Half of surveyed banks, fintechs yet to start data localisation before January deadline
- A NITDA survey found 22 of 44 financial institutions have not begun storing payment data in Nigeria.
- The CBN says more than half of respondents report readiness for the January 1, 2027 deadline.
- Regulators say clearer rules on what counts as payment transaction data are needed.
Half of the financial institutions surveyed by the National Information Technology Development Agency (NITDA) have not started work on keeping payment data inside Nigeria, with the January 1, 2027 deadline about nine weeks away.
The survey covered 44 banks, fintechs and payment providers. Twenty-two had not begun implementing the data localisation rules, according to findings presented at a regulatory dialogue in Lagos on Wednesday.
The event was convened by NITDA and the Central Bank of Nigeria (CBN) and brought together regulators, bank executives, fintech operators and technology providers.
Dr Muhammad Aminu Lawal, Special Assistant on Digital Transformation to NITDA Director-General Kashifu Inuwa Abdullahi, presented the results. He summed up the gap simply: “Mapping is done; budgets, contracts and migration lag.”
What the survey found
Twenty-six institutions, or 59 per cent, said they had finished the required steps or expected to finish by the deadline. Fifteen said they were unlikely or very unlikely to make it, and three could not say.
The presentation classed 59 per cent as on track and 34 per cent as at risk. It stressed that the answers were self-reported, anonymised and did not amount to a formal compliance check.
Most institutions know what data falls under the rules: 70 per cent had identified the data and systems involved, and 52 per cent had mapped where they are hosted. Far fewer had moved to action. Only 25 per cent had board or executive approval and a budget, 23 per cent had signed up local providers, and 18 per cent had begun moving systems.
Unclear rules are a big brake. Sixty-four per cent wanted a definition of “payment transaction data”, and 38 per cent asked what it means for data to be “stored and managed in Nigeria”. Twenty-nine institutions said their preparations depend on getting that clarity.
Half said they were working on assumptions while they wait, and 16 per cent said material work was on hold.
Why it matters
The CBN wants payment data created in Nigeria to be stored and managed locally so it can oversee transactions and step in when needed. Rakiya Opemi Yusuf, director of the CBN's Payment System Supervision Department, said the regulator needs to see who started a payment, what was paid and whether it went through.
She said the rule does not force foreign recipients of cross-border payments to hand over details of their own customers.
CBN Deputy Governor for Financial System Stability Lamido Abubakar Yuguda warned that localisation alone will not keep the system safe. “Localisation alone does not guarantee security,” he said, adding that banks remain responsible for risks from third-party technology providers.
On enforcement, the CBN said it prefers to work with institutions and that sanctions are not its first step, though deliberate disregard would attract penalties. No change to the deadline was announced.
Institutions asked regulators for phased or risk-based milestones, a clear exceptions process and written guidance on existing contracts. The survey said compliance is “within reach for about six in 10, not yet for the rest”, with clarity the critical path.
What happens next: The CBN said it is analysing survey feedback and will weigh suggestions on their merits. Until written guidance lands, many institutions are likely to keep planning rather than migrating.
