expert explained that the challenge was no longer simply establishing the policy direction but determining how institutions could implement it successfully.
To ensure this, he said that would require clearer guidance on data and workload classification, resilient infrastructure, trusted service providers and coordination among regulators and industry participants,
According to him, the roundtable was intended to bring regulators, financial institutions and infrastructure providers together to discuss the practical requirements of compliance, including data residency, cybersecurity, cross-border transfers, business continuity and disaster recovery.
The discussions at the forum highlighted the potential economic implications of the policy as participants noted that more demand for locally hosted workloads could create opportunities for Nigerian cloud providers, data centre operators, cybersecurity companies and technology professionals.
However, they agreed that exploring the opportunity would depend on how providers were able to demonstrate the security, reliability and capacity required by theirl institutions.
It would be recalled that the CBN sets the requirement in a circular issued on 15 June 2026, which directed PSPs and other covered institutions to store and manage payment transaction data generated within the country.
The migration deadline set by the CBN for the institutions represented part of a broader discourse about Nigeria’s push to strengthen digital sovereignty and develop local infrastructure capable of supporting sensitive financial workloads.
By now, affected institutions are having limited time to assess their systems, review contracts with technology providers, and complete the migration of relevant data.
