Nigeria’s central bank data localisation push is about more than local servers

The Central Bank of Nigeria's recent data localisation push is more than a simple directive to store data locally. Dr Rakiya Yusuf, Director of the Payment System Supervision Department at the CBN, emphasized that the true focus is on ensuring banks and fintechs can access critical data, recover services, and maintain uninterrupted payment processing even when their infrastructure encounters issues.

This move comes amidst the rapid growth of digital payments in Nigeria, with the country processing over ₦1.2 quadrillion ($880.51 billion) worth of transactions in 2025. The CBN's new rules aim to address concerns that concentrating financial data and infrastructure on foreign cloud providers could leave Nigeria's financial system vulnerable to disruptions, dependencies, and decisions made outside its control.

Financial institutions now face the challenge of examining who controls their infrastructure, where backups are stored, and how dependent they are on technology providers. Yusuf stressed that achieving resilience and sovereignty in this context involves understanding every aspect of data management, from its creation and processing to its storage, backup, and recovery.

Financial institutions must take executive ownership of this transition, treating it as a comprehensive, cross-departmental effort rather than just a technology or security issue. The CBN's 2024 risk-based cybersecurity framework highlights lack of visibility as a significant risk of using cloud services, and the bank requires financial institutions to maintain records of their cloud providers and other third parties.

To ensure preparedness, institutions must test their resilience by simulating failures, connectivity disruptions, or provider unavailability, and understand how quickly critical services and data can be recovered or migrated. Yusuf urged institutions to start these assessments now, even without complete regulatory certainty, as approaching this as a structured transformation programme, rather than a last-minute compliance exercise, is the CBN's expectation.

However, questions remain about implementation, such as defining payment transaction data, handling hybrid environments, permitting cross-border processing, and managing existing technology architectures. Yusuf clarified that data sovereignty does not entail turning away from global technology, noting that Nigeria maintains partnerships with international providers like Microsoft and Amazon Web Services on various projects.