The directive is expected to accelerate preparations across the financial sector, as affected institutions review their technology infrastructure, agreements with cloud service providers and plans for moving data to local systems.

The regulator restated its position during the CloudReady Nigeria Financial Services Roundtable organised by Africa Hyperscalers in Lagos. The Director of the CBN’s Payments System Supervision Department, Dr Rakiya Opemi Yusuf, was represented at the event by Assistant Director Babatunde Ajiboye.

Yusuf said the compliance date remained unchanged and stressed that the requirement covered the entire lifecycle of payment data, from its creation and processing to storage and eventual disposal.

The directive was introduced through a CBN circular issued on June 15, 2026. It requires covered financial institutions and payment system participants to ensure that payment transaction data generated within Nigeria is stored and managed locally in line with applicable laws and regulations.

The affected organisations include deposit money banks, microfinance banks, mobile money operators, switching and processing companies, payment terminal service providers and other licensed participants in the payments ecosystem.

Yusuf said compliance would require more than simply moving databases to servers located in Nigeria. Institutions must identify and classify relevant data, review their technical arrangements and contracts, migrate the covered information, test their systems and independently verify that the requirements have been met.

She also emphasised the need to protect data integrity and maintain uninterrupted payment services during the transition. Financial institutions must ensure that their migration efforts do not introduce operational weaknesses or compromise transaction records.

Institutions involved in cross-border transactions will also need to examine how their arrangements meet Nigeria’s requirements while supporting legitimate international payment operations. Those facing implementation difficulties are expected to demonstrate progress, identify outstanding gaps and develop credible plans to address them.

The CBN has further urged financial institutions to review their contracts with cloud and technology providers to establish where payment data is stored, how it is processed and backed up, and whether existing arrangements can satisfy the new rules.

The policy forms part of Nigeria’s broader push to strengthen digital sovereignty and expand domestic capacity for hosting sensitive information. Greater use of Nigerian data centres and cloud infrastructure could create opportunities for local technology companies, infrastructure operators and skilled professionals.

However, industry participants have stressed that successful implementation will depend on the availability of secure and reliable infrastructure, clear regulatory guidance and coordination between regulators, financial institutions and technology providers.

Executive Director of Africa Hyperscalers, Temitope Osunrinde, said Nigeria had taken important steps towards greater control over its digital infrastructure through initiatives including the National Cloud Policy, the National Sovereign Cloud Policy, the Nigeria Data Protection Act and the CBN’s payment-data localisation directive.

He said the next challenge was translating those policies into workable arrangements across the financial services industry. This would require clear approaches to classifying data and workloads, resilient infrastructure, trusted service providers and stronger coordination among stakeholders.

At the roundtable, Nobus Cloud Chief Operating Officer Stephen Okoye discussed the role local cloud providers could play in helping financial institutions migrate their systems. He highlighted the need to assess application dependencies, security settings, connectivity and recovery arrangements before moving critical workloads.

Okoye also outlined his company’s infrastructure and compliance credentials. Such claims, including service availability and certification, need to be assessed against relevant technical evidence and independently verifiable standards when financial institutions evaluate providers.

Open Access Data Centres Chief Executive Officer Ayotunde Coker said each financial institution should assess its applications, operational requirements and risks before deciding how to implement the transition.

He noted that data localisation was not simply a matter of relocating information. Institutions must consider whether local infrastructure can support their systems reliably, including the connectivity, power supply, redundancy and disaster recovery arrangements needed to keep essential services running.

For organisations whose applications depend on overseas cloud platforms, the transition could require changes to system architecture and extensive testing. The scale of the work and the associated costs will vary depending on the complexity of each institution’s technology environment.

The Nigeria Data Protection Commission also highlighted the importance of safeguarding personal information throughout the process. The commission’s National Commissioner and Chief Executive Officer, Dr Vincent Olatunji, was represented at the event by Ibukunoluwa Owa.

Owa emphasised the need for data protection impact assessments, third-party risk assessments and appropriate data-processing agreements. Organisations must understand the responsibilities of their technology providers and ensure that personal information is handled in accordance with applicable data protection requirements.

She also highlighted breach reporting, transparent privacy policies, clear arrangements for addressing service interruptions and effective disaster recovery planning as important elements of responsible data management.

With January 1, 2027, approaching, financial institutions face the task of balancing regulatory compliance with the need to maintain secure, reliable payment services. The CBN’s latest position makes clear that affected institutions must continue preparing for the deadline rather than assume additional time will be granted.

Reporting by TalkNaijaMedia