Nigerian banks warned against compromising resilience under data localisation rules

Banks and payment service providers in Nigeria have been urged to strengthen data protection and comply with upcoming data localisation requirements without weakening financial system resilience or disrupting cross-border transactions.

Executives speaking at the 7th CIO and C-Suite Awards Africa in Lagos on Tuesday warned that requiring payment data to remain within Nigeria could create operational risks if financial institutions failed to invest in reliable infrastructure and maintain connectivity with international payment networks.

The Central Bank of Nigeria’s (CBN) data localisation directive, issued on 15 June 2026, requires financial institutions and participants facilitating payments within the country to store and manage locally generated payment transaction data within Nigeria from 1 January 2027. While the policy is intended to strengthen domestic control over financial data, its implementation has raised questions about infrastructure capacity, operational costs and the continued reliability of financial services.

CBN highlights infrastructure needs for data localisation

In a keynote address, Rakiya Yusuf, Director of the CBN’s Payments System Supervision Department, described data localisation as increasingly important to national security, financial system stability and the development of domestic digital infrastructure.

However, she acknowledged that implementing the policy would require substantial technical capacity and investment.

“Effective localisation requires reliable power, connectivity, data centres, cloud infrastructure and cybersecurity capabilities,” she said, warning that inadequate capacity could increase operating costs and reduce efficiency.

The requirements could encourage investment in domestic data centres, cloud computing, telecommunications infrastructure and digital platforms. However, the benefits will depend partly on whether local infrastructure can support the demands of financial institutions while maintaining the performance and availability expected of modern payment systems.

The transition also raises questions about how banks and payment providers will manage international transactions and technology partnerships that rely on cross-border data flows.

Financial sector cautions against isolation from global networks

Emmanuel Alao, Chief Operating Officer of FMDQ Depository Limited, argued that data sovereignty should not come at the expense of interoperability, which enables financial institutions and markets to exchange information and conduct transactions across jurisdictions.

“Isolation is out of the question,” Alao said, emphasising the need to preserve data flows and comply with international standards while protecting critical information.

He warned that poorly designed restrictions could disrupt transaction processing, affect cross-border investment flows and weaken the network effects that underpin financial markets across Africa.

For banks and payment service providers, the challenge is therefore to meet domestic data storage requirements while maintaining the technical connections needed to serve customers and participate in regional and international financial markets.

Banks urged to build resilience into local data hosting

Emeka Oboegbune, Divisional Head of Information Technology and Operations at FSDH Merchant Bank, described the policy as an opportunity to improve Nigeria’s domestic technology infrastructure but cautioned that implementation must not create new vulnerabilities.

He called for a national resilience framework to ensure that local data hosting does not introduce single points of failure or undermine the reliability of financial services.

Data localisation can strengthen domestic control over information, but the resilience of payment systems also depends on infrastructure availability, cybersecurity capabilities and the ability to maintain services when technical failures occur. Financial institutions will need to consider these factors as they assess their technology arrangements and prepare for the implementation deadline.

Deloitte calls for risk-based approach to compliance

Wole Oyeniran, a partner at Deloitte, urged financial institutions to treat the new requirements as an opportunity to redesign their payment systems rather than approach compliance as a regulatory checklist.

He recommended that institutions map their payment data flows, classify information according to risk and determine which categories require local storage. These decisions, he said, should take account of security, system performance and operational resilience.

“Rather than thinking of either migration or compliance, rather optimise your operation,” Oyeniran said.

A risk-based approach could help institutions identify where changes are necessary while assessing how those changes may affect existing systems, service delivery and international connectivity.

Data localisation deadline puts focus on implementation

With the 1 January 2027 deadline approaching, Nigerian financial institutions face the task of aligning their data management practices with regulatory requirements while preserving the reliability of payment services.

The discussions at the awards highlighted the importance of balancing data protection and national control with interoperability, infrastructure readiness and cybersecurity. The effectiveness of the policy will depend not only on where payment data is stored, but also on whether the systems supporting it remain secure, available and capable of facilitating domestic and cross-border transactions.