Your payment data has a new address: Nigeria.
The Central Bank of Nigeria now requires payment transaction data generated in Nigeria to be stored and managed inside the country. Here is what the rule actually covers, and how PCIS helps regulated institutions meet it without weakening resilience.
What the Circular actually requires
On 15 June 2026, the CBN issued a Circular on market structure, data localisation, beneficial ownership and systemic oversight in Nigeria's payments system. The data localisation piece is simple to state and harder to execute: payment transaction data generated in Nigeria must be stored and managed inside Nigeria, in line with the Nigeria Data Protection Act, 2023.
It applies to:
Four linked requirements, one deadline that bites hardest
Each pillar has its own evidence trail — but for most institutions, localisation is the one with the deepest technology footprint.
Market structure caps
An operator above 25% share in consumer issuing or merchant acquiring must hold its share in the other activity to 15%, with monthly returns to the CBN.
Data localisation
Payment transaction data generated in Nigeria — primary copies, backups and recovery sites — must be stored and managed in-country.
Beneficial ownership
Operators must disclose and keep current records of significant shareholders, in line with AML/CFT/CPF rules.
Systemic oversight
Ongoing CBN monitoring, with supervisory sanctions available where institutions fall short of the requirements.
of the financial industry already reports being compliance-ready, per the CBN's own readiness survey.
“This is about our sovereignty, clarity and visibility over our transaction data.”
— Dr. Rakyat Yusuf, Director, Payment System Supervision Department, CBN, at the CBN–NITDA Executive Regulatory Dialogue, Lagos, October 2026
Hosting a server in Lagos is not the same as being compliant.
A primary database inside Nigeria doesn't prove compliance on its own. The requirement covers the full data lifecycle — and institutions that only move their main database often leave a trail of copies behind:
How PCIS helps
PCIS runs Nigeria-based cloud and server infrastructure built around exactly this kind of requirement — payment and customer data that never has to leave the country to be reliable.
PCIS Cloud
Nigeria-hosted virtual machines and cloud capacity for core banking, payments and customer-data workloads.
Explore Cloud Servers →Managed Servers & Hosting
In-country primary and disaster-recovery hosting, designed with real geographic and provider separation.
See Managed Servers →Databases & Storage
Dedicated managed PostgreSQL and S3-compatible object storage, hosted in-region with no egress surprises.
See Databases →Migration & Readiness Support
Hands-on help mapping your current data footprint and moving workloads in-country on your timeline.
Talk to us →A realistic path to January 2027
Map and baseline
Map where payment data is stored, replicated and processed; identify every offshore copy.
Design and contract
Design the in-country primary + disaster-recovery architecture and line up migration.
Market structure compliance
Monthly market share returns in place, submitted in the CBN's prescribed format.
Data localisation compliance
Primary, backup and recovery data in Nigeria; offshore copies repatriated or deleted.
Sustain and test
Regular failover and continuity testing, with results reported to the board.
Start your data localisation readiness assessment
PCIS will map your current data footprint, flag the gaps against the CBN Circular, and design an in-country hosting plan that's ready well before 1 January 2027.
This page is general information for Nigerian financial institutions and payment operators, not legal or regulatory advice. It summarises the CBN Circular on Market Structure Requirements, Data Localisation, Ultimate Beneficial Ownership Disclosure, and Systemic Oversight Measures (15 June 2026). Institutions should confirm their own obligations directly with the CBN and their legal and compliance advisers.
Background research: PwC Nigeria, “CBN data localisation and market structure rules” (2026); CBN–NITDA Executive Regulatory Dialogue on the National Sovereign Cloud Initiative, Lagos, October 2026.