Nigeria orders banks and fintechs to keep payment data at home by 2027

Nigeria is moving to bring its financial data closer to home as the Central Bank of Nigeria tightens control over one of Africa’s fastest-growing digital payments markets.

• Nigeria’s central bank has ordered banks, fintechs and payment operators to store and manage payment transaction data within the country by January 1, 2027.
• The directive is part of a wider push to tighten oversight of Nigeria’s fast-growing digital payments industry.
• The new rules also require ownership disclosure and introduce limits aimed at preventing excessive market dominance.
• The policy could boost local data infrastructure, but may raise compliance costs for firms that rely heavily on offshore systems.

The apex bank has directed banks, fintech companies, mobile money operators and other payment service providers to ensure that payment transaction data generated in Nigeria is stored and managed within the country by January 1, 2027.

The rule is part of a wider regulatory overhaul covering data localisation, ownership disclosure, market structure and systemic oversight in Nigeria’s payments system.

The policy may sound technical to consumers. But it touches one of the most sensitive parts of modern finance: who controls payment data, where that data is stored, and how easily regulators can access it when risks emerge.

Nigeria’s payments industry has grown rapidly over the past decade, driven by mobile banking, agency banking, fintech apps, card payments and online transfers.

That growth has made digital payments central to daily life for millions of Nigerians. It has also made the sector more important to financial stability.

The CBN said the expansion of electronic payments and digital financial services has raised concerns around market concentration, operational dependence, ownership transparency and the storage of critical payment data.

In simple terms, the regulator wants more visibility over the companies moving money across the economy.

Under the new directive, payment transaction data generated in Nigeria must be stored and managed locally in line with Nigerian data protection laws.

This means banks and fintechs that rely heavily on offshore infrastructure may need to review how they host, process and back up payment records before the 2027 deadline.

The CBN’s move does not necessarily mean foreign cloud companies are banned from Nigeria’s financial sector. But it raises the bar for banks and fintechs using offshore systems, especially where payment data is stored outside the country.

The policy could create fresh demand for local data centres and cloud infrastructure, as financial institutions look for compliant ways to host sensitive transaction data within Nigeria.

But it could also raise costs for smaller fintechs, which may need to upgrade systems, renegotiate vendor contracts or redesign parts of their technology operations.

Beyond data storage, the directive also targets ownership transparency. Banks, payment service providers and other financial institutions with digital payment operations must disclose the ultimate beneficial owners of significant shareholders.

This is aimed at showing who really owns or controls companies, even where ownership is hidden behind layers of corporate structures.

The CBN also introduced market-share limits to reduce excessive dominance in parts of the payments industry.

Under the framework, a licensed institution with more than 25% market share in card issuing will not be allowed to hold more than 15% market share in merchant acquiring during the same period. A similar restriction applies in reverse for firms dominant in merchant acquiring.

That part of the policy is important because payments are becoming too critical to be controlled by a few powerful players.

If one dominant operator suffers a major failure, the impact could spread across banks, merchants, fintech platforms and consumers. By tightening oversight, the CBN is trying to reduce concentration risk before it becomes a wider financial stability problem.

Governments are increasingly treating data as a strategic asset, especially in finance, telecoms, health and national security. For Nigeria, keeping payment data at home gives regulators greater control over a system that now carries a large share of economic activity.

The policy comes at a time when Nigeria is pushing deeper financial inclusion and expanding electronic payments under its broader payments modernisation agenda.

Growth in Nigeria’s digital finance sector will now come with tougher rules on data, ownership and market power.