The CBN’s January 2027 deadline is not just a test of where payment records are stored. It is a test of whether domestic infrastructure can protect them.
In June, during a visit to Lagos, I asked the chief technology officer of a Nigerian bank a simple question: where does your payment data actually live? His answer was straightforward: in a cloud region outside Nigeria.
That was not necessarily a poor choice. Overseas cloud regions can offer mature security controls, scalable capacity and resilience. But on 15 June 2026, the Central Bank of Nigeria (CBN) directed financial institutions and payment participants to ensure that transaction data generated in Nigeria is stored and managed in Nigeria. Compliance is required by 1 January 2027, a deadline the CBN reaffirmed in October.
The aim is understandable: greater control over a payment system central to daily economic life. Yet, moving data across a border does not automatically make it safer. Nigeria must prove that the infrastructure receiving it is secure, resilient and independently verifiable.
Beyond the location of a database
The directive covers banks, mobile-money operators, payment processors and other licensed participants. Its crucial words are ‘stored and managed’. A payment generates more than one record: primary databases, backups, transaction logs, fraud-monitoring systems, analytics services and audit trails may all handle related information.
At an October industry roundtable, the CBN reportedly emphasised logs, metadata and supporting systems, and recommended auditing and classifying data before migration, testing and independent verification. That is the right approach. Moving the primary database locally while leaving critical copies or processes offshore may not answer the regulator’s question.
What assurance actually requires
In data-centre assurance, I have supported audits for regulated organisations and helped demonstrate how facilities safeguard customer workloads. The recurring lesson is that a cloud-region name is a promise; documented evidence makes it credible.
Behind every cloud service are buildings, power systems, cooling equipment, connectivity, access controls, staff and subcontractors. Institutions need to ask: who can access the facility or administer the system? What happens during an outage? Can an independent auditor inspect the controls and test the supporting evidence?
Europe’s Digital Operational Resilience Act offers a useful comparison. Financial-sector technology contracts must identify relevant service and data locations and, for critical or important functions, provide substantial audit and inspection rights. Nigeria’s payment-data rule is more location-specific, but the assurance principle remains: the new address must come with proof.
An economic opportunity, with real risks
The stakes are substantial. NIBSS figures reported by BusinessDay put Nigerian instant-payment transactions at approximately ?1.07 quadrillion in 2024. Payment infrastructure is therefore essential to households, businesses and economic confidence.
Localisation could generate sustained demand for Nigerian data centres, engineers, cybersecurity specialists, independent auditors and domestic suppliers. It could also create a case for investment in additional facilities and digital skills.
But localisation can introduce new concentrations of risk. Unreliable electricity, inadequate cooling, limited fibre-route diversity and poorly separated recovery sites can undermine availability. A backup facility exposed to the same power or connectivity failure is not meaningful resilience. Government, operators and investors must expand capacity without lowering standards.
Five questions institutions must answer
First, where does payment data travel? Map production systems, replicas, backups, logs, testing environments and third-party services, rather than relying on a single hosting declaration.
Second, what does ‘managed’ mean? Document privileged access, remote support, subcontractors and administrative responsibilities. Seek written guidance from the CBN where interpretation remains uncertain.
Third, can facilities withstand disruption? Evaluate power, cooling, network diversity, incident response and geographically separated recovery arrangements.
Fourth, what evidence supports the claims? Obtain independent assurance reports, physical-security documentation, supplier disclosures and enforceable inspection rights. Certifications matter, but they should not replace an assessment of the actual operating environment.
Fifth, who verifies the outcome? Migration teams should test continuity and data integrity, while an independent assurance function examines compliance. A hurried transition that disrupts payments would undermine the policy’s purpose.
Turn the deadline into a lasting standard.
Important questions still require clarity, including offshore processing, disaster-recovery copies and remote administration. Institutions must also consider Nigeria’s data protection obligations. These details matter when designing systems that will operate long after January 2027.
Nevertheless, sovereignty cannot be measured by geography alone. A payment record held domestically but exposed to weak security, poor recovery arrangements or limited oversight is not automatically safer.
The CBN deadline should become a catalyst for stronger national infrastructure and rigorous assurance. In June, I asked where a bank’s payment data lived. The better question for 2027 is whether Nigeria can prove that the data is safe where it lives.