Twenty-two of 44 financial institutions surveyed in Nigeria have yet to begin implementing measures to comply with the country’s data localisation requirements, raising concerns about readiness ahead of the January 1, 2027 deadline.
The findings show that while most institutions have identified the data and systems covered by the requirements, progress on securing budgets, contracting local providers and migrating systems remains slow, with just nine weeks left before the deadline.
The survey, presented by Muhammad Aminu Lawal, special assistant on digital transformation to the director-general of the National Information Technology Development Agency (NITDA), Kashifu Inuwa Abdullahi, found that 26 institutions, representing 59 percent, had completed the required actions or expected to do so by the deadline.
However, 15 institutions said they were unlikely or very unlikely to finish on time, while three could not assess their readiness.
The findings were presented at the Executive Regulatory Dialogue on NSCI Implementation and Data Localisation, convened by NITDA and the Central Bank of Nigeria (CBN) in Lagos. The meeting brought together regulators, financial sector executives, banks, fintech operators and technology service providers.
The presentation described the implementation gap in stark terms: ‘Half are still planning; 22 of 44 have not started implementing.’ It classified 59 percent of respondents as on track and 34 percent as at risk.
The survey was based on self-reported, anonymised and aggregated responses and was explicitly described as ‘not a compliance assessment’.
A breakdown of the findings shows that financial institutions have made more progress in identifying affected data and systems than in committing resources to meet the requirements.
While 70 percent of respondents had identified the data or systems covered by the rules, only 52 percent had mapped their hosting and administration arrangements.
Progress was considerably weaker at the execution stage. Just 25 percent had secured board or executive approval and a budget, 23 percent had contracted local providers, and only 18 percent had started migration or remediation.
‘Mapping is done; budgets, contracts and migration lag,’ Lawal said.
The figures suggest that identifying the systems affected by the requirements has not translated into the financial commitments and operational changes needed to complete implementation.
Regulatory uncertainty is also slowing preparations, with institutions seeking clarification on the scope of the requirements and what constitutes compliance.
Sixty-four percent of respondents wanted a definition of ‘payment transaction data’, while 38 percent sought clarity on what it means for data to be ‘stored and managed in Nigeria’.
Twenty-nine institutions said they depended on clarification, while half of respondents said they were proceeding based on working assumptions. Another 16 percent reported that material work was on hold pending further guidance.
The presentation identified a written clarification on the scope of the rules as a priority, alongside clearer transition milestones, an exceptions process and guidance on existing contracts.
The January deadline is therefore approaching as institutions contend with both implementation gaps and unanswered regulatory questions.
The survey presentation concluded that compliance was ‘within reach for about six in 10, not yet for the rest’, identifying regulatory clarity as a critical factor in determining whether institutions can complete the required work on time.
With budgets, provider contracts and migration still lagging behind initial planning, the remaining weeks will be crucial for financial institutions seeking to meet the deadline.