CBN Insists January 1, 2027 Deadline for Data Localisation Directive Remains

By Adedapo Adesanya

The Central Bank of Nigeria (CBN) has reiterated that its January 1, 2027, deadline for implementing the data localisation directive remains unchanged, warning financial institutions and payment service providers against expecting an extension or phased compliance.

The apex bank disclosed this in a Frequently Asked Questions and Answers (FAQs) document on the directive released on Wednesday.

It said compliance with the directive was a regulatory requirement for Deposit Money Banks, Microfinance Banks, Mobile Money Operators, switching and processing companies, payment terminal service providers, payment solution service providers, super agents and other licensed operators in Nigeria’s payments ecosystem.

The CBN stated that there would be no automatic grace period, transitional arrangement or formal exemption for legacy systems beyond the deadline.

It acknowledged that regulated institutions were at different stages of readiness, with implementation challenges varying according to their sizes, business models, technology infrastructure and existing offshore hosting arrangements.

However, it maintained that the January 1, 2027 implementation date remained in force, adding that its regulatory approach would follow a strict enforcement framework.

The directive follows a circular issued by the CBN on June 15, 2026, introducing data localisation and market structure requirements aimed at protecting the integrity of Nigeria’s payments system and ensuring that payment transaction data generated within the country is stored locally.

Business Post reports that lawmakers are also pursuing a bill to this effect, which could see fintechs and banks face up to N1 billion in fines.

Clarifying the scope of the requirements, the apex bank said they covered payment transaction data and supporting information needed for processing, settlement, reconciliation, monitoring, reporting, auditing, investigations and dispute resolution.

These include production databases, transaction logs, settlement records, audit trails, backup repositories, disaster recovery systems, archives, data warehouses and security logs.

On cross-border transactions, the apex bank said data required by international card schemes, correspondent banks, remittance partners, payment networks and SWIFT infrastructure could still be transmitted where necessary to complete transactions.

However, it stressed that such information must be stored and managed within Nigeria, while data shared with international partners for fraud investigations, chargebacks and dispute resolution must comply with applicable legal, regulatory and security requirements.