How Nigeria’s overlapping data rules affect fintechs and banks

Nigeria's financial sector is grappling with conflicting data regulations from the Central Bank of Nigeria (CBN) and the National Information Technology Development Agency (NITDA). The CBN mandates that financial institutions and payment system participants store and manage payment transaction data locally by January 1, 2027. Simultaneously, NITDA is developing a broader framework for cloud infrastructure, data classification, cybersecurity, and digital systems.

While both frameworks aim to maintain national control over critical digital infrastructure, their mandates differ: the CBN focuses on financial stability and operational risk, while NITDA covers technology standards, cloud infrastructure, and digital systems. This overlap in responsibilities creates a complex compliance landscape for fintechs and banks, as they must balance the requirements of both regulators.

Compliance becomes a puzzle as financial institutions must navigate the intersection of sector-specific financial regulations and broader technology standards. A key challenge lies in determining which data must be localised, under what conditions, and on what infrastructure. Nigeria's approach demonstrates that greater control over data can be achieved without isolating its digital economy from global cloud providers.

The solution requires a clearer division of responsibilities between NITDA and the CBN, with NITDA leading technical standards for cloud systems, data centres, and digital infrastructure, while the CBN applies these standards to financial institutions, adding sector-specific requirements.