Nigerian banks and other payment industry operators have called on the Central Bank of Nigeria (CBN) to extend the January 1, 2027 deadline for full localisation of payment transaction data, warning that the six-month implementation window may not be sufficient to complete the migration without exposing the payments ecosystem to operational and cybersecurity risks.
The stakeholders said the scale and complexity of moving critical payment workloads from foreign cloud environments and other overseas infrastructure to local facilities require a phased implementation plan, clearer regulatory guidance and closer engagement between the regulator and operators.
The concerns were raised by financial-sector executives and technology industry stakeholders at the GrowthX by Techeconomy and TiLAwards in Lagos, where participants discussed the implications of the CBN’s data localisation directive and the broader infrastructure requirements of Nigeria’s rapidly expanding digital payments ecosystem.
The CBN, through a circular issued in June 2026, directed banks, fintech companies, mobile money operators, switching and processing companies, payment service providers and other licensed payment operators to ensure that payment transaction data generated within Nigeria is stored and managed locally.
The directive is scheduled to take effect from January 1, 2027 and forms part of measures aimed at strengthening regulatory oversight, data sovereignty and resilience within the Nigerian payments system.
However, industry operators said meeting the deadline involves more than simply transferring data to servers located in Nigeria.
They noted that institutions with significant workloads hosted on international cloud platforms would have to redesign parts of their technology architecture, migrate large volumes of sensitive transaction data, test systems, establish adequate backup and disaster-recovery arrangements and ensure that payment services remain available throughout the process.
Chief Technology Officer of FCMB, Blessing Ehize, said the industry still required greater clarity from the CBN on how the regulation would apply to different infrastructure arrangements, particularly institutions operating hybrid cloud environments.
According to him, banks need a clear roadmap setting out what data must be physically hosted in Nigeria and what components of hybrid arrangements may continue to operate outside the country.
Ehize said the Committee of Bank Chief Information Officers had faced difficulties engaging effectively with the CBN over some of the technical issues surrounding the implementation of the directive.
He argued that the industry has the capacity to achieve localisation but needs adequate planning and milestones rather than an accelerated migration that could create avoidable risks.
The concern over the timeline was also echoed by Hakeem Adeniji-Adele, Deputy Managing Director of eTranzact, who said the six-month period was short considering the volume of data and workloads that would have to be moved.
He advocated a phased approach that separates computing and storage requirements, rather than requiring all affected institutions to undertake major migrations simultaneously.
The concerns are particularly significant given the scale of Nigeria’s digital payments market.
Figures cited at the event showed that digital payments in Nigeria had crossed N1 quadrillion in a single year, while more than 11.2 billion instant transfers were processed through the Nigeria Inter-Bank Settlement System’s NIP platform.
With such transaction volumes, industry participants said a poorly coordinated migration could have consequences beyond individual financial institutions, potentially affecting the availability and resilience of payment services across the wider economy.
The localisation exercise would also involve banks, fintechs, cloud service providers, data-centre operators, telecommunications companies and cybersecurity firms, making the transition a broad infrastructure project rather than a conventional compliance exercise.
Industry estimates cited by BusinessDay indicate that payment-data localisation could require between 14 megawatts and 30MW of additional IT capacity, depending on the growth scenario. Existing commercial data centres were estimated to have about 20MW of available IT capacity, with a further 15MW to 20MW potentially capable of being fitted out.
This has shifted the debate from whether Nigeria has physical data-centre capacity to whether financial institutions can migrate critical workloads while maintaining redundancy, cybersecurity, disaster recovery and uninterrupted access to payment services.
Chief Executive Officer of UniCloud Africa, Krishnan Ranganath, had earlier noted that many Tier-1 and Tier-2 banks had already localised their transaction data, while fintechs, digital banks and other operators with significant overseas-hosted workloads could face a more complicated transition.
Existing contracts with international cloud providers could also increase the cost and technical complexity of migration for institutions that have committed to long-term arrangements.
Beyond infrastructure, cybersecurity remains a major consideration.
David Adeoye Abodunrin, a cybersecurity strategist and founder of Cubed Integrated Consulting and Cyberfore Consulting, said data localisation would need to be accompanied by stronger security architecture, behavioural safeguards, recovery testing and greater collaboration among banks, fintechs and telecommunications operators.
He cited NIBSS data showing that digital-payment fraud losses declined by 51 per cent to N25.85bn in 2025 from N52.26bn in 2024, while social engineering remained a significant fraud technique.
The cybersecurity concerns highlight the fact that storing data within Nigeria does not, by itself, guarantee stronger protection.
Financial institutions would still need reliable power, resilient data centres, connectivity, backup systems, cybersecurity controls and tested disaster-recovery capabilities to ensure that localised data remains accessible and secure during disruptions.
Ayotunde Coker, Chief Executive Officer of Open Access Data Centre, said the reliability of digital infrastructure had become critical to virtually every major sector of the economy, particularly banking and payments.
He noted that failures in power, data-centre operations or connectivity could quickly translate into disruptions to banking platforms and financial services.
Meanwhile, other industry stakeholders have previously called for early preparation for the January deadline, with data-centre operators arguing that institutions should begin migration planning early rather than wait until the final months before the compliance date.
The CBN’s localisation policy is intended to ensure that payment information generated within Nigeria remains under Nigerian jurisdiction and is subject to local regulatory oversight and applicable data-protection requirements.
But as the January 1, 2027 deadline approaches, banks and payment companies are increasingly asking the regulator to provide a practical implementation framework that balances the objective of data sovereignty with the need to protect the stability and reliability of Nigeria’s payment infrastructure.
For the operators, the immediate issue is therefore no longer whether payment data should be localised, but how the transition can be carried out without disrupting the payment services on which businesses, consumers and the wider economy increasingly depend.
