Follow Us on Google
•Warn against deliberate breaches
By Faheem Lawal
The Central Bank of Nigeria (CBN) and the National Information Technology Development Agency (NITDA) have moved to allay concerns over the January 1, 2027 deadline for financial institutions to store critical payment data in Nigeria, assuring industry players that sanctions would not be the first option for enforcing compliance.
The two agencies gave the assurance at the Executive Regulatory Dialogue on the National Sovereign Cloud Initiative (NSCI) and Data Localisation Implementation, held in Lekki, Lagos, on Wednesday.
They, however, warned that deliberate breaches would not be tolerated.
The meeting brought together banks, fintech companies, data centre operators, infrastructure providers, system integrators and investors to clarify regulatory requirements and address concerns about implementation.
Speaking to journalists, the CBN Director of Payment Systems Supervision Department, Dr. Rakiya Yusuf, said the dialogue was organised in response to requests for clarification following the apex bank’s circular on data localisation.
She disclosed that a survey conducted ahead of the meeting showed that more than half of the financial institutions were prepared to meet the deadline, while others needed further guidance to complete their migration.
“It’s about our sovereignty, it’s about clarity, it’s about visibility over our production data, localisation was also tied to financial system stability, which is the CBN’s mandate,” she said.
On enforcement, Yusuf said regulators were working with institutions to achieve compliance, stressing that penalties would be considered where there was a deliberate attempt to disregard the rules.
“Everybody is hand-holding to be able to achieve the compliance with the regulation. However, where we see that there’s a deliberate attempt, of course sanctions will come,” she said.
Yusuf said the CBN’s Payment System Supervision Department, established in 2025, had strengthened its oversight capacity, with examiners trained and equipped to monitor compliance across the payments ecosystem.
She added that most of the CBN’s own data was already stored within Nigeria, while efforts were ongoing to localise the remaining secondary data held abroad. The bank, she said, was still analysing feedback from the industry and would consider requests for adjustments on their merits.
In his keynote address, the CBN Deputy Governor, Financial System Stability, Lamido Abubakar Yuguda, said data had become a critical national asset, with the resilience of the financial system increasingly dependent on the strength of the digital infrastructure supporting it.
He said regulated institutions were expected to store and manage critical payment transaction data within Nigeria by January 1, 2027, to protect sensitive financial information and improve regulators’ access to records needed for effective supervision.
However, Yuguda cautioned that keeping data within the country would not automatically guarantee its safety. He urged financial institutions and their technology providers to maintain strong cybersecurity systems, business continuity plans and disaster recovery arrangements.
“Responsibility for managing associated risks remains with the regulated institution,” he said, warning that banks and other regulated entities could not transfer responsibility for technology-related risks to cloud service providers.
The deputy governor also stressed that the NSCI should not restrict innovation or isolate Nigeria from global technological developments. Rather, he said, the initiative should provide the security, resilience and regulatory certainty needed to attract investment and support economic growth.
The Director-General of NITDA, Dr. Kashifu Inuwa, described data localisation as an issue of national economic security, financial stability and digital sovereignty, rather than merely a technical requirement.
He asked participants to consider the consequences of a major submarine cable disruption or geopolitical crisis cutting Nigerian banks off from digital infrastructure hosted abroad.
“Submarine cable disruption cannot automatically affect our payment system,” he said.
Inuwa said the CBN and NITDA were working to make the financial sector the first to comply with the sovereign cloud initiative, adding that the technology needed to support implementation already existed in Nigeria.
He said the country would work with global technology companies and hyperscalers to develop the required infrastructure, while ensuring that institutions were not tied to particular vendors or countries.
“We don’t want you to get locked into a technology, a vendor, a country or geopolitics,” he said.
Presenting the survey findings, NITDA Director-General on Policy, Dr. Aminu Lawal, said 89 organisations responded to the survey, comprising 47 financial institutions and 42 infrastructure and service providers.
He said 59 per cent of the 44 financial institutions that completed the relevant section expected to finish migrating their data by the deadline. Payment-focused operators and microfinance institutions were among those likely to face greater challenges, while most commercial banks were expected to comply.
On infrastructure readiness, Lawal said 33 of the 42 providers surveyed were prepared to host financial-sector data, while 74 per cent could onboard new customers in the sector within three months.
He added that 83 per cent offered Nigeria-only data hosting under contractual arrangements, while 79 per cent already held international certifications, including information security standards.
Providers were planning about seven megawatts of additional capacity, largely in 2027, with 14 per cent expected before January and 46 per cent between January and June 2027.
Lawal identified financing and the cost of capital as the biggest constraints to expanding local infrastructure. He said the scope of data covered by the directive was the leading concern, raised by 64 per cent of respondents, followed by questions about local capacity at 41 per cent.
Many institutions also sought face-to-face guidance, clearer approval procedures and better coordination among regulators, he added.
