Follow Us on Google
Twenty-two of 44 financial institutions surveyed in Nigeria are yet to begin implementing measures to comply with data localisation requirements, with only nine weeks remaining before the January 1, 2027 deadline.
The findings, presented at the Executive Regulatory Dialogue on National Cybersecurity Infrastructure (NSCI) Implementation and Data Localisation in Lagos, exposed gaps between financial institutions’ planning and actual implementation, amid calls for clearer regulatory guidelines.
The dialogue was convened by the National Information Technology Development Agency (NITDA) and the Central Bank of Nigeria (CBN), bringing together regulators, financial sector executives, banks, fintech operators and technology service providers.
Presenting the survey findings, Dr Muhammad Aminu Lawal, Special Assistant on Digital Transformation to NITDA Director-General, Kashifu Inuwa Abdullahi, said institutions had made more progress in identifying affected data and systems than in committing funds, engaging local service providers and migrating workloads.
According to the survey, 26 institutions, representing 59 per cent of respondents, had completed the required actions or considered completion likely by the deadline. However, 15 institutions said they were unlikely or very unlikely to finish on time, while three could not assess their readiness.
The presentation, which classified 34 per cent of respondents as being at risk, showed that preparations remained incomplete despite the approaching deadline.
“Mapping is done; budgets, contracts and migration lag,” Lawal said.
The survey found that 70 per cent of institutions had identified the data and systems covered by the requirements, while 52 per cent had mapped their hosting arrangements and administration processes.
However, only 25 per cent had secured board or executive approval and funding for implementation. Just 23 per cent had contracted local service providers, while 18 per cent had commenced migration or remediation.
The findings point to a significant implementation gap, with institutions still needing to translate assessments and plans into funded projects, contractual arrangements and actual movement of systems.
Uncertainty over the scope of the requirements also emerged as a major obstacle. Sixty-four per cent of respondents sought clarification on what constitutes “payment transaction data”, while 38 per cent wanted a clearer definition of what it means for such data to be “stored and managed in Nigeria”.
The presentation also identified cross-border processing, international software-as-a-service platforms, vendor relationships and existing contracts as areas requiring further clarification.
Twenty-nine institutions indicated that their preparations depended on regulatory clarification, highlighting the importance of timely guidance as the deadline approaches.
While half of the institutions said they were proceeding on working assumptions pending clarification, 16 per cent reported that material implementation work was on hold. Another 34 per cent said their progress was not dependent on further clarification.
To accelerate implementation, institutions called on regulators to provide phased or risk-based compliance milestones, a clearly defined exceptions and approvals process, and written guidance addressing outstanding questions.
The survey also highlighted the need for coordination among the CBN, NITDA and the Nigeria Data Protection Commission to ensure that institutions have a clearer understanding of their obligations.
The presentation identified a definitive written explanation of the scope of payment transaction data and the meaning of local storage and management as immediate priorities, alongside clarity on transition arrangements and existing contracts.
The findings were based on self-reported, anonymised and aggregated responses collected between October 13 and 27, 2026. The presentation stressed that the results did not constitute a formal compliance assessment of individual institutions.
With the January 1, 2027 deadline approaching, the survey concluded that compliance remained achievable for a majority of respondents, but warned that regulatory clarity would be critical to helping institutions that had yet to move beyond planning.
The presentation summarised the situation as “within reach for about six in 10, not yet for the rest”, underscoring the urgency of resolving outstanding questions and accelerating implementation across the financial sector.
