Half of surveyed Nigerian payment firms have not started data localisation

Half of surveyed Nigerian payment firms have not started data localisation

29 October 2026: Twenty-two of 44 Nigerian financial institutions that answered a government survey have not begun work to keep their payment transaction data inside the country, two months before the Central Bank of Nigeria's 1 January 2027 deadline. The finding was presented in Lagos on 28 October at a dialogue run jointly by the central bank and the National Information Technology Development Agency (NITDA).

Not yet independently verified. We have still not read the Central Bank of Nigeria's circular or a CBN or NITDA page on the dialogue; the figures come from the state broadcaster and Nairametrics, which also disagree on which CBN official gave the keynote. We will update this when it can be confirmed, and remove this note.

What the survey found

NITDA surveyed banks, fintechs, payment service providers and cloud and data-centre operators between 13 and 27 October, collecting answers from 47 financial institutions and 42 infrastructure providers, though not every respondent answered every question. Of the 44 institutions that answered the readiness question, 26 said they had finished or expected to finish before the deadline, 15 said completion was unlikely or very unlikely, and three could not say.

The outstanding work, according to Muhammad Lawal of the NITDA director-general's office, is budgeting, contract negotiation and system migration. On the supply side, 79% of the infrastructure providers said they could take on new workloads from the financial sector. "The challenge extends beyond infrastructure availability to deployment, contracting and migration," Lawal said, as reported by Nairametrics.

NITDA describes the results as self-reported, anonymised and aggregated, and says they are not a compliance assessment. Respondents asked for closer coordination between the CBN, NITDA and the Nigeria Data Protection Commission.

The rule and the warning

The requirement, set in a CBN circular this year, is that payment transaction data generated in Nigeria be stored and managed in Nigeria by 1 January 2027. It covers banks, fintechs, mobile money operators and other payment service providers. Our earlier report on the circular sets out its scope.

At the dialogue the central bank stressed two points. Localisation alone "does not guarantee security", so firms still need cybersecurity, business continuity and disaster recovery arrangements. And institutions remain answerable for the risks of their cloud and other technology suppliers. Rakiya Yusuf, director of the CBN's Payments System Supervision Department, warned that deliberate non-compliance could attract sanctions, and said the bank would keep working with the industry on implementation problems.

Where this leaves vendors

NITDA's director-general, Kashifu Inuwa Abdullahi, tied the deadline to the National Sovereign Cloud Initiative and said Nigerian companies spend more than US$850 million a year on cloud services. For foreign SaaS and payments vendors serving Nigerian institutions, the practical question is whether their product can run with transaction data held in a Nigerian region or data centre, and whether the contracts and migration can be done in the eight weeks left. Firms that rely on a vendor's offshore processing will need a written plan from that vendor before January.

Our payment processing software category lists 14 products.

Sources

• Voice of Nigeria: NITDA, CBN intensify data localisation, 29 October 2026
• Nairametrics: CBN data localization rule: only 59% of banks, fintechs ready for January deadline, 29 October 2026