Only 59 per cent of banks, fintech companies and other financial institutions in Nigeria are ready to meet the January 1, 2027 deadline set by the Central Bank of Nigeria (CBN) for storing payment transaction data on local servers.
This was revealed in a survey conducted by the National Information Technology Development Agency (NITDA) and presented on Wednesday at a regulatory meeting organised by NITDA and the CBN on Nigeria’s data localisation policy and Sovereign Cloud Initiative.
The survey showed that 26 of the 44 financial institutions that answered questions on their readiness had completed or were likely to complete the necessary steps before the deadline.
However, 15 institutions said they were unlikely or very unlikely to meet the deadline, while three were unsure of their readiness.
NITDA identifies challenges
Dr Muhammad Lawal, Special Assistant on Policy to the Director-General of NITDA, said many financial institutions had yet to begin implementing the directive.
According to him, 22 of the 44 institutions surveyed had not started the process. Some were still working on their budgets, negotiating contracts or preparing to move their systems to local infrastructure.
Lawal said 79 per cent of the digital infrastructure providers surveyed were ready to support additional workloads from financial institutions.
He explained that the major challenge was therefore not simply the availability of local infrastructure but also the time needed for deployment, contract negotiations and system migration.
The survey received responses from 47 financial institutions and 42 digital infrastructure providers between October 13 and October 27. However, the number of responses differed across the questions asked.
NITDA said the findings were based on information provided by the respondents and were not an official assessment of compliance with the directive.
Lawal added that the initiative was designed to improve Nigeria’s control over critical digital infrastructure, strengthen data security and expand the country’s capacity to host important digital services.
He also called for better coordination among the CBN, NITDA and the Nigeria Data Protection Commission to support implementation.
CBN insists on local storage of payment data
In her keynote address, the CBN Deputy Governor for Financial System Stability, Dr Rakiya Yusuf, said financial institutions must ensure that critical payment transaction data are stored and managed within Nigeria in line with regulatory requirements.
She said the January 1, 2027 deadline was intended to improve regulatory oversight, strengthen the financial system and protect important financial data.
However, Yusuf warned that storing data locally would not automatically guarantee security.
She said financial institutions must also invest in cybersecurity, business continuity plans, disaster recovery systems and effective risk management.
The deputy governor added that banks and other financial institutions would remain responsible for risks arising from their relationships with cloud service providers and other technology companies.
She urged regulators, financial institutions and technology providers to work together to address implementation challenges without discouraging innovation or weakening the competitiveness of Nigeria’s financial sector.
NITDA highlights benefits of Nigerian Sovereign Cloud
The Director-General of NITDA, Kashifu Inuwa, said the Nigerian Sovereign Cloud Initiative was designed to strengthen the country’s control over its digital infrastructure and develop local capacity in critical technologies.
He said Nigerian companies spend more than $850 million annually on cloud services.
According to him, developing local cloud infrastructure could create jobs, keep more money within the Nigerian economy and reduce the country’s exposure to disruptions affecting digital infrastructure outside its control.
Inuwa said the initiative aligned with the Federal Government’s Nigeria First policy, which promotes local production, capacity development and economic value creation.
He explained that the policy was not intended to isolate Nigeria from global technology but to ensure that the country developed the capacity to support its own critical digital services.
He also cited the submarine cable disruptions in 2024 as an example of the risks associated with depending on digital infrastructure outside Nigeria.
Background to CBN directive
The CBN issued a directive requiring banks, fintech companies, mobile money operators and other payment service providers to store payment transaction data generated in Nigeria on local servers.
The directive is part of efforts to strengthen regulatory oversight, improve transparency and reduce risks in the country’s growing digital payments sector.
Under the directive, financial institutions and payment service providers handling transactions in Nigeria must ensure that locally generated payment data are stored and managed within the country in line with Nigerian data protection laws and regulations.
All affected institutions are expected to comply fully with the requirement by January 1, 2027.