Only 59% of banks, fintechs ready for data localisation

ABUJA, Nigeria — Only 59% of banks, fintechs and other financial institutions in Nigeria are ready to meet the January 1, 2027 deadline set by the Central Bank of Nigeria for hosting all payment data locally, according to a survey by the National Information Technology Development Agency.

The findings were released on Wednesday, October 28, at an Executive Regulatory Dialogue on the National Sovereign Cloud Initiative and data localisation, organised jointly by the agency and the Central Bank.

Of the 44 financial institutions that answered the readiness question, 26 had completed or were likely to complete the required actions before the deadline. Fifteen said completion was unlikely or very unlikely, and three could not assess their readiness. Twenty-two of the 44 had yet to begin implementation, with budgeting, contract negotiations and system migration among the outstanding tasks.

Among digital infrastructure providers, 79% said they were ready to take on new workloads from the financial sector. Dr Muhammad Lawal, Special Assistant on Policy to the agency’s Director-General, said the gap lies less in infrastructure than in deployment, contracting and migration.

The survey ran from October 13 to October 27 and drew responses from 47 financial institutions and 42 digital infrastructure providers. The number of responses varied across questions. Lawal said the findings were self-reported, anonymised and aggregated, and did not amount to a compliance assessment. Respondents called for stronger coordination among the Central Bank, the agency and the Nigeria Data Protection Commission, as well as access to reliable local infrastructure.

Dr Rakiya Yusuf, Deputy Governor for Financial System Stability at the Central Bank, said institutions must store and manage critical payment transaction data within Nigeria. She said the January 2027 deadline is meant to strengthen regulatory visibility, improve resilience and safeguard critical financial data. She cautioned, however, that local storage alone does not guarantee security, and that institutions need strong cybersecurity, business continuity, disaster recovery and risk-management arrangements. She also said institutions would remain accountable for risks arising from their relationships with cloud and other third-party technology providers.

The Director-General of the agency, Kashifu Inuwa Abdullahi, said the Nigerian Sovereign Cloud Initiative is meant to build domestic capacity for critical technologies and infrastructure. He said Nigerian companies spend more than $850 million a year on cloud services, and that developing local capacity could create jobs, keep more economic value in the country and reduce exposure to external disruptions. He linked the initiative to the Federal Government’s Nigeria First policy, and cited the 2024 submarine cable disruptions as an example of the risks of depending on infrastructure outside the country’s control.

The Central Bank’s directive requires banks, fintech firms, mobile money operators and other payment service providers to store all payment transaction data generated within Nigeria on local servers. The directive was contained in a circular issued on Monday, signed by the Director of the Payments System Supervision Department, Rakiya O. Yusuf, and it requires full compliance by January 1, 2027.