Data localisation is a policy that attracts broad support in principle but raises significant questions when it comes to implementation.
On June 15, 2026, the Central Bank of Nigeria issued circular PSS/DIR/PUB/CIR/001/004, signed by the Director of the Payments System Supervision Department, Dr Rakiya Yusuf, directing financial institutions to localise payment data.
The circular signals a shift towards treating the country’s largest fintech companies as critical financial infrastructure rather than simply startups. Its most demanding requirement is the localisation of payment data.
Under the policy, all payment transaction data generated in Nigeria must be stored and managed within the country by January 1, 2027.
The requirement, according to interpretations by law firms examining the circular, could cover transaction databases, settlement and reconciliation records, switching logs, merchant and issuer records, audit trails, as well as backups and disaster-recovery systems.
The circular operates alongside the Nigeria Data Protection Act 2023, meaning affected institutions must comply with both regulatory frameworks.
However, the CBN circular does not establish specific penalties for non-compliance. Instead, it provides for discretionary supervisory sanctions.
The only quantified monetary penalty within the surrounding framework comes under the Nigeria Data Protection Act, which provides for a penalty of up to ₦10 million or two per cent of annual gross revenue.
This means companies are being given a firm compliance deadline without a fully defined standard or a specific penalty structure under the circular itself.
The Case for Data Localisation
The underlying principle of the policy has considerable merit.
Payment data is a strategic national asset, and a regulator overseeing a payments ecosystem worth trillions of naira should not have to depend on foreign courts, foreign cloud providers or cooperation from other governments to obtain information required for regulatory oversight.
Financial sovereignty, therefore, does not necessarily amount to protectionism but can form part of prudent financial regulation.
There is also a macroeconomic argument for keeping payment infrastructure and associated spending within Nigeria.
Technext estimates that Nigerian companies spend approximately $850 million annually on foreign cloud providers.
The expenditure is made in scarce foreign currency, which has become considerably more expensive following the naira’s loss of roughly 70 per cent of its value between 2020 and 2024.
Keeping more of that spending within Nigeria is therefore a legitimate economic objective, while naira-denominated hosting could provide a hedge against foreign-exchange pressures.
Infrastructure Remains the Major Concern
The main concern surrounding the CBN’s policy is not its objective but the timing and practical requirements for implementation.
The regulator has given the industry until January 2027 to achieve full localisation, roughly six months after the circular was issued.
The concern is whether Nigeria currently has the infrastructure, cloud ecosystem and operational capacity required to support such a transition.
The policy effectively requires financial institutions to move onto infrastructure that is still being developed.
There is already a precedent for the difficulty of implementing data localisation within an aggressive timeframe.
CBN’s Growing Oversight of Fintechs
The latest circular also forms part of a wider pattern of tighter CBN regulation of the fintech industry over the past two years.
In November 2023, the Bank introduced stricter Know Your Customer requirements, which were widely viewed as affecting fintech onboarding.
It later revised regulations covering international money transfer operators, increasing the minimum capital requirement to US$1 million, introducing a ₦10 million non-refundable licensing fee, and preventing fintech companies from holding such licences.
Then, on April 29, 2024, the CBN directed five major fintech companies, OPay, Moniepoint, Kuda, PalmPay and Paga, to stop onboarding new customers.
The directive came two days after the Economic and Financial Crimes Commission froze 1,146 accounts linked to alleged illicit foreign-exchange activities.
The issue is not whether the CBN should regulate fintech companies.
Rather, concerns have centred on the regulator’s repeated use of strict deadlines and broad regulatory measures before fully addressing the operational consequences.
The latest data localisation requirement moves that approach from business processes into the underlying infrastructure supporting the fintech industry.
As a result, whether the policy can realistically be implemented has become a central question.
Major Cloud Platforms Have Limited Local Presence
A significant challenge is that the infrastructure on which many Nigerian fintech companies operate is not physically based in Nigeria.
Amazon Web Services, Microsoft Azure and Google Cloud do not currently operate full data-centre regions in the country.
AWS has operated a Local Zone in Lagos since January 2023, but a Local Zone is an extension of a parent region rather than a standalone AWS region. Its parent region is in Cape Town.
Microsoft Azure and Google Cloud have their nearest African regions in Johannesburg.
The Equiano subsea cable also lands in Lagos, but connectivity infrastructure does not provide computing capacity.
For many institutions, therefore, complying with the CBN requirement would involve migrating live production workloads from the infrastructure on which much of Nigeria’s fintech industry has been built.
That makes the exercise more than a simple configuration change.
Does Nigeria Have Enough Data-Centre Capacity?
Nigeria currently has an estimated 50 to 56 megawatts of operational commercial data-centre capacity, according to industry trackers including TechCabal and ConnectingAfrica.
When announced and under-construction facilities are included, the figure rises to approximately 124 to 137 megawatts.
These figures represent different measurements and are sometimes combined despite referring to different stages of capacity.
By comparison, South Africa has approximately 355 megawatts across more than 50 facilities.
That scale is one reason AWS, Microsoft and Google have established their African cloud regions there.
The current Nigerian data-centre landscape also highlights the infrastructure challenge.
Rack Centre operates a 13.5-megawatt off-grid gas plant in Lagos and added a 12-megawatt hall in March 2025.
Open Access Data Centres has committed more than $240 million to reach 24 megawatts by 2027, although only its first 12-megawatt phase is expected in the near term.
Kasi Cloud has a campus planned for 100 megawatts at full development, with only its first phase currently operational.
Equinix, which acquired MainOne for $320 million in 2022, has a 20-megawatt facility planned for Alaro City.
Meanwhile, Airtel’s Nxtra is developing 38 megawatts of capacity in Eko Atlantic.
Many of these projects are expected to mature during or after 2027, placing their full availability around or beyond the CBN’s localisation deadline.
None has yet been tested at the scale required to operate a national payments switching system.
There is also a difference in commercial pricing.
International hyperscalers have historically provided startups with free tiers and credits, while local infrastructure providers generally charge commercial rates from the beginning.
Industry Operators Offer Different Views
Data-centre operators themselves have different views about Nigeria’s readiness.
The chief executive of Open Access Data Centres has argued that physical capacity is not the main constraint and that institutions have no reason to delay their migration.
However, a co-founder of Kasi Cloud has questioned whether Nigeria has sufficient cloud computing and storage infrastructure to accommodate a migration of this scale.
The chief technology officer of fintech company Rank has similarly identified processing capacity, rather than simply physical data-centre space, as a concern.
The difference matters because having enough physical space for servers is not the same thing as having sufficient computing infrastructure to operate critical financial services.
Data Centres Are Not Automatically Cloud Platforms
The policy also risks treating data-centre capacity and cloud infrastructure as though they are interchangeable.
They are not.
A building filled with servers does not automatically provide the managed cloud services required to operate high-availability financial workloads at national scale.
The critical question is whether Nigeria has enough mature cloud platforms with reliable storage, networking, orchestration and operational resilience to absorb the migration without affecting service reliability.
That capacity has yet to be demonstrated at the required scale.
Huawei Provides a Local Hyperscale Option
Huawei represents a notable exception.
In December 2024, the company launched what it described as Nigeria’s first hyperscale cloud region, offering more than 30 managed cloud services.
It has also announced another $400 million off-grid facility in Ogun State.
If any provider is currently positioned to meet the CBN’s localisation objective at scale, Huawei is among the strongest candidates.
However, this creates another consideration.
A policy introduced partly in the name of data sovereignty could ultimately shift Nigeria’s payment infrastructure away from American cloud providers and towards a Chinese provider.
Data localisation would therefore not necessarily eliminate dependence on foreign infrastructure. Instead, it could change which foreign infrastructure Nigeria depends upon.
AWS Local Zone Has Its Own Limitations
AWS presents a different situation.
Its Lagos Local Zone allows certain workloads and data to remain within Nigeria, but it is not a complete AWS region.
The control plane remains in Cape Town, while several core managed services, including Amazon RDS, are unavailable locally.
As a result, whether AWS infrastructure satisfies the requirement that payment data must be both “stored and managed” within Nigeria depends on how the CBN interprets that requirement.
The circular does not clearly define the phrase.
That leaves one of the most obvious compliance pathways dependent on an issue the policy itself has not fully clarified.
Electricity Creates Another Challenge
Power supply presents another major obstacle.
Nigeria’s national electricity grid supplies approximately 5,000 to 6,000 megawatts to a population of more than 230 million people.
Commercial data centres therefore rely heavily on diesel generators and other backup systems to maintain operations during power interruptions.
These alternative power sources can cost two or three times as much as grid electricity, particularly as fuel costs continue to rise.
This creates a difficult situation for a policy that aims to strengthen resilience.
Critical payment infrastructure could be moved from globally distributed cloud platforms to domestic infrastructure operating within a power system that is itself less reliable.
Data Centres Are Concentrated in Lagos
The geographical distribution of Nigeria’s data-centre infrastructure also creates concerns.
Approximately 14 of the country’s 17 operational data centres are located in Lagos.
Many fintech companies currently use geographically separated cloud regions to provide disaster recovery and failover.
If critical infrastructure is concentrated within one metropolitan area while disaster-recovery copies are prohibited from being stored abroad, companies could lose some of the geographical redundancy that currently protects their systems.
This creates a situation where the infrastructure is being localised at the same time that its geographical safety net becomes narrower.
Banks Are Better Positioned to Comply
Large Tier-1 banks are likely to be better positioned to meet the localisation requirement.
Major banks have operated their own data centres for decades and already employ systems engineers, procurement teams, security specialists and round-the-clock operational staff required to maintain mission-critical infrastructure.
The capital expenditure involved would be significant, but it would be an established type of investment for these institutions.
The situation is different for fintech companies.
Public Cloud Changed the Fintech Model
One of the major technological developments of the past decade was that companies no longer needed to own their computing infrastructure.
Public cloud services converted servers from a capital expenditure into an operating expense.
Startups could rent computing power rather than purchase server racks, maintain hardware or establish their own disaster-recovery facilities.
Modern fintech companies also depend on managed databases, object storage, message queues, identity services and automated scaling systems.
These services cannot always be replaced simply by using local colocation facilities.
The cloud model reduced barriers to entry and allowed small engineering teams to compete with much larger institutions.
Localisation Could Increase Costs for Fintechs
The new requirement could reverse some of those advantages.
Where mature managed cloud services are unavailable locally, fintech companies could be forced to purchase or colocate physical infrastructure, acquire hardware, establish redundancy, employ operations teams and pay for backup power.
These are capabilities that many cloud-native fintech companies were deliberately designed not to maintain themselves.
The cost of compliance would therefore not be distributed equally.
For an established bank, localisation may represent a significant infrastructure investment.
For a fintech, it could require a fundamental change to its operating model.
A policy designed to strengthen Nigeria’s payments infrastructure could therefore raise barriers to entry, reduce competition and reinforce the position of established financial institutions.
A startup forced to rapidly establish its own infrastructure under a regulatory deadline could potentially introduce greater operational and security risks than the mature and geographically distributed infrastructure it is replacing.
The Policy Also Affects Nigeria’s Digital Economy
The implications extend beyond banking and payments.
Nigeria’s digital economy depends heavily on the infrastructure supporting fintech companies and other technology businesses.
In early July, the Ministry of Communications, Innovation and Digital Economy emphasised the need for coordinated policymaking, broad consultation and regulatory certainty when dealing with cross-cutting digital-economy issues.
The CBN’s data localisation requirement demonstrates why such coordination is important.
Compliance Requirements Remain Unclear
Even companies with sufficient capital and infrastructure face another challenge: the circular does not provide enough technical detail about what full compliance actually means.
It establishes a deadline and a destination but leaves many engineering questions unanswered.
For example, it does not clearly define which categories of data fall within the requirement.
While “payment transaction data” can be interpreted broadly, companies still need to determine whether customer identifiers, device information, internal risk scores and archived logs fall within the scope.
The circular also does not specify recovery-time or recovery-point objectives.
Those requirements are important because they determine the scale and capability required for an in-country disaster-recovery facility.
The policy also does not establish a specific audit schedule or identify who would conduct compliance audits.
Another unresolved issue is whether a synchronised copy of data stored within Nigeria would satisfy the requirement or whether the primary system itself must be physically located within the country.
The difference between those two interpretations could determine whether companies face a manageable migration or need to completely rebuild their infrastructure.
Critical Infrastructure Supervision Also Needs Clarity
The circular also indicates that the largest fintech companies will be supervised as critical financial infrastructure.
However, it does not clearly state what criteria determine whether a fintech is large enough to fall within that category.
There is also no specific penalty schedule beyond the reference to discretionary supervisory sanctions.
This creates uncertainty for companies trying to determine exactly what they must build and how much they must spend to comply.
Companies that cannot clearly determine the regulatory standard may either build infrastructure against the strictest possible interpretation or risk falling short.
The cost of that uncertainty is likely to be greater for startups and mid-sized companies that cannot afford extensive specialist regulatory advice.
India Offers a Relevant Precedent
Nigeria is not the first country to introduce payment data localisation.
In April 2018, the Reserve Bank of India directed payment operators to store payment data locally within six months.
The deadline proved difficult to meet.
Major card networks did not achieve full compliance until 2022, after the RBI had barred non-compliant networks from onboarding new customers.
A six-month requirement ultimately took almost four years to enforce.
One of the most important lessons from India’s experience was the time required to clarify what compliance actually meant.
Localisation Did Not Stop India’s Innovation
India’s experience also demonstrates that data localisation does not necessarily prevent domestic innovation.
The country’s home-grown payments ecosystem continued expanding during the transition.
At the same time, there is limited evidence that localisation alone significantly reduced fraud or automatically improved regulators’ access to information.
Those outcomes depend heavily on governance, legal cooperation and data integrity rather than simply the physical location of servers.
The lesson for Nigeria is therefore not that data localisation cannot work.
It is that unrealistic deadlines can create serious implementation problems.
Nigeria is also starting from a less developed infrastructure base than India had when it introduced its policy.
A Phased Approach Could Work Better
The objective of Nigeria’s policy is not necessarily the problem. The sequencing is.
The CBN could replace the current deadline with phased milestones over 18 to 24 months.
The process could begin with data mapping, followed by primary storage, disaster recovery and eventually processing.
Such a timeline would give infrastructure providers the opportunity to build, test and prove their systems while financial institutions migrate gradually.
The CBN would also need to resolve one of the circular’s most important ambiguities: whether the primary system must be located within Nigeria or whether a synchronised domestic copy would satisfy the requirement.
That distinction would determine whether companies can make a manageable migration or would have to completely rebuild their infrastructure.
Local Hyperscale Infrastructure Could Provide a Solution
A more sustainable approach would be to create conditions that encourage major cloud providers to establish local regions or mirrored infrastructure in Nigeria.
That could give the CBN the regulatory access it wants while allowing financial institutions to migrate according to infrastructure readiness rather than an inflexible deadline.
The obligations should also reflect the size and capacity of individual institutions.
A two-year-old fintech should not necessarily face exactly the same infrastructure burden as a Tier-1 bank.
The policy could also be accompanied by incentives for local hosting so that compliance does not make it prohibitively expensive for smaller technology companies to operate.
At the same time, data localisation would need to be accompanied by investment in its underlying requirements, including reliable electricity, geographically distributed data-centre capacity and a mature domestic cloud ecosystem.
Regulation alone cannot create the infrastructure required to support it.
Nigeria’s objective of keeping its payment data within the country is understandable, but data sovereignty depends on infrastructure as much as regulation.
The destination may be right, but the sequence remains a concern.
Build the infrastructure first, then move the traffic.
