Nigeria’s Payment Data Rule: Essential Risks Before the 2027 Deadline

Nigeria’s payment data rule is putting banks, fintech companies and payment service providers under pressure to prepare for a major change in how financial transaction records are stored and managed. The Central Bank of Nigeria (CBN) has set January 1, 2027, as the deadline for affected institutions to store and manage payment transaction data generated in Nigeria locally.

The directive, issued in June 2026, is part of efforts to strengthen regulatory oversight and encourage investment in domestic digital infrastructure. However, as the deadline approaches, questions remain about the readiness of financial institutions, the cost of migration and the ability to protect sensitive data without disrupting digital payment services.

What Does the CBN’s Payment Data Rule Require?

The CBN’s directive requires covered financial institutions and payment service providers to store and manage payment transaction data generated within Nigeria on local infrastructure by January 1, 2027.

The affected institutions include banks, mobile money operators, payment processors and other licensed participants in the payments industry. For organisations that currently depend on overseas infrastructure, meeting the requirement could involve changes to their databases, cloud arrangements, contracts and security systems.

The policy is intended to give Nigerian authorities greater oversight of financial transaction records and reduce dependence on infrastructure outside the country.

However, compliance involves more than moving information to a server located in Nigeria. Institutions must understand which records are covered, where copies and backups are stored, and how information moves through the systems that support payments.

Why Nigeria Wants Payment Data Stored Locally

The Central Bank’s position also reflects a wider interest in digital sovereignty: the ability of a country to exercise appropriate control over important data and the infrastructure supporting it.

Speaking at a forum on the directive in June, Dr Ayotunde Coker, chief executive officer of Open Access Data Centre, argued that local control of data could support Nigeria’s participation in the digital economy.

His comments highlight the economic argument behind the policy. However, keeping data locally does not automatically guarantee better security. Institutions must still invest in encryption, access controls, monitoring and effective recovery systems.

Cybersecurity Risks Banks and Fintechs Must Consider

In an interview with BusinessDay in July, Krishnan Ranganath, chief executive officer of UniCloud Africa, warned that institutions needed to consider the risks and implications of their migration decisions.

The distinction is important because financial institutions must demonstrate that their systems can continue operating under pressure, not simply confirm that they have established backup infrastructure.

For customers, the practical concern is whether transfers, payments and other services will remain reliable during the transition. A successful migration must protect financial information without creating avoidable interruptions.

Can Nigeria’s Digital Infrastructure Meet the Deadline?

Infrastructure readiness has become one of the main questions surrounding the January 2027 deadline.

In September, The Guardian reported concerns from industry representatives about the short implementation period, technical migration challenges and the need for clearer guidance from the regulator.

Blessing Ehize, chief technology officer of FCMB, raised concerns about uncertainty surrounding the implementation requirements. Speaking at a technology industry discussion, he said the guidance was unclear and called for a more structured roadmap. His comments reflected concerns that institutions could struggle to determine precisely how the directive should apply to different technical arrangements.

However, the industry does not speak with one voice. Some local data-centre operators have expressed confidence that Nigeria has the infrastructure needed to support the transition, provided institutions plan carefully and make appropriate use of available facilities.

This distinction matters. The challenge is not necessarily just the number of data centres available. Institutions must also consider capacity, connectivity, power supply, contracts, security requirements and the technical work needed to move live systems safely.

Smaller fintech companies may face different challenges from large commercial banks because their budgets, staffing and existing infrastructure arrangements vary.

CBN Maintains the January 2027 Deadline

The approaching deadline has increased pressure on affected institutions to finalise their migration plans. On October 9, The Guardian reported that the CBN had reiterated its position that the January 1, 2027 deadline remained unchanged.

Dr Rakiya Opemi Yusuf, director of the CBN’s Payments System Supervision Department, communicated the regulator’s position at the CloudReady Nigeria Financial Services Roundtable in Lagos. She was represented at the event by Assistant Director Babatunde Ajiboye.

Yusuf also emphasised that institutions must consider the entire data lifecycle, from the creation and processing of records to their storage and eventual disposal. The directive means that affected organisations need to audit their data, identify the systems and service providers involved, establish suitable local arrangements and test their infrastructure before the deadline.

The CBN’s position is clear, but institutions still need to translate the requirement into practical implementation plans that protect both customer information and the reliability of financial services.

What the Rule Could Mean for Nigeria’s Tech Industry

The policy could create opportunities for local providers of cloud services, data-centre facilities, cybersecurity solutions and technology consulting.

As banks and fintech companies review their arrangements, demand could increase for professionals who can manage cloud systems, protect sensitive information and oversee complex data migrations.

Local infrastructure providers could also benefit from additional demand. However, these opportunities will depend on their ability to provide reliable services at prices financial institutions can sustain. The transition may also increase costs for organisations that need to upgrade their systems, employ additional specialists or renegotiate technology contracts. Smaller providers may find these expenses particularly difficult to manage.

For Nigeria’s technology industry, the opportunity is to turn the directive into lasting improvements in digital infrastructure and technical capacity. That will require investment, clear implementation guidance and careful attention to security.

Conclusion

Nigeria’s payment data rule presents both an opportunity to strengthen local digital infrastructure and a challenge for institutions preparing to meet the January 2027 deadline. This will depend on whether banks and fintech companies can complete the transition securely, maintain reliable payment services and protect customer information throughout the process.

Follow Amebopreneur for the latest on Nigeria’s tech ecosystem, startup funding opportunities, and the cross-border partnerships shaping Africa’s innovation future.