CBN: 57% of Financial Institutions Ready for Data Localisation Deadline

***• Expects compliance with January 2027 deadline, warns of sanctions for deliberate non-compliance ***

•NITDA: 326 MDAs spent N3.8trn on technology in 3 Years

Nume Ekeghe

Central Bank of Nigeria (CBN) and National Information Technology Development Agency (NITDA) have disclosed that only 57 per cent of financial institutions are ready for the country’s data localisation requirements, but expressed optimism that the industry would meet the January 1, 2027 deadline.

The regulators gave the indication yesterday at the Executive Regulatory Dialogue on National Sovereign Cloud Initiative (NSCI) and Data Localisation Implementation in Lagos, where they engaged banks, fintechs, payment infrastructure providers, and other stakeholders on compliance expectations.

With less than three months to the deadline, the regulators said they were prioritising engagement and guidance to help institutions close gaps in their preparedness, warning, however, that deliberate non-compliance would attract sanctions.

CBN issued a circular on June 15, 2026, introducing requirements covering data localisation, market structure, ultimate beneficial ownership disclosure, and systemic oversight in Nigeria’s payments system.

Under the directive, regulated institutions were expected to ensure that critical payment transaction data generated in Nigeria were stored and managed locally, with compliance required from January 1, 2027.

Speaking at the dialogue, Director of the Payments System Supervision Department, CBN, Rakiya Yusuf, said the engagement was intended to clarify the requirements and help stakeholders prepare adequately for implementation.

Yusuf said a survey conducted ahead of the meeting showed that more than half of the industry was ready.

She expressed confidence that institutions yet to comply would make progress with further guidance.

Yusuf stated, “I am so glad that the survey that we also put forward to be able to generate some data has shown us that more than 50 per cent of the industry are ready to comply. So the remaining less than 40, I mean, less than 50, will also, with this clarity provided, be able to build on what they have.”

Yusuf said CBN was optimistic that the industry would meet the deadline, stressing that the policy is critical to national sovereignty, transaction visibility, and financial system stability.

She stated, “Ultimately, we are looking forward to that by January 2027, everyone will be on board to have the payments data localised because it’s about our sovereignty, it’s about clarity, it’s about visibility over our transaction data, and it’s about ensuring financial system stability, which is the mandate of the Central Bank of Nigeria.”

On enforcement, Yusuf said the regulator would initially focus on helping institutions understand and comply with the requirements rather than imposing penalties.

She said, “Sanctions will surely not be the first in our mind when it comes to enforcement. So, what is surely first in our mind is to ensure that everybody is hand-held.” She, however, warned that institutions deliberately frustrating the implementation would face consequences.

“However, where we see that there is a deliberate attempt to scuttle it, of course, sanctions will come,” Yusuf stated. “There will be sanctions for non-compliance,” she added.

Director-General of NITDA, Kashifu Inuwa Abdullahi, disclosed that 57 per cent of financial institutions were ready to comply with CBN’s data localisation requirements ahead of the January 1, 2027 deadline.

Abdullahi said the engagement was designed to assess preparedness and guide institutions yet to meet the requirements.

He stated, “The objective is to check, to find out. Based on our survey, 57 per cent of them are ready to comply and meet the deadline of 1st January 2027. Those who are not ready, we are here to provide guidance for them, to handhold them, to make sure we support them to comply with the guidelines.”

He explained that the financial sector was being prioritised because it was Nigeria’s most digitalised sector, adding that NITDA is working with the budget office to prepare ministries, departments and agencies (MDAs) for compliance.

Abdullahi disclosed that 326 MDAs spent more than N3.8 trillion on technology between June 2023 and October 2026, stating that some of the expenditure could be centralised through cloud services to improve efficiency and accelerate digital service delivery.

He said, “We’ve done our analysis from June 2023 to date. 326 MDAs spent over N3.8 trillion in technology. So based on that, we look at it. Most of this investment can be centralised and use cloud, which will make it easier and faster for MDAs also to deploy digital services.”

He added that the National Sovereign Cloud Initiative was designed to strengthen Nigeria’s control over critical digital infrastructure and reduce exposure to external disruptions. He linked the initiative to President Bola Tinubu’s executive order designating digital infrastructure as critical national infrastructure and the federal government’s Nigerian First Policy.

In his keynote address, CBN Deputy Governor, Financial System Stability, Lamido Yuguda, said the resilience of Nigeria’s financial system increasingly depended on the security and reliability of the digital infrastructure supporting it.

Yuguda said the rapid expansion of digital payments, fintech, mobile money, and digital banking had increased the financial sector’s dependence on technology, making cybersecurity, data protection, and operational resilience critical regulatory concerns.

“The resilience of our financial system increasingly depends on the resilience of the digital infrastructure that supports it,” Yuguda said.

He stressed, however, that data localisation must be accompanied by adequate security measures, warning that storing data within Nigeria would not automatically eliminate operational and cybersecurity risks.

He stated, “Localisation alone does not guarantee security. Financial institutions and their critical technology providers must maintain robust cybersecurity, business continuity, disaster recovery, and risk-management arrangements to ensure that critical financial services remain secure and available.”