The Central Bank of Nigeria has ruled out an extension of the 1 January 2027, deadline for financial institutions to store and manage payment transaction data generated in Nigeria locally, putting pressure on banks, fintechs and payment service providers to complete their migration plans.
The disclosure was made at the CloudReady Nigeria Financial Services Roundtable, hosted in Lagos by Africa Hyperscalers Company in partnership with 100 Women in Digital Infra, Open Access Data Centres, Layer3, Nobus Cloud Services and the National Information Technology Development Agency..
Director of the CBN’s Payments System Supervision Department, Dr Rakiya Yusuf, reiterated the position in remarks delivered on her behalf by Assistant Director Babatunde Ajiboye at the CloudReady Nigeria Financial Services Roundtable organised by Africa Hyperscalers in Lagos. Yusuf was represented by Ajiboye, Payments Systems Supervision Division, CBN.
“The compliance date hasn’t changed. It is 1 January 2027,” Yusuf said.
The requirement was set out in a circular issued on 15 June 2026, directing payment service providers and other covered institutions to store and manage payment transaction data generated within Nigeria in the country. The deadline leaves affected institutions with limited time to assess their systems, review contracts with technology providers, and complete the migration of relevant data.
Yusuf said institutions must examine more than the physical location of their databases. Their compliance work should cover transaction logs, audit trails, metadata and the systems supporting payment operations.
“The practical sequence is to audit and classify the data, agree on the local architecture and contracts, then migrate, test, and independently verify completion,” she stated.
She also warned that institutions must preserve service continuity and data integrity throughout the transition. A migration that meets the location requirement but disrupts payment services or compromises records would not adequately address the operational risks involved.
For cross-border transactions, financial institutions must ensure that records covered by the Nigerian requirement remain compliant while accounting for the needs of foreign counterparties. Institutions experiencing difficulties are expected to demonstrate the progress they have made, identify outstanding gaps and present credible plans for addressing them.
The CBN also urged financial institutions to review their agreements with cloud and technology providers to establish where data is stored, how it is processed and backed up, and whether existing arrangements can meet the new requirements.
The deadline formed part of a wider discussion about Nigeria’s push to strengthen digital sovereignty and develop local infrastructure capable of supporting sensitive financial workloads.
Executive Director of Africa Hyperscalers, Temitope Osunrinde, noted that Nigeria had taken important steps towards greater control over its digital infrastructure through the National Cloud Policy, the National Sovereign Cloud Policy, the Nigeria Data Protection Act, and the CBN’s data-localisation requirements.
He said the challenge was no longer simply establishing the policy direction but determining how institutions could implement it successfully.
That would require clearer guidance on data and workload classification, resilient infrastructure, trusted service providers and coordination among regulators and industry participants, Osunrinde said.
The roundtable was intended to bring regulators, financial institutions and infrastructure providers together to discuss the practical requirements of compliance, including data residency, cybersecurity, cross-border transfers, business continuity and disaster recovery.
The discussions also highlighted the potential economic implications of the policy. More demand for locally hosted workloads could create opportunities for Nigerian cloud providers, data centre operators, cybersecurity companies and technology professionals. However, that opportunity depends on providers being able to demonstrate the security, reliability and capacity required by financial institutions.
The Chief Operating Officer of Nobus Cloud, Stephen Okoye, declared that locally developed cloud technology could support financial institutions seeking to move workloads into Nigeria while retaining the technical controls required for regulated operations.
He highlighted the role of Nigerian engineers in developing local cloud services and discussed the provider’s infrastructure, including its two availability zones. Okoye also cited the company’s compliance and assurance credentials, including ISO standards, Payment Card Industry Data Security Standard requirements, and the Nigeria Data Protection Act.
He said Nobus Cloud offered support to organisations migrating their systems, a process that can involve more than transferring information from one server to another. Institutions may need to review application dependencies, security configurations, connectivity and recovery arrangements before moving critical workloads.
Okoye also pointed to the company’s claimed 100 per cent uptime as an indication of its service reliability. For financial institutions, however, providers’ assurances must be assessed alongside their technical evidence, resilience arrangements and ability to maintain services during an outage or other disruption.
The transition is likely to require institutions to weigh local hosting options against their existing technology arrangements, particularly where applications rely on services and tools provided by international cloud platforms.
The Chief Executive Officer of Open Access Data Centres, Dr Ayotunde Coker, said readiness for the transition would depend on the complexity and requirements of each financial institution’s workloads.
He urged institutions to assess their needs and risks before deciding what to migrate, rather than treating localisation as a straightforward relocation exercise. Financial operators need to understand the demands of their applications, the infrastructure available to support them, and the regulatory requirements that apply to their data.
Coker also highlighted the importance of local data centres, connectivity and reliable power in building a stronger digital infrastructure ecosystem. Investment in these areas will be important as demand for cloud computing and more advanced digital services, including artificial intelligence, grows.
The discussion underscored that the availability of local data centre space is only one part of readiness. Financial institutions must also consider connectivity between systems, redundancy, disaster recovery and the capacity to keep critical services running if infrastructure fails.
For institutions with applications designed around overseas cloud platforms, migration may require architectural changes and testing to ensure that systems continue to perform as expected. The process can also affect costs, depending on the complexity of the workload and the changes required.
The Nigerian Data Protection Commission also emphasised the need to protect personal data and manage the risks associated with cloud service providers.
National Commissioner and Chief Executive Officer of the commission, Dr Vincent Olatunji, was represented at the event by Ibukunoluwa Owa. The commission’s contribution focused on the responsibilities of organisations that determine how personal data is processed and those that process it on their behalf.
Owa highlighted the need for data protection impact assessments, third-party risk assessments and appropriate data processing agreements. Institutions must understand the responsibilities of their service providers and ensure that their arrangements comply with applicable data protection requirements.
The commission’s guidance also covered breach reporting, transparent privacy policies and the need for organisations to explain how they will protect customers’ information.
Owa stressed the importance of preparing for operational disruption, including setting out appropriate remedies for possible downtime and maintaining disaster recovery plans.