CBN warns GTB, Access, Other Nigerian Banks as Deadline to Localise Payment Data in Nigeria Nears

• The CBN has fixed January 1, 2027, as the deadline for banks and other regulated financial institutions to store critical payment data in Nigeria
• The CBN warned that institutions that deliberately fail to comply with the policy will face sanctions
• Banks must also strengthen cybersecurity, disaster recovery and risk management to protect customers’ financial data

Legit.ng journalist Victor Enengedi has over a decade's experience covering energy, MSMEs, technology, banking and the economy.

The Central Bank of Nigeria (CBN) has reaffirmed January 1, 2027, as the deadline for banks and other regulated financial institutions to store critical payment transaction data within the country, warning that violations will attract sanctions.

CBN Deputy Governor for Financial System Stability, Lamido Abubakar Yuguda, disclosed this at an executive regulatory dialogue organised by the CBN and the National Information Technology Development Agency (NITDA) in Lagos.

The meeting focused on the National Sovereign Cloud Initiative (NSCI) and data localisation, amid growing concerns about the security of Nigeria's digital financial infrastructure.

CBN warns institutions against non-compliance

Yuguda said the deadline remained unchanged and warned that deliberate attempts to frustrate implementation would not be tolerated.

He explained that regulated institutions must ensure critical payment transaction data is stored and managed within Nigeria in line with existing regulatory requirements.

According to him, the policy is designed to improve regulatory oversight, strengthen the resilience of the financial system and protect sensitive financial information.

He noted that Nigeria's financial system increasingly depends on digital infrastructure as electronic payments, digital banking and financial technology services expand.

The deputy governor stressed that protecting the systems supporting these services was essential to maintaining financial stability and public confidence.

Cloud computing presents opportunities and risks

Yuguda acknowledged that cloud computing could help financial institutions improve efficiency, flexibility and innovation. However, he warned that increased reliance on cloud services also presents challenges involving cybersecurity, data protection and operational resilience.

He added that dependence on third-party technology providers could expose financial institutions to additional risks if not properly managed.

The deputy governor described the National Sovereign Cloud Initiative as an opportunity to strengthen Nigeria's digital resilience, build local technological capacity and improve the protection of critical financial data.

The initiative is expected to support efforts to keep sensitive information under appropriate domestic control while strengthening the country's digital infrastructure.

Banks must strengthen cybersecurity measures

Despite the emphasis on data localisation, Yuguda cautioned that storing information within Nigeria would not, on its own, guarantee security.

He said financial institutions must complement the policy with strong cybersecurity systems, business continuity plans, disaster recovery arrangements and effective risk-management practices.

He also stressed that banks and other regulated institutions would remain responsible for managing risks arising from relationships with cloud service providers and other technology partners.

The CBN's position signals continued regulatory pressure on financial institutions to prepare for the January 2027 deadline while ensuring that their technology systems meet broader security and resilience requirements.