In short: the Central Bank of Nigeria has said there will be no extension to its 1 January 2027 deadline for storing payment transaction data in Nigeria. A NITDA survey presented this week found that 26 of 44 responding financial institutions expect to be ready in time, 15 said they were unlikely to be, and 22 had not started. With two months left, the question for boards and their counsel is no longer whether, but how to evidence compliance.
What the CBN requires
The requirement comes from the CBN circular of 15 June 2026 on market structure, data localisation, beneficial ownership disclosure and systemic oversight in the Nigerian payments system. Banks, payment service providers, mobile money operators and other payment system participants must store and manage payment transaction data generated in Nigeria on infrastructure in Nigeria. As Pavestones Legal read the circular in July, primary systems, databases, backups and operational control are all in scope; a local copy of offshore data is not enough. The circular does not define “payment transaction data”, so most advisers are reading it widely.
No extension
At a stakeholder session in Lagos in early October, the CBN said: “The compliance date hasn’t changed. It’s 1st of January, 2027,” and urged firms that had not begun migration to start immediately. On 29 October, at a joint CBN and NITDA dialogue on the National Sovereign Cloud Initiative, NITDA presented its readiness survey. The results are self-reported, NITDA stressed, and are not a compliance assessment. 79% of the digital infrastructure providers surveyed said they could take on new financial-sector workloads.
How it sits with the Nigeria Data Protection Act
The circular adds to the Nigeria Data Protection Act 2023; it does not replace it. The Act governs personal data and its transfer abroad through recognised mechanisms. The CBN rule is a separate localisation duty for payment data, personal or not. Meeting one does not discharge the other.
What counsel should be advising now
- Map the data. Where payment data is created, processed, stored, backed up and administered, including offshore access to local systems.
- Read the vendor contracts. Cloud, card-processing, fraud and analytics agreements need data-location, access and audit terms that match the circular.
- Decide on keys and logs. Offshore encryption-key management and offshore audit logging are the points most likely to draw questions.
- Put the board on record. A minuted migration plan with owners and dates is the first thing an examiner will ask for.
- Keep the evidence. Architecture diagrams, test results and independent verification will matter more than a policy statement.
The CBN has not published a sanctions schedule for this requirement in the sources reviewed. Firms should not read that as leniency: the Bank has broad supervisory powers over payment licences.
Sources: Nairametrics, 29 October 2026; ThisDay, 8 October 2026; Pavestones Legal via Mondaq, 6 July 2026. This article is general information, not legal advice.
Leave a Reply