Payment data must stay in Nigeria from 2027: what the CBN's new rule changes

From 1 January 2027, the record of almost every payment made in Nigeria will have to live on servers inside Nigeria. That is the effect of a Central Bank of Nigeria (CBN) circular dated 15 June 2026, which says that all financial institutions and participants facilitating payments in the country must ensure that payment transaction data generated in Nigeria is "stored and managed in Nigeria".

For most people the rule is invisible. Behind the screen, though, banks, fintechs, switches and agent networks that keep their data with foreign cloud providers now have weeks, not years, to move it. Telecom operators and data-centre companies, MTN Nigeria among them, are pitching themselves as the landlords for that data.

What exactly did the CBN order?

The circular, reference PSS/DIR/PUB/CIR/001/004, came from the CBN's Payments System Supervision Department and was signed by its director, Dr Rakiya Yusuf. It is addressed to deposit money banks, microfinance banks, mobile money operators, switching companies, payment terminal and payment solution service providers, super agents and other licensed payment operators, according to ThisDay's report of the circular.

"Data localisation" simply means a legal requirement to keep certain information physically inside a country's borders. Here it applies to payment transaction data: the records created when money moves. Full compliance is due on 1 January 2027.

Localisation is only one part of the circular. It also caps market dominance: an institution holding more than 25% of card issuing over a rolling 12 months may not hold more than 15% of merchant acquiring (signing up shops to accept cards) in the same period, and the reverse, with that part due by 31 December 2026. Banks and payment firms must also disclose the ultimate beneficial owners, meaning the real people behind their significant shareholders. The CBN's stated concerns, as summarised by law firm Aluko & Oyebode, include market concentration, operational dependence and where critical payments data is located.

Why does the CBN care where the data sits?

Nigeria's payment system is now large and almost entirely electronic. The NIBSS Instant Payment system (NIP), which carries most bank transfers, handled about 11.2 billion transactions in 2024, up from 9.7 billion in 2023, with a combined value of roughly ₦1.07 quadrillion across e-payment channels.

Much of the software behind those transactions runs abroad. Industry estimates cited by BusinessDay put more than 90% of regulated businesses as hosting data on foreign cloud platforms. The Guardian cites an estimated $850 million a year leaving the country to pay for foreign cloud services. Treat both as rough industry estimates; neither comes from an audited count.

A regulator worries about three things here. Records held abroad may be harder to reach in an investigation or a dispute. Dollar hosting bills add to demand for scarce foreign exchange. And a system leaning on a few foreign providers depends on them staying up. The circular is not Nigeria's first data rule: the Nigeria Data Protection Act 2023 allows personal data to leave the country when the destination offers adequate protection, and NITDA guidelines from 2019 already require government data to be hosted locally. The CBN rule goes further for one sector.

Does this ban the cloud?

No. RainingMoney's reading: the circular's wording is about location, not technology. A bank can still rent computing power from a cloud provider, as long as the data is stored and managed in a facility in Nigeria.

That matters because the big global cloud companies, known as hyperscalers, do not run a full cloud region in Nigeria. Amazon Web Services opened a Local Zone in Lagos in January 2023, a smaller site that puts some computing, storage and database services close to users. How far such sites satisfy the rule will depend on where each service actually keeps its data.

Who is offering to host the data?

Several kinds of provider are competing for the work:

• Telecom operators. MTN Nigeria opened phase one of its Sifiso Dabengwa data centre in Lagos in July 2025, with a second phase planned. In August 2026 MTN said it was setting up infrastructure to help financial institutions migrate. Lynda Saint-Nwafor, its Chief Enterprise Business Officer, put the sales pitch plainly: "Hosting locally means lower latency, faster response times, and compliance with Nigeria's data regulations." (Latency is the delay before a system responds.) By September, MTN said the facility's ground floor was fully committed. The operators' association ALTON has endorsed the mandate.
• Independent data-centre operators. Rack Centre and Open Access Data Centres (OADC) run colocation sites in Lagos, where clients rent space, power and cooling for their own equipment. OADC's chief executive, Ayotunde Coker, has argued that the push could make Nigeria a regional data hub.
• The state. Galaxy Backbone, the government-owned provider, runs facilities in Abuja and Kano, according to TechCabal, mainly for public-sector data.
• The hyperscalers, through local sites such as the Lagos Local Zone.

What does it mean for banks, fintechs and customers?

For banks, which one industry executive told Arise have largely localised already, the job is mostly an audit: find every payment record held abroad, including backups and analytics copies. For fintechs, which often built on foreign cloud from day one, it can mean moving live systems. Techpoint reports fintech executives' worries about local capacity, disaster recovery, migration risk and long-term cost, and warns that a badly run migration can cause downtime lasting hours or longer.

Cost cuts both ways. Local hosting can be dearer, but some founders welcome naira pricing, which removes the risk of a hosting bill jumping when the naira falls.

For customers, the best outcome is that nothing visible happens. The realistic risk is a few rough weeks of failed or delayed transfers around the switch, if migrations are rushed into December.

Is the deadline really fixed?

So far, yes. At an industry roundtable in October, the CBN's payments supervision department said: "The compliance date hasn't changed. It is January 1, 2027." Update, October 2026: ThisDay reports that the CBN has begun moving its own offshore-hosted payment data back to Nigeria, and that some institutions plan to move only a slice of their data while keeping most applications abroad. Separately, NITDA, the IT regulator, launched a National Sovereign Cloud Initiative in August, with a platform to certify cloud and data-centre providers due in October.

What to watch

• Whether the CBN publishes guidance on backups, disaster-recovery copies and cross-border card transactions.
• How the CBN treats firms that move only part of their data by 1 January.
• Service disruptions at fintechs during November and December migrations.
• Whether any hyperscaler commits to a full Nigerian cloud region.

The bottom line

The CBN's rule is simple to state and hard to execute: payment data made in Nigeria must stay in Nigeria from 2027. It shifts business towards local hosts such as MTN, Rack Centre, OADC and Galaxy Backbone, and it may ease some dollar demand.

RainingMoney's reading: the policy's success will be judged less by the deadline than by the weeks around it. If migrations are tested and staged, customers will never notice. If they are rushed, customers will notice first.