Banks, Fintechs Face N1bn Fine for Exporting Payment Data Under New Bill

By Adedapo Adesanya

Banks, fintechs, and other financial institutions could face a minimum fine of N1 billion for transferring payment transaction data outside Nigeria under a proposed bill before the House of Representatives.

The bill also proposes a 10-year prison term and a minimum fine of N500 million for individuals who transfer strategic payment data outside the country without regulatory authorisation.

Sponsored by the member representing Surulere II Federal Constituency of Lagos State, Mr Lanre Okunlola, the proposed legislation seeks to establish the National Payment Data Protection and Sovereignty Commission to regulate and protect payment transaction data generated within Nigeria.

Titled A Bill for an Act to Establish the National Payment Data Protection and Sovereignty Commission, the proposed piece of legislation seeks to strengthen Nigeria’s control over its financial information infrastructure, address cybersecurity threats and reduce dependence on offshore payment data storage and processing facilities.

Introduced during a plenary session last week, the bill is expected to be debated by lawmakers in the coming weeks.

Under Section 22, any financial institution that fails to comply with the proposed data localisation requirements commits an offence and, upon conviction, faces a fine of not less than N1 billion, alongside additional daily penalties for continuing violations.

The provision would affect banks, fintech companies, payment service providers, switching companies and settlement system operators, which would be required to maintain their primary payment data infrastructure within Nigeria.

Section 9 of the bill stipulates that all payment transaction data generated within the country must be stored within Nigeria, while Section 10 requires domestic payment transactions to be processed through infrastructure physically located in the country.

The proposed legislation also seeks to restrict financial institutions from hosting their primary payment transaction data infrastructure abroad, except with the approval of the proposed Commission in conjunction with the Central Bank of Nigeria (CBN).

Under Section 8, payment transaction data generated within Nigeria would be classified as a “Strategic National Economic and Security Asset”.

The bill further proposes penalties for individuals who transfer such data outside the country without authorisation.

Section 23 provides that anyone who commits the offence would, upon conviction, be liable to imprisonment for a term not exceeding 10 years, a fine of not less than N500 million, or both.

However, the proposed legislation recognises the need for international financial transactions and provides a framework for authorised cross-border data transfers.

Section 18 prohibits the transfer of strategic payment data outside Nigeria without authorisation from the proposed Commission.

Section 19 provides that such approval may only be granted where the transfer is necessary for international settlement obligations, national security interests are protected, adequate safeguards are in place and approval has been obtained from the CBN.

On cybersecurity, the bill classifies payment transaction infrastructure as Critical National Information Infrastructure and empowers the proposed Commission to establish minimum security and resilience standards.

Recall that the CBN in June directed all commercial banks and fintech companies to domesticate their payment processing data within the country by 2027.

For years, several financial institutions have hosted critical customer and transaction data on foreign cloud servers, but under the new policy, all point-of-sale (PoS), web, and mobile transaction data must be stored and processed within local data centres.

This means banking institutions must now restructure their data architecture and invest significantly in local cloud infrastructure or partner with domestic data centre providers.

While the mandate raises immediate operational costs for startups, the apex bank maintains that keeping financial data within Nigerian borders is non-negotiable for safeguarding sovereignty and preventing capital flight.