CBN Data Localisation Checklist: What Fintechs Must Move Before January 2027

On 15 June 2026 the Central Bank of Nigeria issued a circular that changes where a large part of the country's financial data is allowed to live. From 1 January 2027, payment transaction data generated in Nigeria has to be stored and managed in Nigeria. If you process payments in Nigeria, the question is no longer whether this applies to you but what, precisely, has to move, and in what order.

This article is the working checklist. It states what the circular says, what it does not say, and the exercise a payments business can run this week to find out how big its own migration is.

What the circular says

The document is circular PSS/DIR/PUB/CIR/001/004, issued by the CBN's Payments System Supervision Department and signed by its director. Its operative sentence on data, as quoted by Nairametrics, the Nigerian Tribune and others on the day it was issued, reads:

"All Financial Institutions and participants facilitating payments within Nigeria shall ensure that payments transaction data generated within Nigeria are stored and managed in Nigeria in accordance with data protection laws and regulations applicable in Nigeria."

The same circular introduces market-structure rules, monthly market-share returns and beneficial-ownership disclosure, with a separate compliance date of 31 December 2026. Those are outside this article. On enforcement it says only that the CBN "shall monitor compliance with the provisions of this Circular and may, where necessary, impose supervisory sanctions". There is no penalty schedule in it.

Who is in scope

The addressee list, as rendered by the law firm Aluko & Oyebode and by ThisDay, is deposit money banks, microfinance banks, mobile money operators, switching and processing companies, payment terminal service providers, payment solution service providers, super agents, and other licensed operators in the Nigerian payments ecosystem.

Note that the operative sentence is wider than the list: it binds "all financial institutions and participants facilitating payments within Nigeria". A fintech that is not itself licensed but sits in a payment flow through a licensed partner should read that phrase as applying to it in practice.

What the circular does not say

This is the part most write-ups skip, and it decides the size of your project.

• It does not define "payment transaction data". Pavestones, writing for Legal500, notes that "the circular does not formally define this term". Every list you will see of what it covers (payer and beneficiary details, amounts, references, authentication records, settlement and routing information, transaction logs) is a law firm's reading, not the regulator's text.
• It does not say whether backups, disaster-recovery copies or logs are included. Aluko & Oyebode say further guidance "may be useful" on "offshore disaster-recovery infrastructure". Their practical advice nonetheless is to map whether any payment transaction data is "stored, processed, backed up or managed outside Nigeria", which is the prudent reading: assume copies count until told otherwise.
• It does not say whether a foreign cloud provider's Nigerian zone satisfies it. The same firm notes the circular "does not expressly state" this. A CBN representative at a September industry event, as reported by TechCabal, said the objective is local oversight of core financial records rather than severing links with global providers. That is a reported position, not a published rule.
• It does not define "managed". Whether administration, access and support from outside Nigeria counts as managing the data abroad is unanswered. Femi Olugbesan of Descasio put the operational point to TechCabal: "Changing the address of the data is not the same as having sovereignty over it."

In late September the Committee of Bank CIOs, through FCMB's chief technology officer, said publicly that it had not been able to get clarity from the CBN on these questions since June. So the gaps above are not an artefact of our reading. They are open.

The migration checklist

Work the list in order. Each step narrows the next.

1. List every system that generates or touches a Nigerian payment

Card and transfer processing, wallet ledgers, settlement and reconciliation, dispute handling, fraud scoring, merchant and issuer records. Include systems run by vendors on your behalf. The circular binds the participant, not the software supplier.

2. Find every copy

Primary databases are rarely the problem. Read replicas, nightly backups, disaster-recovery sites, log pipelines, analytics and reporting warehouses, data science extracts, customer-support tooling that exports transaction detail, and third-party observability services all hold payment data. Backups are where most of these projects find their surprise. Aluko & Oyebode's data-flow mapping step exists for exactly this reason.

3. Split what has to move from what has to stop leaving

Some data lives abroad because a system was built there and can be re-homed. Some leaves Nigeria continuously because of an integration, a monitoring agent, a global vendor's architecture. The first is a migration. The second is a redesign, and it takes longer, so find it early.

4. Decide what "in Nigeria" will mean for you

Floor space is not the constraint. Johnson Agogbua of Kasi Cloud told TechCabal that "physical data centre capacity is not the problem". The constraint is having a platform you can provision on, with storage, backups and administration that stay inside the jurisdiction, and an operating model your team can run. Olugbesan again: "Data can be copied. The difficult part is moving the operating model around it without breaking the business."

5. Ask each provider four questions, in writing

• Where, physically, is the primary data stored?
• Where are the backups and the disaster-recovery copies?
• Where is the platform administered from, and who can access the data?
• What will you attest to, and on what date?

Keep the answers. If the CBN's monitoring ever asks how you satisfied the circular, this file is the answer.

6. Work the calendar backwards from 1 January

Payments operators who have looked at the load call the timeline short. Hakeem Adeniji-Adele of eTranzact told ThisDay it "is quite short, simply because of the amount of load that needs to be moved". The Central Bank has since answered. At a Lagos roundtable on 7 October, an address by Dr Rakiya Yusuf, delivered on her behalf by Assistant Director Babatunde Ajiboye, said: "The compliance date hasn't changed. It's 1st of January, 2027." On a panel at the same event, Ajiboye added that migration problems could be "dealt with on a case-by-case basis. That doesn't mean there will be an extension to the deadline." Plan for 1 January 2027.

7. Check the other regimes at the same time

Two more rules sit beside this one. The Nigeria Data Protection Act 2023 and the NDPC's implementation directive govern personal data and its transfer abroad regardless of the CBN circular (we set out what that Act does and does not require in a separate article). And from October 2026 NITDA's national cloud certification register, signed into effect on 4 August, is intended to decide which cloud and data-centre providers may handle regulated data. TechCabal's summary of the overlap is the right one: where both regimes apply, comply with both.

Resilience, not location

Moving the data is not the whole job. Speaking in September, Dr Rakiya Yusuf, Director of the Payment System Supervision Department at the CBN, put it in one line: "Localisation is not the same thing as resilience." As TechCabal reported, she said the Central Bank does not want to measure success by the number of servers in Nigeria. It wants payment systems that are more resilient, institutions that recover faster, critical dependencies the regulator can see, and critical data that can be recovered and moved when it has to be.

She called for executive ownership: the work should not be delegated entirely to the chief information officer, the chief technology officer or the information-security team. And she said institutions should not wait for complete regulatory certainty before starting.

Against that measure, here are three tests of our own to put to any provider, including us. Do your backups stay in the country with your data? Can you see every action taken on your servers and your account? And can you run them with your own tools, not only the provider's?

Where AFRICLOUD fits

We run a Lagos region, so compute and storage for Nigerian workloads can stay on Nigerian soil, with backups in the same jurisdiction. That answers our first test and the first two of the four provider questions in step 5. The other two tests have plain answers as well: an activity log of every action on your server and account is visible in the dashboard, and our REST API is public and documented, so you can automate your servers with your own tools, not only through our dashboard. None of this, by itself, answers the rest of the provider list, and residency is not compliance. We are an infrastructure provider, not a CBN-licensed operator and not your counsel. Specific compliance requires individual legal assessment.

This article describes publicly reported regulatory requirements and named professional opinions, with sources, and is not legal advice. The circular itself was not available for direct download at the time of writing; quotations are as reported by the outlets named.

Sources

• Nairametrics, CBN mandates banks, fintechs to store payment data in Nigeria (15 June 2026): nairametrics.com
• Aluko & Oyebode, CBN issues circular on market structure, data localisation and systemic oversight (19 June 2026): aluko-oyebode.com
• Pavestones via Legal500, CBN's data localisation directive: compliance considerations: legal500.com
• TechCabal, CBN's local data order puts Nigeria's data centres to test (7 July 2026): techcabal.com
• TechCabal, Localising Nigeria's data is easy, building sovereignty is harder (8 September 2026): techcabal.com
• ThisDay, Stakeholders fault CBN's January timeline on data localisation (25 September 2026): thisdaylive.com
• TechCabal, Nigeria's central bank data localisation push is about more than local servers (29 September 2026): techcabal.com
• ThisDay, CBN insists on data localisation, says no extension in January 2027 deadline (8 October 2026): thisdaylive.com
• ThisDay, As CBN begins data migration, local hosting (15 October 2026): thisdaylive.com