On 15 June 2026 the Central Bank of Nigeria issued Circular PSS/DIR/PUB/CIR/001/004, requiring every institution that facilitates payments in Nigeria to store and manage payment transaction data generated in Nigeria on infrastructure located in Nigeria. The deadline is 1 January 2027. This is not a consultation. It is a binding directive with supervisory sanctions attached.
The circular makes explicit what has been a quiet architectural fact of the Nigerian financial system: the record of the country's payments has, for much of the digital era, lived outside the national boundary. Cloud regions abroad, offshore data centres and cross-border processing arrangements have carried the transaction history of a nation whose regulators never had full sight of where that record sat. The directive ends that arrangement on a fixed date.
The operative sentence of the circular is precise:
All Financial Institutions and participants facilitating payments within Nigeria shall ensure that payments transaction data generated within Nigeria are stored and managed in Nigeria in accordance with data protection laws and regulations applicable in Nigeria.
CBN Circular PSS/DIR/PUB/CIR/001/004 · 15 June 2026
Two dates matter. Market-structure requirements — caps on card-issuing and merchant-acquiring concentration, ultimate beneficial ownership disclosure, and automated monthly market-share submissions — take effect on 31 December 2026. The data residency requirement binds from 1 January 2027. The scope is the entire payments ecosystem: deposit money banks, microfinance banks, mobile money operators, switching companies, payment terminal service providers, payment solution service providers, super agents and every other licensed payment participant. There are no carve-outs for small operators, startups or low-volume processors.
The compliance question is an infrastructure question
The directive does not say "use a Nigerian cloud." It says the data must be stored and managed in Nigeria. A foreign cloud provider may still be used, but the physical residency of the record — servers, backups, disaster recovery, audit logs — must be domestic. That distinction is the heart of the matter. Institutions that have been running on AWS, Azure or Google Cloud in regions outside Nigeria are not compliant simply by signing a new contract; the infrastructure that holds the data must sit inside the national boundary.
Compliance therefore becomes an inventory exercise and an engineering exercise at once. Institutions must know, with evidence, where every payment data set generated in Nigeria physically resides — primary stores, replicas, caches, backups, the derived data in analytics and fraud systems. Then they must decide which workloads migrate, in what order, with what tolerance for downtime. Then they must prove the position to the CBN and, where personal data is concerned, to the Nigeria Data Protection Commission.
National systems made visible
The directive aligns Nigeria with a global movement. Regulators in every major economy are asking where critical financial data lives, because the answer determines jurisdiction, resilience and control. Data stored offshore is data subject to foreign legal process, foreign outages and foreign policy. For a nation building sovereign digital infrastructure, the location of the record is not a technical footnote; it is a statement of where authority sits.
This is where the Nigeria Data Protection Act 2023 and the NDPC enter. The NDPA establishes the general law: lawful processing, accountability, and the protection of Nigerians' personal data. The CBN circular adds a sectoral, time-bound requirement on top of that general law, and the two instruments now operate as one compliance programme. Institutions registered with the NDPC as data controllers of major importance, or otherwise licensed by the CBN, must satisfy both. The January 2027 deadline concentrates both obligations into a single operational plan.
Four pillars, one deadline
The data residency requirement is one of four pillars in Circular PSS/DIR/PUB/CIR/001/004, and it is the pillar with the hardest date. The others — caps on any single institution's share of card issuing or merchant acquiring, disclosure of ultimate beneficial ownership, and automated monthly submission of market-share data using CBN-approved templates — are structural reforms to the payments market itself. They reshape who can dominate the ecosystem. The localisation pillar reshapes where the ecosystem's record physically lives. Together they describe a regulator bringing the payments industry fully inside Nigerian law, Nigerian jurisdiction and Nigerian infrastructure.
What institutions should do now
- Inventory the record. Map every payment data set generated in Nigeria and its physical location — including backups and derived stores.
- Decide the residency strategy. Which workloads move to domestic infrastructure, in what order, and with what accepted downtime.
- Engineer for evidence. Residency is only compliance if it can be demonstrated. Logs, attestations and control documentation must be production-ready, not reconstructed after the fact.
- Treat it as architecture, not procurement. The institutions that complete this well will hold a stronger, more controllable data estate — a durable asset, not a regulatory cost.
The position of this Journal
The path to green white green is the work of bringing the national record inside the national boundary. It is legal, operational and infrastructural at once. Kaliabe builds the sovereign data infrastructure that makes the directive operable: in-country hosting, data residency by rule, encryption at rest and in transit, and evidence systems that let institutions demonstrate where the record lives.
The market has six months of running room before the first structural deadlines, and until January 2027 to complete the migration. That is short enough to demand decisions now, and long enough to make them properly. This Journal will track the programme as it develops — the deadline, the market response and the infrastructure that answers it. National systems made visible, one article at a time.
FIG. J1 — DATA FACILITY + SURVEY · NIGERIA · RESIDENCY, BY RULE