Banks warned against sacrificing resilience for data localisation

Banks and payment service providers in Nigeria have been urged to strengthen their data protection systems without undermining the resilience of financial services or their ability to conduct cross-border transactions as new data localisation rules approach.

Executives at the 7th CIO and C-Suite Awards Africa in Lagos on Tuesday warned that keeping payment data within Nigeria could create operational challenges if institutions failed to invest in reliable infrastructure and maintain links with international payment networks.

The Central Bank of Nigeria’s data localisation directive, issued on 15 June 2026, requires financial institutions and participants facilitating payments within the country to store and manage payment transaction data generated in Nigeria locally from 1 January 2027. The directive is intended to strengthen domestic control over financial data while raising questions about the capacity of local infrastructure to support the requirements.

In a keynote address, the Director of the CBN’s Payments System Supervision Department, Rakiya Yusuf, described data localisation as increasingly important to national security, financial system stability and the development of domestic digital infrastructure. She also acknowledged the costs and technical constraints that could accompany its implementation.

“Effective localisation requires reliable power, connectivity, data centres, cloud infrastructure and cybersecurity capabilities,” she said, warning that institutions could face higher operating costs and reduced efficiency where the necessary capacity was inadequate.

The policy could stimulate investment in data centres, cloud computing, telecommunications infrastructure and digital platforms. However, its implementation also raises questions about how Nigerian financial institutions will manage international transactions and technology partnerships that depend on cross-border data flows.

The Chief Operating Officer of FMDQ Depository Limited, Emmanuel Alao, argued that data sovereignty should not come at the expense of interoperability, which enables financial institutions and markets to transact across jurisdictions.

“Isolation is out of the question,” Alao said, stressing the need to maintain data flows and comply with international standards while protecting critical information.

He warned that poorly designed restrictions could undermine transaction processing, cross-border investment flows and the network effects that support financial markets across Africa.

The Divisional Head of Information Technology and Operations at FSDH Merchant Bank, Emeka Oboegbune, described the policy as an opportunity to improve domestic technology infrastructure but cautioned against creating new vulnerabilities in the process.

He called for a national resilience framework to ensure that local data hosting did not introduce single points of failure or weaken the reliability of financial services.

The Partner at Deloitte, Wole Oyeniran, urged financial institutions to use the requirements as an opportunity to redesign their payment systems rather than treat compliance as a regulatory checklist.

He recommended that institutions map payment data flows, classify information according to risk and identify which categories required local storage, while considering security, performance and operational resilience.

“Rather than thinking of either migration or compliance, rather optimise your operation,” Oyeniran said.