Skip to content
CBN data localisation deadline, 1 Jan 2027: 99d 00h 31m left.Talk to us →
NuxFamily

CBN data localisation

CBN data localisation: what has to be inside Nigeria by 1 January 2027

The Central Bank of Nigeria requires payment transaction data (processing, databases, backups, identity, keys and audit logs) to live and stay inside the country. This page explains what the directive covers, where estates usually fail it, and which architectures pass.

Take the readiness assessmentBook a Discovery Session

Time to the CBN deadline · 1 January 2027

99days
00hours
31minutes
37seconds

West Africa Time. Primary processing, databases, backups, keys and audit logs must be in Nigeria by then.

What the directive says

What the directive says

The circular sets a single, dated obligation: payment transaction data belonging to the Nigerian payments system must be processed and stored in Nigeria. It is not a guideline with a grace period attached. The table below reduces the text to the eight elements that decide your programme.

Issuer
Central Bank of Nigeria (CBN), acting as the regulator of the Nigeria Payments System.
Publication date
15 June 2026.
Compliance deadline
1 January 2027. Roughly eighteen months from publication, and less than that from the day most institutions started planning.
Subjective scope
Commercial banks, fintechs, licensed payment service providers, mobile money operators and other participants in the Nigerian payments system. Scope follows the activity, not the place of incorporation.
Objective scope
Payment transaction data: primary processing environments, databases, backups and the administrative functions around them: identity and access management, encryption keys and audit logs.
Express prohibitions
Storing or processing payment data outside Nigeria; depending on foreign cloud infrastructure for payment workloads; cross-border replication of payment data.
Additional obligations
Localisation clauses in supplier contracts, audit rights, facilitation of regulatory inspection, breach notification protocols, a documented data map and an updated data governance model.
Consequences
Sanctions for non-compliance, and a standing duty to hold documentary evidence that survives inspection. In practice, the evidence pack matters as much as the architecture.
Central Bank of Nigeria, circular of 15 June 2026, “Introduction of Market Structure Requirements, Data Localisation, Ultimate Beneficial Ownership Disclosure, and Systemic Oversight Measures in the Nigeria Payments System”.

Who it applies to

Who it applies to

The test is participation in the Nigerian payments system, not size or ownership. If payment transactions touching Nigerian customers, accounts or instruments pass through your systems, plan on being in scope and document the reasoning if you conclude otherwise.

  • Commercial banks

    Core banking, card issuing and acquiring, NIBSS-facing channels and the data warehouses fed from them are all in scope. The usual difficulty is not the core: it is the long tail of adjacent systems (reconciliation, fraud scoring, dispute management, reporting) that were built on foreign platforms while the core stayed local.

  • Fintechs and payment startups

    Companies built entirely on a foreign hyperscaler face the largest change, because localisation touches the platform, not just a database. Being incorporated outside Nigeria does not remove the obligation if the transactions are Nigerian. Expect to move compute, data and key management together rather than in stages.

  • Licensed payment service providers

    Switching companies, PTSPs, PSSPs and super-agents hold transaction data on behalf of other regulated entities, so their compliance position is inherited by every client. Licence conditions and the directive point the same way: the processing environment and its administrative functions belong in Nigeria.

  • Mobile money operators

    Wallet ledgers, agent network data, KYC records tied to transactions and USSD session logs are payment transaction data. Regional platforms shared across several African markets are the common problem, because a single multi-country database usually cannot satisfy the prohibition on cross-border replication without partitioning.

  • Other payments participants

    Processors, technology vendors, aggregators and BNPL providers that store or process Nigerian payment data are captured, whether or not they hold a CBN licence themselves. If you serve regulated clients, they will pass the obligation to you through the contract clauses the directive requires.

What must be localised

What must be localised

Draw the perimeter once, in writing, and test every system against it. The directive covers the data and the functions that administer the data, which is why a compliant database in Lagos is not compliant if its keys, logs or operators sit abroad.

Must be inside Nigeria

  • Primary processing: the applications and compute that authorise, clear and settle Nigerian payment transactions.
  • Transaction databases, including read replicas, caches and any staging or landing zones that hold transaction records.
  • Backups, snapshots and long-term archives of payment data, together with the systems that catalogue and restore them.
  • Identity and access management for payment systems: directories, privileged access management and the MFA service protecting them.
  • Encryption keys and the KMS or HSM that generates, stores and rotates them, including key custody and escrow procedures.
  • Audit logs and security telemetry produced by payment systems, from application audit trails to database and operating system logs.
  • Disaster recovery environments that hold payment data, which must be a second Nigerian site rather than a foreign region.
  • Administrative tooling with standing access to payment systems: bastions, orchestration, configuration management and monitoring agents.

May remain outside (with conditions)

  • Corporate email, collaboration and HR systems, provided they never receive payment transaction data through exports, attachments or support tickets.
  • Marketing, web and product analytics computed on non-payment data, with no account identifiers, transaction references or card data in the payload.
  • Vendor remote support, where access is brokered through a Nigerian jump host, time-bound, recorded and approved per session, with no data extraction.
  • Software supply chain services (source repositories, image registries, licence servers), as long as they carry code and artefacts, never transaction data.

The boundary matters because it decides what you have to move and what you only have to control. Systems that stay outside need evidence that they cannot receive payment data (egress controls, data loss prevention, contract clauses and tested support procedures), not just a statement that they do not. Every exception you claim becomes a line an inspector can ask you to prove.

The five compliance gaps we find most often

The five compliance gaps we find most often

These five turn up in almost every assessment we run, including in estates whose owners believed they were already local. They share a pattern: the transaction database was moved or built in Nigeria, but a function that administers it was left behind.

  1. 01

    Encryption keys managed in a foreign KMS

    The database runs in a Nigerian data centre, but the keys that make it readable are held in AWS KMS, Azure Key Vault or Google Cloud KMS. Envelope encryption hides this well: the data key sits next to the data, while the key that unwraps it never leaves the foreign region. A regional outage or an account action abroad renders Nigerian payment data unreadable, and control over access to the data sits outside the country. Teams often discover it only when they trace a startup dependency rather than reading an architecture diagram.

  2. 02

    Disaster recovery replicas outside the country

    The primary site is in Lagos and the DR target is a foreign cloud region, usually chosen years ago because it was cheaper than a second Nigerian facility. Replication is continuous, so a full copy of live payment data exists abroad at all times, which is exactly the cross-border replication the circular prohibits. The exposure is permanent, not conditional on a failover ever happening. Runbooks make it worse, because they assume an offshore recovery point the institution can no longer legally use.

  3. 03

    Logs aggregated in a foreign observability SaaS

    Application, database and security logs stream to Datadog, Splunk Cloud, New Relic or an Elastic Cloud deployment hosted outside Nigeria. Those logs are in scope: audit trails are named in the directive, and payload logging routinely carries account numbers, amounts, device identifiers and masked card data. The volume makes redaction unreliable, because a single new debug statement can start exporting fields nobody reviewed. It is also the gap most likely to survive a migration, since observability is rarely on the list of things being moved.

  4. 04

    Backups in regional object storage

    Nightly dumps and snapshots land in an S3 or equivalent bucket in a regional cloud (Cape Town, Frankfurt, Dublin) because that is where the backup tool was pointed when it was installed. Backups are explicitly in scope, and a backup is a complete copy of the payment database, so this is usually the single largest volume of misplaced data in the estate. Retention policies mean copies from years back are still there, often with weaker key management than production. Immutable or vaulted tiers add a complication: the data cannot simply be deleted on request.

  5. 05

    SaaS control planes that manage local infrastructure

    The workloads run in Nigeria but are governed from abroad: a managed Kubernetes control plane, a hosted secrets manager, a foreign CI/CD service deploying straight into production, or a monitoring agent with an outbound tunnel. These planes hold credentials, configuration and metadata about payment systems, and they exercise administrative functions the directive places inside the perimeter. They also create an egress path that no firewall rule blocks, because it was deliberately opened. The question to ask is simple: who could change a Nigerian payment system today, and from where?

Your path to 1 January 2027

Your path to 1 January 2027

The phases below assume a mid-sized payments estate and a team working on this alongside its normal load. The sequence matters more than the dates: mapping before design, keys and logs before the database move, evidence collected as you go rather than assembled the week before an inspection.

  1. 01

    Weeks 1-4

    Map and classify

    • Inventory every system that touches Nigerian payment transactions, including reporting, reconciliation and fraud tooling.
    • Trace data flows end to end, following backups, replicas, log shipping and analytics exports as first-class flows.
    • Locate key material, identity services and administrative access for each in-scope system.
    • Classify each system as inside the perimeter, outside with controls, or to be decommissioned.
    • Produce the data map the directive requires, in a form the regulator can read.

  2. 02

    Weeks 5-9

    Design the target

    • Choose the architecture pattern: owned data centre, Nigerian colocation, or hybrid with an isolated payment perimeter.
    • Size compute, storage and network for the payment perimeter, including the DR site and its bandwidth.
    • Design key management, identity, logging and backup as in-country services from the start.
    • Set recovery objectives, then verify that a second Nigerian site can meet them.
    • Agree the contractual changes needed with each supplier, including audit and inspection rights.

  3. 03

    Weeks 10-20

    Build the Nigerian platform

    • Install the private cloud foundation at the primary and DR sites, with the network segmentation the perimeter depends on.
    • Commission the HSM cluster and run the key ceremony, with custody and escrow documented.
    • Deploy in-country identity, logging, SIEM and backup before any payment workload arrives.
    • Harden and penetration-test the platform, and fix findings before data lands on it.
    • Rehearse the cutover on synthetic data, including the rollback path.

  4. 04

    Weeks 21-34

    Migrate and cut over

    • Move workloads in waves, starting with the systems whose failure is easiest to absorb.
    • Replicate the transaction databases in-country, then cut over in a planned window with a tested rollback.
    • Re-encrypt data under the Nigerian root keys and retire the foreign key rings.
    • Repoint backups and observability, and confirm no payment traffic leaves the country through network evidence.
    • Decommission foreign replicas, buckets and control planes, keeping deletion certificates.

  5. 05

    Weeks 35-40, then continuous

    Evidence and steady state

    • Assemble the evidence pack: data map, architecture, key custody records, contracts, deletion certificates and test results.
    • Run a restore test and a DR failover to the Nigerian site, and file the results.
    • Set the recurring controls that keep the perimeter honest: egress monitoring, access reviews and change records.
    • Brief the board and the risk function with a single view across the CBN directive, the NDPA and the cybersecurity framework.
    • Schedule quarterly re-mapping, because new systems will try to leave the country again.

Architecture patterns that comply

Architecture patterns that comply

Three patterns cover almost every institution we work with. They differ in who owns the building, not in where the payment data sits: in all three, processing, databases, backups, keys, identity and logs are inside Nigeria.

Full private cloud in an owned data centre

The institution owns both facilities and runs the whole stack itself, with NuxFamily supporting the platform. Payment applications, databases, key management and observability sit on a private cloud foundation at the primary site, replicated to an owned DR site. Nothing in the payment path depends on an external provider, which makes the compliance argument short and the inspection straightforward. The cost is capital and operational: two facilities, power, and a team able to run them.

Best for: Tier-1 banks with existing data centres, a capital budget and an infrastructure team already operating at scale.

Full private cloud for payment data in an owned Nigerian data centrePayment perimeter coreIn-country supporting servicesOutside Nigeria, no payment data

Private cloud in Nigerian colocation

Hybrid with an isolated payment-data perimeter

NDPA 2023 and the CBN cybersecurity framework

NDPA 2023 and the CBN cybersecurity framework

Three instruments now govern the same systems: the localisation directive, the Nigeria Data Protection Act 2023 and the CBN's risk-based cybersecurity framework. Treated separately they produce three projects, three sets of documents and three audits. Treated as one programme they share most of their evidence.

  • One register, three sources of obligation

    Build a single control register in which every requirement carries its source. The directive drives location and cross-border controls, the NDPA drives lawful basis, data-subject rights and processor terms, and the cybersecurity framework drives risk assessment, controls testing and board reporting. Most controls satisfy more than one source, which is where the saving is.

  • NDPA 2023: the data map does double duty

    The NDPA expects a record of processing, a lawful basis for each purpose, a data protection officer and honoured data-subject rights, along with obligations that flow to processors. The data map the directive requires is substantially the same artefact. Produce it once, with both regimes in mind, and register the entity with the NDPC rather than treating that as a separate exercise.

  • Risk-based cybersecurity: the controls that prove location

    The CBN's cybersecurity framework already asks for segmentation, privileged access management, logging, incident response and periodic testing. Those are exactly the controls that demonstrate a payment perimeter is real. Extend them with egress monitoring and key custody evidence, and the same control tests answer both the security and the localisation question.

  • One evidence pipeline, one board report

    Collect evidence continuously from the systems that already produce it (access reviews, change records, restore tests, DR failovers, network flow logs) rather than assembling it before each inspection. Report it to the board in a single view covering all three instruments. Breach notification is the clearest example: one incident process satisfies the CBN and the NDPC if it is designed that way from the start.

Where does your estate stand today?

Nine questions on processing, backups, keys, logs, disaster recovery, contracts, data mapping and governance. You get a banded score and specific actions per area in under five minutes, with no email required to see your result.

Start the readiness assessmentRequest the CBN Playbook whitepaper

The journey with NuxFamily

  1. 01Assess
  2. 02Design
  3. 03Build
  4. 04Migrate
  5. 05Operate
  6. 06Evolve

Every family is delivered through the same six-stage journey, with official 24×7 support and knowledge transfer built in.

FAQ

FAQ

It is a circular issued by the Central Bank of Nigeria on 15 June 2026 requiring payment transaction data belonging to the Nigerian payments system to be processed and stored inside Nigeria. It covers primary processing, databases, backups and the administrative functions around them: identity and access management, encryption keys and audit logs. It also requires localisation clauses in supplier contracts, audit and inspection rights, breach notification protocols and a documented data map.

FAQ →

Over two decades

Built by the team behind the platforms of Santander, ING, Bankinter, Mapfre and Inditex

More than twenty years designing, building and operating private clouds for institutions that cannot afford to fail, and a delivery model where we stay with you from assessment to operation.

See our track record

20+

Years building private clouds

40+

Private clouds delivered

Disclaimer: This page is informational and reflects our reading of the CBN circular of 15 June 2026 as a technology partner, not as a law firm. It is not legal advice and does not create a professional relationship. Confirm your obligations with qualified Nigerian counsel and with the Central Bank of Nigeria before making compliance decisions.

Where does your estate stand today?

Nine questions on processing, backups, keys, logs, disaster recovery, contracts, data mapping and governance. You get a banded score and specific actions per area in under five minutes, with no email required to see your result.

No mailing lists, no automated follow-ups. We reply personally within one working day.