CBN, NITDA renew call for local storage of payment data as January 2027 deadline nears

The Central Bank of Nigeria (CBN) and the National Information Technology Development Agency (NITDA) have intensified their appeal to banks, fintech firms and payment service providers to store critical payment transaction data within the country before the January 1, 2027 compliance deadline.

Regulators said the requirement is essential for protecting Nigeria’s digital sovereignty, improving oversight of the financial system, safeguarding sensitive customer information and building greater resilience as digital payments and cloud services expand rapidly across the economy.

The renewed push came during the CBN-NITDA Executive Regulatory Dialogue on the National Sovereign Cloud Initiative and data localisation, held in Lagos on Wednesday.

In his keynote address, CBN Deputy Governor for Financial System Stability Lamido Yuguda described data as a strategic national asset. As financial services increasingly depend on digital payments, mobile money, fintech platforms and online banking, the location and security of transaction data have become critical.

While cloud computing offers efficiency, scalability and innovation, Yuguda cautioned that it also introduces risks around cybersecurity, operational resilience, third-party dependence and regulatory visibility.

He insisted that critical payment data must be stored and managed inside Nigeria by the January 2027 deadline. Local storage alone, he stressed, is not enough; institutions must maintain strong cybersecurity, business continuity, disaster recovery and risk-management frameworks.

Banks remain fully accountable for risks arising from their use of cloud providers and other technology partners.

The CBN said it would keep working with NITDA and other agencies to ensure financial-sector rules align with national digital infrastructure standards.

READ ALSO: CBN grants JPMorgan approval to establish Merchant Bank in Nigeria

Officials made clear that data localisation is not intended to stifle innovation or cut Nigeria off from global technology. Instead, it seeks to create the security and regulatory certainty needed to attract investment and support sustainable growth.

Hajiya Rakiya Shuaibu Mohammed, Director of the Information Technology Department at the CBN, told participants that the apex bank was working closely with industry players to achieve full compliance.

A recent CBN survey showed that more than half of the institutions that responded were already prepared to meet the localisation directive. The remaining firms, she noted, still needed clearer guidance and practical support to close the gaps.

“Our ultimate expectation is that by January 2027, everyone will be on board to have payment data localised,” Mohammed said. She explained that the policy would give regulators better visibility over transactions and strengthen the stability of the financial system. The dialogue, she added, was designed to address industry concerns, clarify expectations and identify the real obstacles facing banks, fintech companies and infrastructure providers.

Mohammed emphasised that the CBN preferred engagement and technical support over immediate sanctions for institutions making genuine efforts. However, she warned that deliberate attempts to undermine the policy or outright non-compliance would attract penalties. Feedback from stakeholders would be reviewed carefully, and justified adjustments would be considered on their merits.

She also revealed that a large share of the CBN’s own data is already hosted in Nigeria, while work continues to bring remaining secondary data onshore. In 2025, the bank further tightened supervision of the payments sector by creating the Payment Systems Supervision Department.

NITDA Director-General Kashifu Inuwa stressed that Nigeria’s growing reliance on digital infrastructure has turned control of critical technology and data into a national priority.

The National Sovereign Cloud Initiative, he said, aims to build domestic capacity so that essential digital services can continue even if external disruptions affect global technology providers.

The programme aligns with the Federal Government’s broader digital transformation agenda and the need to strengthen local technological capabilities.

As the deadline draws closer, regulators urged industry players to use platforms such as the Lagos dialogue to resolve outstanding questions on infrastructure readiness, implementation challenges, cybersecurity standards and the dangers of over-dependence on single technology vendors.