Nigeria's financial institutions are racing against time to comply with a new data localisation requirement that will compel payment transaction data generated in the country to be stored and managed within Nigeria from January 1, 2027.
The directive, issued by the Central Bank of Nigeria (CBN) in June 2026, is expected to have significant implications for banks, fintechs, mobile money operators, switching companies, payment processors and other regulated participants whose digital infrastructure currently relies partly or substantially on offshore cloud services.
The mandate came at a critical juncture for an ecosystem processing upwards of 14 billion digital transactions each year.
For technology executives, the challenge extends well beyond moving data from one server to another.
Keep up with the latest headlines on WhatsApp | LinkedIn
Institutions with years of investment in international cloud platforms such as Amazon Web Services (AWS) and Microsoft Azure must determine how to restructure complex technology environments while maintaining the speed, reliability and security expected of modern financial services.
Moving core banking applications, payment-processing platforms, real-time settlement systems, fraud-detection engines and other interconnected workloads requires careful planning to avoid service disruptions.
The January 2027 deadline therefore represents a major operational test for financial institutions and their technology teams.
Compliance deadline approaches
According to the CBN circular issued on June 16, 2026, entities processing payments in Nigeria will be required from January 1, 2027, to store and manage payment transaction data generated in Nigeria within the country, in accordance with applicable Nigerian data protection laws.
The directive forms part of broader measures covering data localisation, market structure, ultimate beneficial ownership disclosure and systemic oversight within Nigeria's payments system.
The new requirements apply across a broad range of regulated institutions, including deposit money banks, microfinance banks, mobile money operators, switching and processing companies and other licensed participants in the digital payments ecosystem.
The CBN has said it will closely monitor compliance and may impose supervisory sanctions on institutions that fail to meet the requirements under applicable laws, regulations and guidance.
For institutions operating offshore cloud infrastructure, the deadline creates a particularly demanding transition.
More than a technology migration
Industry experts at Goldsmith Solicitors Nigeria said the rapid growth of Nigeria's digital payments sector has created new regulatory challenges.
They noted that electronic transaction volumes and mobile money adoption have expanded significantly, while a relatively small number of switching, processing and payment infrastructure providers play important roles in the movement of money across the country.
According to the experts, the CBN's June 2026 circular is intended to address some of the risks associated with this growth, while increasing regulatory visibility and reducing operational risks associated with offshore data storage.
The data localisation requirement means institutions with cross-border data-processing arrangements may have to establish relationships with local data centres, renegotiate cloud contracts and develop detailed migration plans.
The requirement also operates alongside, rather than replacing, obligations under the Nigeria Data Protection Act 2023.
The cost of moving to local infrastructure
For chief information officers and other technology executives, the immediate costs of migration are relatively easy to identify.
Computing capacity, storage, data transfer, network connectivity, migration services and infrastructure procurement will all contribute to the overall bill. For a mid-sized fintech undertaking a large-scale migration, the costs could run into tens of millions of naira, while larger financial institutions operating hundreds of interconnected services could face considerably higher expenses.
However, the financial implications extend beyond the cost of acquiring local infrastructure.
Institutions must also account for application redesign, systems integration, cybersecurity, testing, staff training, data replication, disaster recovery and the potential cost of downtime.
A poorly planned migration could affect payment processing and customer-facing services, making resilience a central consideration.
Infrastructure capacity under scrutiny
One of the challenges facing institutions preparing for the deadline is determining which local infrastructure can provide the performance, scalability, security and resilience required by high-volume financial applications.
Financial institutions therefore face the task of balancing regulatory compliance with operational resilience. Simply moving workloads into Nigeria may satisfy a localisation requirement, but institutions must ensure that the new environment can support the performance and reliability of the services customers depend on.
Local infrastructure providers step forward
As financial institutions prepare for the transition, local digital infrastructure providers are positioning themselves to support the migration.
MTN Nigeria, for instance, has highlighted data sovereignty, scalability and sustainability as key features of its data centre and cloud offerings.
Lynda Saint-Nwafor, Chief Enterprise Business Officer at MTN Nigeria, said the company's infrastructure strategy was designed around keeping African data within Africa while providing businesses with the capacity to scale securely.
"For MTN, it aligns with our vision to be the leading digital solutions provider across Africa, building infrastructure that supports long-term economic transformation," she said.
Such local infrastructure offerings could provide financial institutions with alternatives to fully offshore cloud arrangements while helping them meet the CBN's localisation requirements.
Opportunity beyond compliance
While the January 2027 deadline creates significant pressure, industry observers say it could also accelerate the development of Nigeria's digital infrastructure ecosystem.
Sign up for free AllAfrica Newsletters
Get the latest in African news delivered straight to your inbox
For financial institutions, the migration could encourage greater investment in local data centres, cloud services, cybersecurity and disaster-recovery infrastructure.
It could also lead technology executives to reassess their existing architectures and reduce unnecessary dependencies on infrastructure outside the country.
The transition, however, will require careful sequencing. Institutions cannot simply switch providers overnight without assessing application dependencies, data integrity, security, performance and business continuity.
The most successful migration strategies are likely to involve detailed workload mapping, phased migration, extensive testing and clearly defined rollback and disaster-recovery procedures.
A high-stakes deadline
For financial institutions, the central challenge is to achieve compliance without compromising the availability and reliability of services.
The deadline could ultimately distinguish institutions that treat data localisation purely as a compliance obligation from those that use it as an opportunity to strengthen their technology architecture, improve resilience and deepen investment in Nigeria's digital infrastructure.
Banks, fintechs and payment companies must determine which workloads need to move, where they will reside, how they will be protected and how the migration can be completed without disrupting the financial systems on which millions of Nigerians depend.
