On 15 June 2026, the Central Bank of Nigeria issued circular PSS/DIR/PUB/CIR/001/004, signed by Dr Rakiya Yusuf, Director of the Payments System Supervision Department, directing financial institutions to localise payment data. The circular signals a new posture of systemic oversight, under which the largest fintechs would be supervised as critical financial infrastructure rather than as startups. And it mandates data localisation, which has attracted the most attention, because it is by far the most operationally demanding. It requires that all payment transaction data generated in Nigeria be “stored and managed within Nigeria” by January 1, 2027. Read broadly, as the law firms parsing it have, the requirement extends to transaction databases, settlement and reconciliation records, switching logs, merchant and issuer records, audit trails, and, critically, backups and disaster-recovery systems. The circular supplements rather than replaces the Nigeria Data Protection Act 2023, leaving covered institutions subject to two compliance regimes at once. It specifies no fixed penalties of its own, only discretionary “supervisory sanctions”; the single quantified monetary penalty in the surrounding framework belongs to the NDPA, at up to N10 million or two per cent of annual gross revenue. Firms are expected to comply by a hard deadline, to a standard the circular never fully defines, under a penalty it never quantifies. The principle behind the policy deserves broad support. A country’s payment data is a strategic national asset. The regulator supervising a trillion-naira payments ecosystem should not have to rely on a foreign court, a foreign cloud provider, or another government’s cooperation to access data needed for oversight. Financial sovereignty is not protectionism; it is prudent regulation. The macroeconomic case is real too. Technext puts Nigerian spending with foreign cloud providers at around $ 850 million a year, paid in scarce dollars earned in a currency that lost roughly 70 per cent of its value between 2020 and 2024. Keeping that expenditure at home is a legitimate ambition, and naira-denominated hosting is a genuine hedge. Where the policy falters is not in its objective but in its execution. The CBN has instructed the industry to achieve full localisation by January 2027, roughly six months after issuing the circular, without ensuring the infrastructure, cloud ecosystem, and operational readiness required to make that transition viable. In effect, it has asked the industry to drive on roads that have not yet been built. We do not have to speculate about the consequences. Another central bank tried this eight years ago, and the deadline did not hold. It would be naive to read the circular in isolation. It is the latest move in a two-year pattern of the CBN tightening its grip on the fintech sector. In November 2023, the Bank introduced stricter KYC requirements widely seen as targeting fintech onboarding. A few months later, it overhauled the rules for international money transfer operators, raising the minimum capital requirement to US$1 million, imposing a N10 million non-refundable licensing fee, and excluding fintech companies from holding those licences altogether. Then, on April 29, 2024, it ordered five of the country’s best-known fintechs; OPay, Moniepoint, Kuda, PalmPay and Paga, to stop onboarding new customers entirely, two days after the EFCC froze 1,146 accounts linked to illicit foreign-exchange dealing. The issue is not that the CBN should supervise the industry. It should. The concern is that it has repeatedly reached for the bluntest regulatory instrument available: impose a hard deadline first and deal with the operational consequences later. Data localisation reflects that same instinct, only this time it targets the industry’s underlying infrastructure rather than its business processes. That makes feasibility not an academic question, but the central one. The platforms Nigerian fintechs actually run on have no home in Nigeria. AWS, Microsoft Azure and Google Cloud do not operate a full data-centre region in the country. AWS has run a Local Zone in Lagos since January 2023, but a Local Zone is a latency extension of a parent region rather than a standalone one, and its parent is Cape Town. Azure’s nearest region is Johannesburg, as is Google Cloud’s. Equiano lands in Lagos, but a subsea cable delivers connectivity, not compute. For most institutions, then, compliance is not a configuration change. It means migrating live production workloads off the infrastructure on which a decade of Nigerian fintech has been built. That is not simply an ambitious migration programme. It is a race against physical constraints. Migrate them to what? Nigeria has roughly 50 to 56 megawatts of live commercial data-centre capacity, by the reckoning of trackers including TechCabal and ConnectingAfrica; counting announced and under-construction facilities, the installed figure
Don't miss out on breaking stories and in-depth articles.