Half the financial institutions NITDA surveyed have not started moving payment data into Nigeria, with the 1 January 2027 deadline under eight weeks away. The Central Bank of Nigeria (CBN) says the date has not changed. Meanwhile, a new House bill would attach fines of at least ₦1 billion to the same requirement.
What the Nigeria Data Localisation Rule Requires
The CBN’s 15 June circular directs banks, fintechs, mobile money operators, switching companies and other payment participants to store and manage payment transaction data generated in Nigeria inside the country. Nairametrics reported that full compliance is due on 1 January 2027. The CBN has framed the rule around regulatory visibility, resilience and data sovereignty.
Rakiya Yusuf, the CBN’s director of payments system supervision, has said the compliance date has not changed, ThisDay reported. She said institutions must cover the full data lifecycle, from creation to disposal. The News Agency of Nigeria reported that the CBN will still hear institutions’ challenges.
The NITDA Survey: Readiness Gaps
NITDA’s survey puts numbers on the gap. Vanguard reported that 22 of the 44 institutions surveyed had not begun implementation. About 59% expect to finish on time, and 15 institutions say they are unlikely to.
The News Agency of Nigeria reported where firms are stuck. Seventy per cent have identified the relevant data and systems. Only 23% have engaged local service providers, and 25% have board approval.
Respondents also want clarity on the rule itself. Leadership reported that they are unsure what counts as payment transaction data and what storing and managing it in Nigeria actually means. Those are basic definitions, and institutions are being asked to build infrastructure before they have them.
The Bill That Goes Further
Lawmakers are not waiting for the deadline. A bill sponsored by Lanre Okunlola, who represents Surulere II in Lagos, would create a National Payment Data Protection and Sovereignty Commission. According to TheNigeriaLawyer, it would classify payment data generated in Nigeria as a strategic national asset and require primary payment data infrastructure to sit inside the country.
Section 22 sets a minimum fine of ₦1 billion for institutions that fail to comply, plus daily penalties for continuing violations. Section 23 proposes up to ten years in prison, a fine of at least ₦500 million, or both, for transferring payment data abroad without authorisation. The bill would also treat payment infrastructure as critical national information infrastructure.
It is a bill, not law. It reached plenary in late October and faces further legislative consideration. Institutions should plan around the CBN directive, which is binding, rather than the penalties, which are not.
Where the Risk Sits
Localisation moves risk instead of removing it. Local data centres still need strong security, and Nigeria’s banking sector is already in the middle of a cybersecurity crisis. Moving data home does not make it safer by default.
Cost is the other pressure. Smaller fintechs and microfinance banks may lack the capital for local hosting, and the survey shows that engaging local providers is the step most firms have yet to take. Larger banks will clear the bar more easily, which could tilt competition.
NITDA, which is also validating a framework to measure the digital economy, pitches the National Sovereign Cloud Initiative as somewhere for firms to go. Kashifu Inuwa Abdullahi described data centres as the refineries of the digital economy in Kano, Nairametrics reported. Nigeria is also building identity infrastructure under the NIMC Act 2026, so the state is positioning itself as owner of the core digital rails.
What to Watch Before 1 January
Three signals matter. First, whether the CBN publishes definitions of payment transaction data and clear transition milestones. Second, whether it offers an exceptions process for firms with existing contracts. Third, whether the Okunlola bill advances while institutions are still migrating. The Nigeria data localisation deadline is fixed for now, and half the sector has yet to start.
