CBN data localisation raises skills, security concerns

Nigeria’s data-centre infrastructure has enough capacity to support the Central Bank of Nigeria’s new payment-data localisation requirement, industry executives and government officials said, even as they warned that shortages of specialised talent, pricing pressures and the security of fibre infrastructure could complicate the transition.

The assessment came at a three-hour roundtable in Lagos recently, where senior representatives of MTN Nigeria Communications, Patrick Gold Microfinance Bank and the National Identity Management Commission discussed the practical implications of the CBN’s data-localisation rule for banks, fintech companies and other payment operators.

SPARK, organisers of the African Technology Expo, organised the session, themed “Making Data Localisation Work: Infrastructure, Cost, Compliance & the Future of Nigeria’s Digital Payments Ecosystem,” in partnership with B4B Partners. It was held in person in Lagos and streamed online.

The discussion comes as payment companies approach a January 1, 2027, deadline imposed by the CBN. Under a circular issued June 15 by its Payments System Supervision Department, the regulator directed financial institutions and participants that facilitate payments in Nigeria to store and manage payment transaction data generated within the country in Nigeria, in accordance with applicable Nigerian data-protection laws.

The scale of Nigeria’s payments market makes the localisation requirement significant. Electronic payment transactions reached N284.99tn in the first quarter of 2025, up 17.7 per cent from N234.49tn a year earlier, according to data attributed to the Nigeria Inter-Bank Settlement System. Point-of-sale transaction value also rose sharply during the period, reaching N10.45tn.

That growth means the infrastructure supporting Nigerian payments must handle increasingly large volumes of transaction data while maintaining the reliability expected from banks, fintechs, switches and other payment operators.

Against that backdrop, Head of Research at Kickoff Africa and moderator of the session, Ayobami Olajide, said Nigeria’s 10 largest banks spend close to N200bn a quarter on cloud and information-technology services and argued that institutions cannot approach migration as an ordinary technology upgrade.

“One per cent failure rate is not acceptable,” Olajide said.

Institutions therefore need to examine where relevant data is stored, processed and backed up. However, the rule should not be characterised as a blanket order to move every banking or fintech workload from international cloud platforms to Nigerian infrastructure.

Technical Adviser to the CEO at NIMC, Fola Olatunji-David, rejected the view that the mandate had outpaced the market. “It’s not a policy that has come from nowhere,” he said. “I don’t think there’s any cloud provider in the country today that is operating at 100 per cent capacity.”

He pointed to NIMC’s own localised national identity database, which he said holds more than 140 million records, about 100 million of them biometric. He said service quality improved because most connecting services are local.

Olatunji-David also urged the CBN to require certified migration personnel. “That is one area that we don’t want to skimp on,” he said.

Cloud providers are also positioning themselves to support organisations through the transition. Head of Cloud Solutions at MTN Nigeria, Ifeanyi Otudor, said local providers already operate to PCI DSS, ISO and SOC 2 standards.

• PalmPay introduces extra verification for night transfers
• ‘Private capital can help bridge Lagos housing gap’
• PHOTOS: Peter Obi watches Ikorodu City beat Rangers 2-0 in Lagos

Otudor said MTN already gives some migrating clients about three months of service at no charge to refactor applications, with commercial terms beginning only after the migration succeeds. He said the offer extends to “anyone who shows up.”

MTN is also expanding its cloud marketplace through partner-built services aimed at startups, a move that could become relevant as smaller fintechs and payment companies assess whether local infrastructure can meet their technical requirements without significantly increasing technology costs.

For financial institutions, however, the challenge extends beyond the availability of local servers. Applications may have been designed around services offered by international hyperscalers, meaning migration can require changes to architecture, networking, security controls and application dependencies rather than a simple transfer of stored files.

Chief Technology Officer of Patrick Gold Microfinance Bank, Daniel Babatunde, provided an example of a financial institution that had already moved away from a foreign cloud platform.

The bank migrated from Microsoft Corp.’s Azure around 2019–2020, he said, partly because of exposure to foreign-currency costs. Hosting infrastructure in naira reduced the need to price the bank’s technology requirements against the dollar.

The bank also gained lower latency through leased-line connections to NIBSS, Interswitch and Unified Payments, replacing IPsec tunnels that had previously operated over the public internet.

“We may not have all the one-click install that we get from a whole lot of cloud providers,” Babatunde said.

He said technology executives considering migration should examine several areas before moving workloads, including encryption at rest and in transit, firewall provisioning, VPN and leased-line connectivity to payment processors, IP re-addressing and security-by-design architecture.

Beyond the technical demands of migration, Babatunde raised a broader infrastructure concern: the protection of fibre networks and data-centre infrastructure from vandalism.

“Data now is the new oil,” he said. “We must protect it the way we protect our pipeline.”

The concern is significant because localisation increases the importance of domestic connectivity. A financial institution may have its payment data physically inside Nigeria, but disruptions to fibre links between data centres, banks, processors and other critical infrastructure can still affect service availability.

Olatunji-David said the government has designated telecommunications infrastructure as critical national infrastructure and criminalised its vandalisation. He also pointed to coordination on right-of-way through Lagos State’s infrastructure agency, the federal Project BRIDGE fibre rollout, and satellite connectivity from NigComSat and Starlink as measures intended to strengthen network resilience.