Your payment data has a new address: Nigeria.
The Central Bank of Nigeria now requires payment transaction data generated in Nigeria to be stored and managed inside the country. Here is what the rule actually covers, and how Promethean helps regulated institutions meet it without weakening resilience.
What the Circular actually requires
On 15 June 2026, the CBN issued a Circular on market structure, data localisation, beneficial ownership and systemic oversight in Nigeria's payments system. The data localisation piece is simple to state and harder to execute: payment transaction data generated in Nigeria must be stored and managed inside Nigeria, in line with the Nigeria Data Protection Act, 2023.
It applies to:
Four linked requirements, one deadline that bites hardest
Each pillar has its own evidence trail — but for most institutions, localisation is the one with the deepest technology footprint.
Market structure caps
An operator above 25% share in consumer issuing or merchant acquiring must hold its share in the other activity to 15%, with monthly returns to the CBN.
Data localisation
Payment transaction data generated in Nigeria — primary copies, backups and recovery sites — must be stored and managed in-country.
Beneficial ownership
Operators must disclose and keep current records of significant shareholders, in line with AML/CFT/CPF rules.
Systemic oversight
Ongoing CBN monitoring, with supervisory sanctions available where institutions fall short of the requirements.
of the financial industry already reports being compliance-ready, per the CBN's own readiness survey.
“This is about our sovereignty, clarity and visibility over our transaction data.”
— Dr. Rakyat Yusuf, Director, Payment System Supervision Department, CBN, at the CBN–NITDA Executive Regulatory Dialogue, Lagos, October 2026
Hosting a server in Lagos is not the same as being compliant.
A primary database inside Nigeria doesn't prove compliance on its own. The requirement covers the full data lifecycle — and institutions that only move their main database often leave a trail of copies behind:
How Promethean helps
Promethean helps Nigerian financial institutions map their real data footprint, close the compliance gaps and run on infrastructure that stays firmly inside Nigeria — including PCIS Cloud, our own in-country cloud and managed-server infrastructure.
IT Consultancy
End-to-end mapping of where your payment data actually lives today, and a gap register against the Circular.
See IT Consultancy →Managed IT Services
24/7 monitoring, patching and support for the systems that touch payment data, handled by our team.
See Managed IT →Cybersecurity & Backup
Encrypted, in-country backup and recovery design, plus the security controls regulators expect to see.
See Cybersecurity →PCIS Cloud Infrastructure
Nigeria-hosted VMs, managed servers and storage from our sister company PCIS, for workloads that must stay in-country.
Explore PCIS Cloud →A realistic path to January 2027
Map and baseline
Map where payment data is stored, replicated and processed; identify every offshore copy.
Design and contract
Design the in-country primary + disaster-recovery architecture and line up migration.
Market structure compliance
Monthly market share returns in place, submitted in the CBN's prescribed format.
Data localisation compliance
Primary, backup and recovery data in Nigeria; offshore copies repatriated or deleted.
Sustain and test
Regular failover and continuity testing, with results reported to the board.
Start your data localisation readiness assessment
Promethean will map your current data footprint, flag the gaps against the CBN Circular, and design an in-country hosting plan that's ready well before 1 January 2027.
This page is general information for Nigerian financial institutions and payment operators, not legal or regulatory advice. It summarises the CBN Circular on Market Structure Requirements, Data Localisation, Ultimate Beneficial Ownership Disclosure, and Systemic Oversight Measures (15 June 2026). Institutions should confirm their own obligations directly with the CBN and their legal and compliance advisers.
Background research: PwC Nigeria, “CBN data localisation and market structure rules” (2026); CBN–NITDA Executive Regulatory Dialogue on the National Sovereign Cloud Initiative, Lagos, October 2026.