The Central Bank of Nigeria (CBN) has published frequently asked questions clarifying its June 15, 2026, data localisation circular, which requires regulated institutions to store, process and manage payment transaction data generated in Nigeria within the country throughout its lifecycle. The guidance reaffirms the January 1, 2027, compliance deadline, with no phased compliance beyond that date, automatic grace period or grandfathering for legacy systems. Existing hosting contracts and reliance on international group infrastructure do not exempt institutions from compliance.
Localisation extends beyond primary transaction databases to supporting records, operational management, backups, disaster recovery environments and archives. Institutions must maintain evidence demonstrating continuous compliance and ensure that data remains accessible for supervisory review under Nigerian legal and regulatory control. Any cloud deployment model may be used, and outsourcing is permitted, but regulated institutions retain responsibility for compliance. Vendor arrangements must preserve regulatory access and audit rights, supported by due diligence, contractual safeguards and ongoing monitoring.
Remote support requires CBN approval and controls to prevent unauthorised offshore storage, replication or transmission of regulated data. For international payments, only information necessary for processing by international card schemes, correspondent banks and other legitimate counterparties may be transmitted, while storage and management must remain in Nigeria. Information needed for chargebacks, fraud investigations and dispute resolution may also be shared where operationally necessary, subject to applicable legal, regulatory and security controls.