Why CBN Maintains January 2027 Deadline for Local Data Storage in Nigeria
The Central Bank of Nigeria insists on its January 1, 2027 deadline for local payment data storage to strengthen digital sovereignty, improve regulatory oversight and boost domestic data infrastructure despite industry concerns.
Nigeria’s financial institutions are facing mounting pressure to move payment transaction data generated within the country to local storage facilities, following the Central Bank of Nigeria’s (CBN) decision to maintain its January 1, 2027 compliance deadline.
The apex bank’s position, reiterated in October 2026, signals that it considers data localisation a critical component of financial security, regulatory oversight and Nigeria’s broader digital transformation agenda.
According to The Guardian Nigeria, the CBN has described local data storage as more than a technical regulatory obligation, presenting it as a fundamental pillar of national economic security and digital sovereignty.
The directive affects banks, fintech companies, mobile money operators, payment processors and other financial institutions involved in facilitating payments in Nigeria. With the deadline approaching, affected organisations must ensure that their systems, technology contracts and data-management arrangements meet the new requirements.
Why the CBN Is Insisting on the Deadline
1. Strengthening Nigeria’s digital sovereignty: One of the major reasons behind the CBN’s position is the need to keep critical financial data within Nigeria’s jurisdiction.
As electronic payments expand, Nigerian financial institutions generate enormous amounts of sensitive information about transactions, customers and commercial activities. When such data is stored or managed abroad, regulatory access and oversight may become more complicated.
Localisation is intended to ensure that payment transaction data generated in Nigeria is stored and managed domestically in line with applicable laws and regulations.
The CBN’s June 15, 2026 circular established the requirement and set January 1, 2027 as the date for full compliance. Punch reported on the original directive, which formed part of a wider package of measures aimed at improving oversight of Nigeria’s growing digital payments sector.
Keeping covered data within the country could also reduce dependence on offshore infrastructure and strengthen the ability of Nigerian regulators to supervise sensitive financial operations.
2. Improving regulatory oversight and financial security: The CBN’s second major concern is effective supervision of a rapidly evolving payments ecosystem.
Digital banking, mobile transfers and fintech services have expanded access to financial services, but the growth has also created challenges involving operational dependence, market concentration, transparency and cybersecurity.
Domestic storage can make it easier for regulators to establish where covered information resides and how it is managed. However, localisation alone cannot eliminate cybercrime or prevent data breaches. Financial institutions must still maintain strong access controls, encryption, monitoring and incident-response systems.
The policy therefore forms part of a broader effort to protect the integrity and resilience of Nigeria’s payment infrastructure rather than serving as a complete cybersecurity solution.
3. Boosting local data centres and technology investment: The deadline could also stimulate investment in Nigeria’s digital infrastructure.
Financial institutions that currently rely on overseas cloud environments may need to expand their use of Nigerian data centres, engage domestic cloud providers or redesign their existing technology arrangements.
In its October 9 report, The Guardian Nigeria said the CBN expects the policy to drive demand for local data centres, technology talent and cloud service providers.
Such investment could create opportunities for infrastructure operators, engineers, cybersecurity professionals and technology companies. It could also encourage the development of domestic capacity to support the country’s expanding digital economy.
The potential benefits, however, depend on whether local facilities can provide reliable electricity, sufficient computing capacity, robust connectivity and dependable disaster-recovery systems.
Why Banks and Fintechs Are Concerned
Despite supporting the broader objective of strengthening financial security, some industry participants have questioned whether the implementation period is long enough for a migration of this scale.
*BusinessDay reported that banks and payment companies raised concerns about the January 2027 deadline, citing the possibility of operational disruption, cybersecurity risks and insufficient clarity over how the rules should apply to different cloud arrangements.
Moving large volumes of financial data requires more than transferring files between servers. Institutions must test applications, protect transaction records, review contracts with international technology providers and ensure that payment services remain available throughout the process.
A poorly managed transition could cause downtime, data loss or weaknesses in backup and recovery arrangements. These risks are particularly significant in a country where individuals and businesses increasingly depend on electronic payments for everyday transactions.
Some institutions may also need to redesign systems that combine overseas cloud applications with locally hosted data. BusinessDay’s report on split-cloud architecture highlights the technical and operational decisions confronting banks and high-volume fintech companies.
What Financial Institutions Must Do Before January 2027
The CBN has maintained that the deadline remains unchanged. At the CloudReady Nigeria Financial Services Roundtable in Lagos, its representatives urged affected institutions to begin or accelerate their migration plans.
The process requires institutions to identify and classify covered data, assess where it is stored and processed, review third-party technology contracts, establish suitable local infrastructure, migrate information and test the resulting systems.
Compliance must also address the wider data lifecycle, including processing, transaction logs, audit trails, backups and eventual disposal, as applicable under the regulatory requirements.
Institutions must demonstrate that their arrangements protect data integrity and preserve service continuity. Simply locating a database in Nigeria will not necessarily resolve every compliance issue if supporting systems or data-management processes remain inconsistent with the directive.
Conclusion
The CBN’s decision to maintain the January 1, 2027 deadline reflects its determination to strengthen Nigeria’s control over critical payment data, improve supervision and encourage investment in domestic digital infrastructure.
The policy offers potential long-term benefits, but its success will depend on careful implementation. Regulators and financial institutions must balance data sovereignty with cybersecurity, reliable payments, clear technical guidance and adequate infrastructure.
For banks, fintech companies and payment service providers, the immediate priority is clear: complete the necessary compliance work without compromising the reliability and security of the services on which millions of Nigerians depend.