CBN Holds January 1, 2027 Deadline for Local Storage of Payment Data

The Central Bank of Nigeria has reaffirmed January 1, 2027, as the deadline for banks and other regulated financial institutions to store critical payment transaction data within Nigeria. The CBN warned that institutions that deliberately fail to comply will face sanctions.

CBN Deputy Governor for Financial System Stability, Lamido Abubakar Yuguda, disclosed the position at an executive regulatory dialogue organised by the CBN and the National Information Technology Development Agency in Lagos. The meeting focused on the National Sovereign Cloud Initiative and data localisation amid concerns about the security of Nigeria's digital financial infrastructure.

Deadline remains unchanged

Yuguda said the deadline remained unchanged and warned that deliberate attempts to frustrate implementation would not be tolerated. He explained that regulated institutions must ensure critical payment transaction data is stored and managed within Nigeria in line with existing regulatory requirements.

According to him, the policy is designed to improve regulatory oversight, strengthen the resilience of the financial system and protect sensitive financial information. He noted that Nigeria's financial system increasingly depends on digital infrastructure as electronic payments, digital banking and financial technology services expand. Protecting the systems supporting these services is essential to maintaining financial stability and public confidence.

Cloud benefits and risks

Yuguda acknowledged that cloud computing could help financial institutions improve efficiency, flexibility and innovation. However, he warned that increased reliance on cloud services also presents challenges involving cybersecurity, data protection and operational resilience. He added that dependence on third-party technology providers could expose financial institutions to additional risks if not properly managed.

The deputy governor described the National Sovereign Cloud Initiative as an opportunity to strengthen Nigeria's digital resilience, build local technological capacity and improve the protection of critical financial data. The initiative is expected to support efforts to keep sensitive information under appropriate domestic control while strengthening the country's digital infrastructure.

Despite the emphasis on data localisation, Yuguda cautioned that storing information within Nigeria would not, on its own, guarantee security. He said financial institutions must complement the policy with strong cybersecurity systems, business continuity plans, disaster recovery arrangements and effective risk-management practices. He also stressed that banks and other regulated institutions would remain responsible for managing risks arising from relationships with cloud service providers and other technology partners.

What it means for banks and customers

The CBN's position signals continued regulatory pressure on financial institutions to prepare for the January 2027 deadline while ensuring that their technology systems meet broader security and resilience requirements. For banks and fintechs, compliance will require investment in local data hosting, cybersecurity and disaster recovery. For customers, the CBN says the goal is stronger protection of payment data and public confidence in the financial system.