CBN Data Localisation Checklist: What Fintechs Must Move Before January 2027

On 15 June 2026 the Central Bank of Nigeria issued a circular that changes where a large part of the country's financial data is allowed to live. From 1 January 2027, payment transaction data generated in Nigeria has to be stored and managed in Nigeria. If you process payments in Nigeria, the question is no longer whether this applies to you but what, precisely, has to move, and in what order.

This article is the working checklist. It states what the circular says, what it does not say, and the exercise a payments business can run this week to find out how big its own migration is.

What the circular says

The document is circular PSS/DIR/PUB/CIR/001/004, issued by the CBN's Payments System Supervision Department and signed by its director. Its operative sentence on data, as quoted by Nairametrics, the Nigerian Tribune and others on the day it was issued, reads:

"All Financial Institutions and participants facilitating payments within Nigeria shall ensure that payments transaction data generated within Nigeria are stored and managed in Nigeria in accordance with data protection laws and regulations applicable in Nigeria."

The same circular introduces market-structure rules, monthly market-share returns and beneficial-ownership disclosure, with a separate compliance date of 31 December 2026. Those are outside this article. On enforcement it says only that the CBN "shall monitor compliance with the provisions of this Circular and may, where necessary, impose supervisory sanctions". There is no penalty schedule in it.

Who is in scope

The addressee list, as rendered by the law firm Aluko & Oyebode and by ThisDay, is deposit money banks, microfinance banks, mobile money operators, switching and processing companies, payment terminal service providers, payment solution service providers, super agents, and other licensed operators in the Nigerian payments ecosystem.

Note that the operative sentence is wider than the list: it binds "all financial institutions and participants facilitating payments within Nigeria". A fintech that is not itself licensed but sits in a payment flow through a licensed partner should read that phrase as applying to it in practice.

What the circular does not say

This is the part most write-ups skip, and it decides the size of your project.

• It does not define "payment transaction data". Pavestones, writing for Legal500, notes that "the circular does not formally define this term". Every list you will see of what it covers (payer and beneficiary details, amounts, references, authentication records, settlement and routing information, transaction logs) is a law firm's reading, not the regulator's text.
• It does not say whether backups, disaster-recovery copies or logs are included. Aluko & Oyebode say further guidance "may be useful" on "offshore disaster-recovery infrastructure". Their practical advice nonetheless is to map whether any payment transaction data is "stored, processed, backed up or managed outside Nigeria", which is the prudent reading: assume copies count until told otherwise.
• It does not say whether a foreign cloud provider's Nigerian zone satisfies it. The same firm notes the circular "does not expressly state" this. A CBN representative at a September industry event, as reported by TechCabal, said the objective is local oversight of core financial records rather than severing links with global providers. That is a reported position, not a published rule.
• It does not define "managed". Whether administration, access and support from outside Nigeria counts as managing the data abroad is unanswered. Femi Olugbesan of Descasio put the operational point to TechCabal: "Changing the address of the data is not the same as having sovereignty over it."

In late September the Committee of Bank CIOs, through FCMB's chief technology officer, said publicly that it had not been able to get clarity from the CBN on these questions since June. So the gaps above are not an artefact of our reading. They are open.

The migration checklist

Work the list in order. Each step narrows the next.

1. List every system that generates or touches a Nigerian payment

Card and transfer processing, wallet ledgers, settlement and reconciliation, dispute handling, fraud scoring, merchant and issuer records. Include systems run by vendors on your behalf. The circular binds the participant, not the software supplier.

2. Find every copy

Primary databases are rarely the problem. Read replicas, nightly backups, disaster-recovery sites, log pipelines, analytics and reporting warehouses, data science extracts, customer-support tooling that exports transaction detail, and third-party observability services all hold payment data. Backups are where most of these projects find their surprise. Aluko & Oyebode's data-flow mapping step exists for exactly this reason.

3. Split what has to move from what has to stop leaving

Some data lives abroad because a system was built there and can be re-homed. Some leaves Nigeria continuously because of an integration, a monitoring agent, a global vendor's architecture. The first is a migration. The second is a redesign, and it takes longer, so find it early.

4. Decide what "in Nigeria" will mean for you

Floor space is not the constraint. Johnson Agogbua of Kasi Cloud told TechCabal that "physical data centre capacity is not the problem". The constraint is having a platform you can provision on, with storage, backups and administration that stay inside the jurisdiction, and an operating model your team can run. Olugbesan again: "Data can be copied. The difficult part is moving the operating model around it without breaking the business."

5. Ask each provider four questions, in writing

• Where, physically, is the primary data stored?
• Where are the backups and the disaster-recovery copies?
• Where is the platform administered from, and who can access the data?
• What will you attest to, and on what date?

Keep the answers. If the CBN's monitoring ever asks how you satisfied the circular, this file is the answer.

6. Work the calendar backwards from 1 January

Payments operators who have looked at the load call the timeline short. Hakeem Adeniji-Adele of eTranzact told ThisDay it "is quite short, simply because of the amount of load that needs to be moved". No extension has been announced. Plan for the date that is published, and treat any later relief as a bonus.

7. Check the other regimes at the same time

Two more rules sit beside this one. The Nigeria Data Protection Act 2023 and the NDPC's implementation directive govern personal data and its transfer abroad regardless of the CBN circular (we set out what that Act does and does not require in a separate article). And from October 2026 NITDA's national cloud certification register, signed into effect on 4 August, is intended to decide which cloud and data-centre providers may handle regulated data. TechCabal's summary of the overlap is the right one: where both regimes apply, comply with both.

Where AFRICLOUD fits

We run a Lagos region, so compute and storage for Nigerian workloads can stay on Nigerian soil, with backups in the same jurisdiction. That answers questions one and two on the provider list above; it does not by itself answer the rest, and residency is not compliance. We are an infrastructure provider, not a CBN-licensed operator and not your counsel. Specific compliance requires individual legal assessment.

This article describes publicly reported regulatory requirements and named professional opinions, with sources, and is not legal advice. The circular itself was not available for direct download at the time of writing; quotations are as reported by the outlets named.

Sources

• Nairametrics, CBN mandates banks, fintechs to store payment data in Nigeria (15 June 2026): nairametrics.com
• Aluko & Oyebode, CBN issues circular on market structure, data localisation and systemic oversight (19 June 2026): aluko-oyebode.com
• Pavestones via Legal500, CBN's data localisation directive: compliance considerations: legal500.com
• TechCabal, CBN's local data order puts Nigeria's data centres to test (7 July 2026): techcabal.com
• TechCabal, Localising Nigeria's data is easy, building sovereignty is harder (8 September 2026): techcabal.com
• ThisDay, Stakeholders fault CBN's January timeline on data localisation (25 September 2026): thisdaylive.com