Nigeria’s data localisation mandate needs more than a migration plan

Tunde Abagun, Sales Lead for West, East, and Central Africa, Nutanix. (Image: AI-enhanced)

---

In my previous article on why the future of enterprise intelligence is hybrid, I argued that African organisations were already moving toward a model where workload placement is shaped by cost, control, privacy, latency, and data sovereignty.

Nigeria’s latest payment data localisation directive shows how quickly that argument has become operational. 

The Central Bank of Nigeria has directed financial institutions and payment system participants to ensure that payment transaction data generated within Nigeria is stored and managed in Nigeria, with the requirement taking effect from January 1, 2027.

The directive forms part of a broader push to strengthen oversight of Nigeria’s fast-growing digital payments ecosystem. For Nigerian banks and fintechs, it is a practical test of whether infrastructure can keep pace with regulation.

Less than six months is not much time to map and localise payment data that moves through applications, cloud platforms, analytics environments, fraud systems, backups, reporting tools, and third-party services.

The harder work is understanding where payment transaction data sits, where it moves, which systems touch it, and which dependencies sit outside Nigeria. A payment record may begin in a local customer journey before passing through processing layers, reconciliation systems, risk engines, monitoring tools, support platforms, and disaster recovery environments.

If an organisation does not know where regulated data moves during normal operations, it will struggle to prove control under scrutiny. Backups, logs, replicas, archives, and analytics copies also need to be included, or the obvious workload may shift while exposure remains elsewhere.

The instinct may be to move everything at once, but that can create operational risk. Payment systems support customer trust, merchant activity, settlement, fraud controls, and daily digital services. A rushed migration may satisfy localisation while weakening availability or increasing complexity.

The better approach is to identify the workloads and data stores most affected by the CBN directive, then sequence migration by transaction criticality, customer impact, integration dependencies, resilience requirements, and environment complexity.

Localising payment data is necessary under the directive, but location alone does not create resilience. A local server can still be poorly governed, difficult to recover, or hard to patch, monitor, scale, and protect. The practical goal should be local control with operational discipline.

For banks and fintechs, the local environment must meet modern infrastructure standards across security, observability, data protection, high availability, disaster recovery, workload mobility, and policy enforcement. It also needs to scale as payment volumes, fraud monitoring, customer expectations, and reporting demands increase.

This is where the earlier sovereignty argument comes in. Sovereignty depends on knowing where data sits, who can access it, who controls it, how it is protected, how systems recover, and whether the organisation can adapt when requirements change.

The CBN directive should not be treated as a one-off migration project. It is better understood as a signal of where financial regulation is heading.

Across markets, regulators are placing greater emphasis on operational resilience, data residency, third-party risk, cloud dependency and digital infrastructure accountability.

 Future requirements may involve tighter reporting, stronger audit evidence, new rules for AI-driven financial services or greater scrutiny of critical technology providers. Banks and fintechs should therefore use the deadline to embed continuous compliance into their operating models.

Financial institutions need to run critical workloads in appropriate locations, manage them consistently, protect their data, recover quickly and retain sufficient portability to respond as regulations, supplier risk, costs or geopolitical conditions change.

The mandate should not be interpreted as a reason to move every workload on-premises. Institutions need an architecture that allows workloads to be placed deliberately while maintaining consistent control across private infrastructure, public cloud and edge environments. 

Public cloud may continue to support suitable workloads, while regulated payment data must be stored and managed within Nigeria. The objective is to manage this mix without losing visibility or creating disconnected operational environments. 

The strongest response is to use the deadline to create a durable operating model around payment data, governance and infrastructure control.

That means assessing existing workloads and data flows, prioritising migration according to risk, establishing local infrastructure with resilience and security at its core, and ensuring governance can keep pace as workloads and regulatory requirements evolve.

Continuous compliance means being able to demonstrate control as the operating environment changes. Nigeria’s financial services sector has grown rapidly as banks, fintechs, payment companies and mobile money operators have integrated digital services into daily life. Its next phase will require the same pace of innovation, supported by stronger infrastructure discipline.

The CBN directive gives the sector both a deadline and an opportunity: to meet an immediate regulatory requirement while building a more resilient foundation for the future of Nigerian financial services.