Nigeria: banks and fintechs must host payments data inside the country from 1 January 2027, the central bank has directed

Nigeria: banks and fintechs must host payments data inside the country from 1 January 2027, the central bank has directed

30 September 2026: The Central Bank of Nigeria (CBN) has directed banks and fintech companies to make sure that payments data currently hosted outside Nigeria "is domiciled within the country from January 1, 2027", according to a report by Techeconomy on 30 September 2026. The directive was discussed at a panel at the first GrowthX by Techeconomy conference in Lagos. There, Blessing Ehize, chief technology officer of First City Monument Bank (FCMB), welcomed the policy's aim and asked for more implementation detail.

Where the directive comes from

According to an analysis by the Lagos law firm Pavestones, published on Legal500 on 6 July 2026, the requirement is part of a CBN circular of 15 June 2026 titled "Introduction of Market Structure Requirements, Data Localisation, Ultimate Beneficial Ownership Disclosure, and Systemic Oversight Measures in the Nigeria Payments System". It covers "payment transaction data generated through Nigeria's payments system", including payer and beneficiary details, transaction amounts, authentication records and settlement information, which must be held in Nigeria from 1 January 2027.

What the industry is asking for

Speaking for the sector, Mr Ehize said banks are "committed to supporting the objectives of the policy", but that clearer guidance would help them plan. The areas he named are:

• Hosting requirements: what counts as hosting in Nigeria.
• Categories of data: how specific categories of payments data are treated.
• Hybrid cloud: how environments that split workloads between local and foreign cloud regions are treated.
• A roadmap: a phased plan with milestones, so institutions can build structured transition plans.

Why it matters for technology buyers

Many Nigerian banks, payment service providers and fintechs run core payment systems, fraud engines, analytics or backups on international cloud regions or with foreign SaaS vendors. A localisation deadline changes the choice of suppliers:

• which cloud regions and data centres qualify;
• whether managed services and SaaS tools that store payments data abroad can still be used;
• what contracts with processors and outsourcers must say about where data sits.

Not yet independently verified. The CBN’s own circular has still not been read on the central bank’s website; its title, date and the data it covers come from a law firm’s analysis published on Legal500. The 1 January 2027 date is given by both sources. We will update this when it can be confirmed, and remove this note.

What to do

• Map where every category of payments data is stored and processed today, including backups, logs and analytics copies held by vendors.
• Ask cloud and SaaS suppliers whether they offer hosting in Nigeria and on what timetable.
• Watch the CBN's circulars page for the directive and any implementation guidance, and plan the migration so it is complete before 1 January 2027.

Related on TrustList:

• CMA proposes making Apple open iPhone NFC to UK wallets and apps
• Rwanda switches off 3G on 30 June 2027: USSD services, payment terminals, meters and trackers must move to 4G

Sources

• Techeconomy: FCMB CTO on the CBN payments data localisation directive (GrowthX by Techeconomy, Lagos) - 30 September 2026
• Legal500 (Pavestones): CBN’s data localisation directive, compliance considerations for payment system participants - 6 July 2026