If your business moves money in Nigeria, the calendar just became a compliance problem. On 15 June 2026 the Central Bank of Nigeria issued Circular PSS/DIR/PUB/CIR/001/004, and one of its clauses is short enough to read in a single breath and large enough to reshape your infrastructure:
"All Financial Institutions and participants facilitating payments within Nigeria shall ensure that payments transaction data generated within Nigeria are stored and managed in Nigeria in accordance with data protection laws and regulations applicable in Nigeria. Accordingly, all affected Financial Institutions shall fully comply with this requirement effective January 1, 2027."
– CBN Circular PSS/DIR/PUB/CIR/001/004, clause 2 [1]
That is barely two months away. Yet much of the conversation treats this as a legal notice to file and forget. It is not. Where your data physically lives, how it is replicated, and how you prove all of it to a regulator are engineering decisions. Treating them as paperwork is how a two-month runway becomes a frantic December.
What the circular actually says
Strip away the commentary and the directive is precise. It is addressed to deposit money banks ⓘ, microfinance banks ⓘ, mobile money operators ⓘ, switching and processing companies ⓘ, payment terminal service providers (PTSPs) ⓘ, payment solution service providers (PSSPs) ⓘ, super agents ⓘ, and other licensed operators. The core obligation is the one quoted above: Nigerian payment transaction data stays in Nigeria.
The same circular carries two more obligations, because they share your compliance team's attention: ultimate beneficial ownership disclosure, and market-structure caps limiting any group to 25% market share in consumer issuing ⓘ against 15% in merchant acquiring ⓘ (and the reverse), with monthly returns to the CBN. Those market-structure measures carry an earlier date, full compliance by 31st December, 2026. The CBN says it may "impose supervisory sanctions" for non-compliance; it does not publish a schedule of penalties, so treat the risk as real but unquantified rather than inventing a figure. [1]
One clarification that matters for scoping: the circular does not list which data categories count. Industry analysts reasonably suggest the net is wide, covering transaction records, settlement and reconciliation data, switching logs, and backups or disaster-recovery copies. [2] That is informed interpretation, not the regulator's words. Plan for the broad reading, but know the difference when you brief your board.
Why this is an architecture problem
The trap is assuming "store it in Nigeria" means moving one database. In most payment businesses, transaction data is smeared across the stack: the primary database, a managed analytics warehouse, a third-party fraud-scoring service, log aggregation, and the quiet one everybody forgets, the offsite backup in a foreign region. A clause about "storing and managing" data reaches all of them.
This is also why the deadline is hard for teams that built on global cloud regions. The practical worry raised across the sector is migration risk and cost, and whether local data centres can reliably carry payment workloads in time for January 2027. [3] That concern is a reported industry view rather than a settled fact, but it points at the real work: this is a data-residency migration under a live, revenue-critical system, not a config toggle.
A readiness sequence you can start this week
You do not need a consultant to begin. You need an honest map.
- Find the data. List every place Nigerian payment transaction data is written, copied, or cached, including analytics tools, third-party processors, and backups. You cannot localise what you have not located.
- Classify scope. Separate payment transaction data covered by this circular from general personal data governed by the Nigeria Data Protection Act (NDPA). The circular is specifically about payments data; conflating the two inflates the project. [4]
- Decide where it lives. For each store, choose: migrate to a Nigerian region, adopt a local managed provider, or retire the data flow. This is an ordinary build-versus-buy decision applied to residency.
- Plan the cutover. Sequence migrations so live payments never stop. Dual-write, reconcile, then cut over. Rushed single-shot migrations are where outages happen.
- Keep the evidence. Document data locations and controls now, because "stored and managed in Nigeria" is something you will have to demonstrate, not just assert.
The decision in front of you
The businesses that come out of this well will not be the ones with the biggest legal budget. They will be the ones that treat residency as a systems project with a deadline, map their data early, and migrate deliberately. The ones that struggle will discover in December how many copies of their data they never knew about.
If you would find it useful to pressure-test your own readiness, Swiftascale's Advisory & Strategic Consulting and Custom Software & Digital Infrastructure work helps leadership teams map where their systems stand and plan changes that do not interrupt operations. The first conversation is a free, no-pressure 45-minute structured call: start the conversation.
Glossary
Plain-language explanations for readers newer to the payments industry. These are not official definitions; the CBN is the authority for the formal licence categories. [1]
- Deposit money bank (DMB): a conventional commercial bank licensed by the CBN to take deposits from the public and provide accounts, lending, and payments.
- Microfinance bank (MFB): a CBN-licensed bank offering small-scale savings, micro-loans, and payments, usually to low-income customers and micro-enterprises within a defined area.
- Mobile money operator (MMO): a licensed provider that lets people store, send, and receive money through a phone-based wallet, often via agents, without a traditional bank account.
- Switching and processing company: infrastructure that routes and processes electronic transactions between banks, cards, and operators; the "plumbing" behind ATMs, POS, and transfers.
- Payment terminal service provider (PTSP): a company licensed to deploy, maintain, and manage POS terminals and keep them working across the network.
- Payment solution service provider (PSSP): a provider of payment products such as gateways, aggregation, and merchant checkout that connect merchants to the payment system.
- Super agent: a licensed operator that runs a network of agents providing cash-in/cash-out and basic financial services on behalf of banks or MMOs, extending reach to underserved areas.
- Consumer issuing: providing payment instruments (such as cards or accounts) to end customers so they can pay. The circular defers to the CBN's Guidelines on the Operations of Electronic Payment Channels for the formal definition. [1]
- Merchant acquiring: enabling merchants to accept electronic payments (for example POS or online checkout) and settling the funds to them.
Sources
- CBN Circular PSS/DIR/PUB/CIR/001/004, "Introduction of Market Structure Requirements, Data Localisation, Ultimate Beneficial Ownership Disclosure, and Systemic Oversight Measures in the Nigeria Payments System," 15 June 2026. cbn.gov.ng
- Complyan, "Nigeria's CBN Data Localisation Directive: What Banks and Fintechs Must Do Before 2027." complyan.com (interpretation of in-scope data categories; not the regulator's wording)
- tech.africa, "Nigeria's CBN orders payment data localised by 2027," 2 July 2026. tech.africa (reported industry concern, not an established fact)
- Finovamax compliance library, "CBN Data Localisation, Effective 1 January 2027." finovamax.com
