CBN Says Banks Must Manage Risks From 3rd Party Tech Providers

As the January 1, 2027 deadline for data localisation compliance approaches, the Central Bank of Nigeria (CBN) has urged financial institutions to strengthen the management of risks associated with their growing reliance on cloud computing and third-party technology providers to protect financial system stability.

The Deputy Governor, Financial System Stability, CBN, Lamido Yuguda, stated this at the CBN-National Information Technology Development Agency (NITDA) Executive Regulatory Dialogue on the implementation of the National Sovereign Cloud Initiative (NSCI) and data localisation.

According to him, while cloud computing offers scalability, efficiency, flexibility and opportunities for innovation, its growing adoption raises concerns about cybersecurity, operational resilience, data protection and dependence on third-party providers.

“Cloud computing has become an important enabler of this transformation, offering scalability, efficiency, flexibility, and opportunities for innovation. However, increased reliance on cloud and digital infrastructure also brings important considerations around cybersecurity, operational resilience, data protection, third-party dependencies, and regulatory oversight” he said.

He also identified concentration risks as an issue requiring attention in implementing the National Sovereign Cloud Initiative, alongside infrastructure readiness and effective oversight of technology providers.

On data localisation, he said regulated institutions were expected to ensure that critical payment transaction data was stored and managed within Nigeria in accordance with applicable regulatory requirements and the January 1, 2027 implementation timeline.

He cautioned, however, that keeping data within the country would not automatically guarantee security. “Localisation alone does not guarantee security,” he said, stressing the need for robust cybersecurity, business continuity, disaster recovery and risk-management arrangements.

The deputy governor said the CBN would continue working with NITDA and other relevant stakeholders to align financial-sector requirements with national digital infrastructure standards.

He said the initiative should strengthen Nigeria’s digital resilience and domestic technological capacity without restricting innovation or isolating the country from global technological developments.

“The objective of the National Sovereign Cloud Initiative should not be to constrain innovation or isolate Nigeria from global technological developments. Rather, it should provide the security, resilience, and regulatory certainty necessary to support investment, innovation, and sustainable growth,” he said.

He called for a balanced and collaborative approach that would strengthen digital sovereignty while preserving global competitiveness and supporting financial stability.