News

A perspective from Arithmetic Contracting (ACG) on regulatory compliance, digital infrastructure, and resilience in Nigeria’s payment ecosystem.

LAGOS, June 23, 2026 – As Nigeria’s financial services sector continues its rapid digital transformation, a new priority is rising to the top of every regulated institution’s agenda: payment data localisation. The question is no longer whether this shift will happen, but how prepared each organisation will be when it does.

For much of the past decade, Nigerian banks, fintechs, and payment service providers have competed on innovation, customer acquisition, and digital channel experience. That competition continues but a parallel, equally consequential conversation is now underway: where critical payment data is stored, how it is processed, and who can access it. The Central Bank of Nigeria’s recent directive on payment data localisation marks a structural turning point in how the industry must think about infrastructure, governance, and risk.

This briefing sets out what payment data localisation means in practice, why it matters to regulators and institutions alike, the questions every executive team should be able to answer today, and the concrete actions that separate organisations that will navigate this transition smoothly from those that will struggle against the clock.

What is Payment Data Localization?

Payment data localisation refers to the requirement that defined categories of payment and financial transaction data be stored, processed, and in many cases replicated within Nigeria’s borders, rather than held exclusively on foreign servers or with offshore cloud providers.

In practice, this spans a wide and operationally significant set of data categories, including:

• Transaction records and payment instructions
• Customer payment information and account-linked data
• Settlement data across banks, switches, and processors
• Merchant records and acquiring data
• Financial messaging and processing logs
• Related operational and audit trail data

The underlying objective is straightforward: ensure that data critical to the integrity of Nigeria’s financial system remains accessible, secure, and subject to direct domestic regulatory oversight rather than dependent on jurisdictions, infrastructure, or providers outside the CBN’s direct supervisory reach.

Why It Matter – To Regulators and Institutions

The Regulator’s Perspective:

From the CBN’s vantage point, payment data localisation is a foundational pillar of financial system resilience and sovereignty. It is designed to deliver:

1. Improved financial system oversight – regulators can supervise risk and conduct in close to real time, rather than relying on retrospective or incomplete reporting.
2. Enhanced data security and sovereignty – sensitive financial information remains within Nigeria’s legal and regulatory jurisdiction.
3. Faster regulatory access during investigations and audits – critical in fraud, AML, and systemic risk events where speed of access materially affects outcomes.
4. Reduced dependence on foreign infrastructure – lowering exposure to geopolitical, contractual, or operational disruptions originating outside Nigeria.
5. Greater resilience of Nigeria’s payment ecosystem – strengthening the system’s capacity to withstand and recover from shocks.

The Institution’s Perspective:

For banks, fintechs, and payment service providers, compliance is not simply an information technology exercise but a business transformation initiative. It touches data architecture, vendor contracts, disaster recovery design, cybersecurity posture, and ultimately the operating model of the institution itself. Treating it as a narrow infrastructure migration significantly understates both the risk and the opportunity involved.

The Questions Every Financial Institution Should Be Asking

In our engagements across the sector, we consistently find that many institutions cannot yet answer foundational questions about their own data estate with full confidence. Executive teams should be able to answer each of the following without hesitation:

• Where exactly is our payment data stored today – by data category, by system, and by vendor?
• Which third-party vendors process or host our transaction data, and under what contractual and jurisdictional terms?
• Do we have adequate local backup and disaster recovery capabilities to meet both operational and regulatory expectations?
• Are our current cloud environments and hosting arrangements aligned with emerging regulatory requirements?
• What would it realistically cost in capital, time, and operational risk to migrate critical workloads if required?
• How quickly, and how credibly, can we demonstrate compliance readiness if asked by the regulator today?

Institutions that cannot confidently and specifically answer these questions are not simply behind on a technical task but are carrying unquantified regulatory, operational, and reputational risk. That risk compounds the longer it remains unaddressed, and it will surface at the least convenient moment: under regulatory inquiry, during a vendor dispute, or in the middle of a live migration with no fallback plan.

Compliance is More Than Infrastructure

A common misconception is that payment data localisation is solely about relocating servers or switching cloud providers. In reality, durable and defensible compliance requires alignment across five interdependent dimensions:

Data Governance:

Understanding what data exists, where it resides, who owns it, and who has access to it is the foundation on which every other compliance decision depends. Without an accurate, current data inventory, no migration or reporting program can be properly scoped or sequenced.

Cybersecurity:

Protecting localised data from increasingly sophisticated threats. Bringing data home does not automatically make it safer but it must be matched with security controls, monitoring, and incident response capability calibrated to the same standard the institution previously relied on offshore, or higher.

Business Continuity:

Ensuring uninterrupted operations during migration and in the face of disruption. Nigeria’s payment rails process billions of transactions; even brief, poorly managed downtime during a migration window carries direct financial and reputational cost.

Vendor Management:

Assessing third-party providers, their sub-processors, and their own compliance obligations. Many institutions discover during readiness assessments that their actual data footprint extends far beyond their direct operations. Once vendors, subcontractors, and sub-processors are fully mapped, the scope of data storage, processing, and transfer activities is often significantly broader than initially assumed, creating additional compliance, security, and operational risks that must be addressed.

Change Management:

Preparing people, processes, and technology for a new operating model. Localisation changes how teams work, who they work with, and which controls they are accountable for, and that shift needs to be actively managed, not assumed.

The Opportunity Hidden Within Compliance

Forward-thinking institutions are choosing to view this mandate not as a cost to be absorbed, but as a catalyst for transformation. Approached deliberately, the compliance program becomes the occasion to:

• Modernise legacy infrastructure that has accumulated technical debt over years of incremental change
• Improve cybersecurity posture as part of a structured, funded initiative rather than a reactive patch
• Strengthen disaster recovery capabilities to a standard appropriate for current transaction volumes
• Enhance customer trust through demonstrable data stewardship and regulatory alignment
• Streamline operations by retiring redundant systems and vendor relationships uncovered during the data-mapping process
• Build a more resilient digital ecosystem capable of absorbing the next wave of regulatory and market change

Organisations that act early are positioned to achieve smoother transitions and meaningfully lower implementation costs than those that wait. Compliance programs run under deadline pressure are, almost without exception, more expensive, more disruptive, and more exposed to execution risk than those run on a deliberate timeline.

Key Actions To Consider Today

1. Conduct a Payment Data Readiness Assessment by establishing a clear, evidenced baseline of current state before committing to a migration plan.
2. Map all payment-related data flows and storage locations across primary systems, backups, vendors, and sub-processors.
3. Review cloud and hosting arrangements against both current contractual terms and emerging regulatory expectations.
4. Evaluate cybersecurity and governance controls to ensure localisation strengthens, rather than dilutes, the institution’s security posture.
5. Develop a phased compliance roadmap sequenced to protect operational continuity and manage cost over a realistic timeline.
6. Establish executive-level oversight for compliance initiatives – this is a business transformation program and warrants the governance attention of one.

Looking Ahead

The journey toward payment data localisation is not merely a regulatory requirement but an opportunity to strengthen Nigeria’s financial infrastructure and improve operational resilience across the industry. The institutions that start preparing now will be best positioned to navigate the transition successfully and remain competitive in an increasingly regulated digital economy.

Those that delay are not avoiding the work but are simply choosing to do it later, under greater time pressure, at higher cost, and with less room to treat the mandate as anything other than an emergency.