Why CBN Wants Nigeria’s Payment Data Kept Within Its Borders

Almost every adult Nigerian passes through the Nigeira digital payment system everyday. Either as a user, transferring funds to another person or as a receiver of funds. In the formal business environment, among artisans as well as market men and women, digital financial transactions have become part of the daily life. A life that has been transformed by the innovation in the nigeiran financial system.

This is evident in the data by the Nigeria Inter-Bank Settlement System (NIBSS) which showed that electronic transactions in the three months of this year rose to N1.05 quadrillion moved in over 12 billion transactions.

However as Nigeria’s financial system becomes increasingly dependent on digital platforms, the growing volume of payment transactions processed through technology infrastructure hosted outside the country is raising concerns about data security, regulatory oversight and the ability of the economy to withstand external disruptions.

From electronic transfers and card payments to mobile money and other digital financial services, the country’s payment ecosystem has expanded significantly, making the availability and security of transaction information critical to financial system stability.

But beyond the convenience of digital transactions lies a growing question: how much control does Nigeria have over the data generated by its financial activities, and what happens if the foreign infrastructure on which these services depend becomes inaccessible?

This concern is at the centre of the Central Bank of Nigeria’s (CBN) directive requiring financial institutions and other participants in the payments ecosystem to store and manage payment transaction data generated within Nigeria locally, effective January 1, 2027.

The policy, which seeks to strengthen Nigeria’s control over its financial data, is also intended to ensure that the country’s payment system remains accessible to regulators and resilient against disruptions arising from technological failures, geopolitical tensions or other external developments.

For the CBN, the importance of keeping payment data within the country goes beyond where transaction information is stored. It is about ensuring that the regulator can access critical information whenever necessary to monitor transactions, investigate irregularities and discharge its responsibility of maintaining financial system stability.

Speaking at a stakeholder engagement on the implementation of the directive, the Director, Payment System Supervision Department of the CBN, Dr Rakiya Yusuf, said the policy was necessary to preserve the regulator’s access to transaction records in an increasingly digital financial environment.

She explained that before the widespread adoption of digital banking, transaction records, including nominal ledgers, cash flows and vouchers, were kept within bank branches, where CBN supervisors and examiners could access them during regulatory examinations.

However, as financial institutions migrated to digital platforms, the regulator’s responsibility remained unchanged, requiring a similar level of access to electronically generated transaction records.

According to Yusuf, the directive is intended to ensure that payment data remains within Nigeria from the point of creation until its eventual destruction in line with applicable archival policies. The significance of this requirement is particularly evident in the treatment of domestic and cross-border transactions.

Yusuf clarified that the CBN was not seeking to prevent foreign financial institutions from retaining information about transactions involving customers within their jurisdictions. Rather, the regulator wants complete information relating to the Nigerian end of such transactions to remain accessible locally.

“It is the Central Bank’s responsibility to ensure financial system stability has not changed. The way they do it is to have unfettered access to it. From the creation of that data to the destruction of that data is a cycle. It is a whole life cycle. So, we are saying that the data should reside in the country to be accessed when we need it throughout its life cycle.” Yusuf explained.

She stressed that the CBN needed to know the identity of the person making a payment, the value of the transaction and whether it was successful. “But within Nigeria, where the data is generated, we want to know who paid, what was paid, and whether it was successful,” she said.

She added that customer identification details, transaction information and the channels through which payments were made must remain within the country throughout the data life cycle.

The policy also speaks to a broader national concern about Nigeria’s dependence on foreign digital infrastructure and the potential consequences when access to such infrastructure is disrupted.

This was highlighted by the Director General of the National Information Technology Development Agency (NITDA), Kashifu Abdullahi, who argued that the growing digitalisation of the economy makes control over critical technology infrastructure an issue of national economic security.

He questioned Nigeria’s ability to sustain essential financial services if a major disruption affected the international infrastructure on which some of its financial institutions depend. “I want you to imagine what will happen to our economy if, tomorrow, a major submarine cable disruption or geopolitical crisis prevents our banks from accessing critical digital infrastructure hosted outside our country.

“Can our citizens still transfer money? Can businesses still receive payments? Can our banks keep processing transactions? Can our economy continue functioning?” he questioned.

His concerns emphasize the risks associated with relying heavily on infrastructure outside the country’s control. A disruption affecting access to such infrastructure could potentially affect the ability of financial institutions to provide essential digital services.

For an economy where businesses and individuals increasingly depend on electronic payments, any interruption to the payment system could have wider implications for commercial activities and financial transactions.

Abdullahi said the objective of the National Sovereign Cloud Initiative was to build Nigeria’s capacity for digital self-determination, ensuring that external disruptions do not prevent citizens from accessing essential digital services.

He explained that digital sovereignty was not about isolating Nigeria from international technology providers or attempting to build every component of its digital infrastructure locally.

“Digital sovereignty is not about politics. It is not about isolation, and it is not about building everything ourselves. It is about building our digital capacity to compete in the world we are in today,” he said

According to him, the initiative is also designed to give Nigeria greater independence in choosing the technology, infrastructure and standards supporting its digital economy, without becoming locked into a particular vendor, country or geopolitical arrangement.

This is particularly important as the financial sector increasingly relies on telecommunications companies, data centre operators, cloud service providers and other technology infrastructure providers to deliver digital services.

Abdullahi said NITDA was working with the CBN to ensure that financial institutions could meet the localisation requirement, adding that the country’s technology ecosystem had the capacity to support the transition.

He also noted that the government would work with global technology providers and hyperscalers, while adopting existing international certifications that meet Nigeria’s sovereign infrastructure requirements.

The CBN’s June 15, 2026 circular provides the regulatory foundation for the policy. Titled ‘Introduction of Market Structure Requirements, Data Localisation, Ultimate Beneficial Ownership Disclosure, and Systemic Oversight Measures in the Nigeria Payments System’, it was issued to deposit money banks, microfinance banks, mobile money operators, switching and processing companies, payment terminal service providers, payment solution service providers, super agents and other licensed operators.

The apex bank said the rapid growth of electronic payments and digital financial services had brought concerns about operational dependence, market concentration, systemic importance and the localisation of critical payment data.

It therefore directed all financial institutions and participants facilitating payments within Nigeria to ensure that payment transaction data generated locally are stored and managed in Nigeria in accordance with applicable data protection laws and regulations.

Beyond safeguarding data and strengthening regulatory access, the initiative is expected to provide a foundation for greater resilience within the country’s digital financial infrastructure.

However, achieving this objective will require significant coordination among financial institutions, fintech operators, data centre providers and technology companies, particularly those whose existing infrastructure and operating arrangements involve foreign jurisdictions.

Recognising the need to prepare the industry, the CBN has intensified engagements with stakeholders to clarify the requirements and address implementation concerns ahead of the deadline.

Yusuf disclosed that a survey conducted by the apex bank showed that more than 50 per cent of industry operators were ready to comply, expressing optimism that further engagements would help the remaining institutions bridge their readiness gaps.

Yusuf said the regulator was prioritising support and guidance to ensure that operators understood the requirements and had sufficient time to prepare. “Sanction is surely not the first in our mind when it comes to enforcement.

So what is really first in our mind is to ensure that everybody is handheld,” she said.

She, however, warned that deliberate non-compliance would attract sanctions. “When we see that there is a deliberate attempt to scrutinise, of course, sanction will come. There will be sanction for non-compliance,” she added.