CBN Data Localisation Directive Triggers Multi-Billion Naira Infrastructure Push

A sweeping Central Bank directive requiring all payment transaction data to be stored within national borders by January 1, 2027, is triggering a multi-billion naira infrastructure push and laying bare stark operational divides across the financial ecosystem. A regulatory clock is ticking loudly across West Africa’s largest fintech hub. Under……

A sweeping Central Bank directive requiring all payment transaction data to be stored within national borders by January 1, 2027, is triggering a multi-billion naira infrastructure push and laying bare stark operational divides across the financial ecosystem.

A regulatory clock is ticking loudly across West Africa’s largest fintech hub. Under a Central Bank of Nigeria (CBN) directive, all financial institutions, payment processors, and fintech platforms must ensure that payment transaction data generated in Nigeria is fully stored and managed locally by January 1, 2027.

In alignment with the Nigeria Data Protection Act, 2023, the regulation aims to establish national data sovereignty, safeguard consumer privacy, and grant local law enforcement and regulators timely access to critical financial records.

However, impact evaluations from PwC (CBN Data Localisation and Market Structure Rules) and KPMG (CBN’s Data Localisation Directive: Positioning Nigerian Data Centres for Financial Sector Mandates) reveal that meeting this mandate requires far more than moving a few servers—it demands a fundamental re-engineering of Nigeria’s technological backbone.

TVC News reports that on June 15, 2026, the Central Bank of Nigeria issued circular PSS/DIR/PUB/CIR/001/004, signed by the Director of its Payments System Supervision Department, Dr Rakiya Yusuf, directing financial institutions to localise payment data. The circular mandates data localisation. It requires that all payment transaction data generated in Nigeria be “stored and managed within Nigeria” by January 1, 2027.

The directive arrives amidst unprecedented growth in Nigeria’s digital financial transactions. According to data highlighted by KPMG, the NIBSS Instant Payment platform processed 120% more transaction volume between 2022 and 2024, reaching a record 11.2 billion transactions in 2024 alone. Furthermore, regulations mandate a 5-year retention period for customer and transaction records.

This massive volume of transaction records represents an unprecedented commercial windfall for domestic colocation and enterprise data centre operators. As financial institutions migrate workloads onshore to meet the 2027 deadline, demand for local server racks, cloud storage, and high-speed network connectivity is surging.

This surge in localised data storage presents an unprecedented commercial opportunity for domestic colocation and enterprise data centre operators. In its industry assessment, KPMG Tech Risk notes, “The CBN’s payment data localisation directive creates a significant opportunity for Nigerian data center operators. As financial institutions migrate payment transaction workloads to locally hosted infrastructure by January 2027, providers must demonstrate strong infrastructure, cybersecurity, and regulatory compliance.”

PwC similarly points out that while compliance demands capital outlay, the regulation creates a major structural upside for the broader tech ecosystem: “Sustained, regulation-driven demand for compliant hosting could accelerate investment in domestic data centres and warehousing, which may benefit the wider digital economy.”

Despite the long-term infrastructure benefits, PwC warns that the transition introduces severe asymmetric financial pressures across the market, favouring established incumbents over emerging fintechs[3]. In their analysis, PwC said, “For fintechs and smaller operators reliant on global cloud providers for affordable infrastructure, this is likely to be costly. The investment needed to match the reliability, compliance standards, and service levels of global hyperscalers requires capital outlay that smaller balance sheets may struggle to absorb, potentially strengthening the position of larger, better-funded incumbents who can more easily afford local hosting.”

Even as demand shifts onshore, KPMG’s Tech Risk evaluation flags six critical operational areas where domestic data centre operators face significant readiness gaps that must be remediated to meet financial sector standards:

Infrastructure Resilience: Overcoming “insufficient power, cooling, and network redundancy to support uninterrupted operation of mission-critical financial workloads.”

Security & Compliance Maturity: Closing “gaps in physical security, cybersecurity controls, governance frameworks, and audit readiness required for hosting regulated financial data.”

Capacity & Scalability: Expanding “limited compute, storage, rack space, and facility capacity to accommodate increased demand from localised banking and payment system workloads.”

Disaster Recovery & Business Continuity: Fixing “inadequate backup infrastructure, recovery capabilities, and geographic resilience to meet financial sector recovery expectations.”

Operational Excellence: Building mature “monitoring, automation, incident management, and operational processes needed for enterprise-grade service delivery.”

Skills & Capability: Resolving “shortages in specialised technical expertise required to operate and maintain financial-services-class infrastructure.”

Perhaps the most critical warning highlighted in PwC’s study is the technical distinction between physical database placement and genuine, full-stack data localisation. PwC emphasised, “Hosting a primary database in Nigeria does not, on its own, demonstrate compliance. An institution may not have complied if backups, disaster-recovery replicas, analytics extracts, logs, test environments or third-party copies of payment transaction data remain offshore.”

Furthermore, PwC cautions that hastily relocating disaster recovery (DR) sites locally could inadvertently compromise systemic resilience if poorly architected. “Moving both primary and recovery environments into Nigeria without reconsidering their design could reduce geographic separation and increase exposure to a common infrastructure, location or provider failure. An institution could meet the localisation requirement but weaken the resilience of its payment operations,” said PwC.

To demonstrate compliance to the CBN, institutions will need to produce a comprehensive technical evidence pack, including “data-flow and data-lineage maps,” inventories of confirmed hosting locations, cloud configuration logs, and certified “evidence of the repatriation or deletion of offshore copies.”

As the January 1, 2027 deadline approaches, both consulting firms stress that financial institutions must act early to align technology architecture with regulatory expectations.

Concluding its assessment, PwC observed, “The direction of the Circular is constructive. Its success will depend on three things: credible compliance, demonstrated through clear technical evidence rather than location alone; payment services that remain reliable throughout and after the transition; and a competitive, sustainable financial industry that can continue to invest and innovate.”

Get a curated selection of the latest Nigeria and global news, right in your email.