CBN Sets 2027 Deadline for Domestic Payment Data Storage

The Central Bank of Nigeria’s data-sovereignty mandate has a fixed date, and the clock is already short. From January 1, 2027, the CBN will require financial institutions and participants in the payments system to store and manage payment transaction data generated in Nigeria within Nigeria. The circular, issued on June 15, gives affected firms roughly six and a half months between issuance and compliance. Regulators, bankers and infrastructure operators alike describe the window as demanding given what the rule actually requires them to move.

The requirement itself is narrower than much of the public discussion suggests. Nigeria already operates a legal framework for cross-border transfers of personal data. The Nigeria Data Protection Act recognizes circumstances in which personal data may leave the country, subject to conditions such as an adequacy decision, an approved cross-border data-transfer instrument, or specified legal bases. Data sovereignty is not synonymous with absolute isolation; the country can build local facilities and still participate in global digital infrastructure. The harder governance question, the one now preoccupying compliance teams, is who controls the systems that surround the data.

That question is being tested against the reality of Nigeria’s infrastructure build-out. Industry estimates put the country at roughly 26 data-center facilities, of which about 18 operate commercially, though the figures shift depending on what counts as operational and whether private corporate installations are included. Most of the commercial market is concentrated around Lagos. The expansion has been rapid. OADC announced plans in 2025 for a $240 million expansion of its Lagos facility to 24MW by 2027, part of a broader $500 million African investment program, with CEO Dr Ayotunde Coker now designing for roughly 40MW within the same development shell as AI demand reshapes plans. Rack Centre commissioned its 12MW LGS2 facility in 2025, a Tier III, carrier and cloud-neutral site serving enterprises, cloud providers and financial institutions. MTN Nigeria has committed more than $240 million to a 9MW Dabengwa data center in Ikeja, whose first phase was designed as a 4.5MW Tier III facility with cloud infrastructure developed alongside Dell Technologies. Kasi Cloud broke ground in 2022 on a campus in Lekki initially described as a $250 million project; four years later its first phase is commissioned, with the campus designed to scale toward 100MW for hyperscale cloud and AI workloads.

Yet the gap between announced and usable capacity remains one of the least visible features of this boom, and it carries direct compliance consequences. Engineer Adetola Ibironke, General Manager for Systems Engineering and Projects at PPC Limited, argues that Nigeria remains in a “critical build-out phase.” “Announced capacity must not be confused with operational capacity,” he says, noting that projects sit at different stages of construction, commissioning and customer onboarding. A building can be finished while its computing equipment is still being installed. A facility can have power infrastructure without the required IT load, or racks without the cloud platform, cybersecurity controls or network redundancy a regulated financial institution needs.

Meanwhile, tier classification, the industry’s standard measure of redundancy and availability, answers only part of what regulators and banks must ask. Tier IV represents the highest level in the Uptime Institute’s classification system, and Galaxy Backbone’s Kano facility in northern Nigeria holds certification for both Tier IV design documents and the constructed facility; the company describes its Abuja site as Tier III, and Uptime’s database lists numerous Nigerian facilities with Tier III certification. But tiering addresses resilience, not migration readiness. It does not tell a bank whether an application can move without redesign, or whether a facility has sufficient GPU capacity, data-governance controls, cyber defenses or specialist personnel. “Building a facility to a particular Tier standard does not automatically make the data hosted there secure, sovereign or resilient,” says Kemisola Adalumo, a Nigerian cybersecurity, governance, risk and compliance and AI-governance specialist.

The distinction between physical and operational sovereignty is where the accountability question sharpens. Favour Egbogun, a doctorate researcher focused on AI governance at Covenant University’s Communications Department, puts it plainly: “A bank can store its primary records in Lagos and still send that same data abroad every day for analytics or technical support.” She argues Nigeria needs clarity across the entire data lifecycle: who controls data, who processes it, who can access it, why, and under which jurisdiction. For AI the question becomes sharper still, because a model does not merely store information but processes it. A Nigerian bank could host its transactional database locally while relying on a foreign AI service to detect fraud, transcribe calls or analyze customer behavior.

By contrast, Coker, who previously served as Group Chief Information Officer at Access Bank, Nigeria’s biggest lender, notes that two institutions can satisfy the same rule through different architectures: hosting and processing locally, or hosting locally while computing internationally. Business Day reported in July that banks had largely localized payment transaction data, while fintechs, digital banks and other institutions still hosting data overseas faced growing pressure to complete migrations, with the sector still working through infrastructure, cybersecurity and compliance issues.

Underlying all of it is the industry’s oldest constraint: electricity. The Africa Data Centres Association’s 2026 economic report says power availability has overtaken connectivity as the continent’s principal constraint, and its 2025 survey identified power reliability and talent shortages as key limits. Operators spend heavily on generators, batteries and redundancy; Kasi Cloud plans a mix of gas, solar and battery storage at Lekki, while Coker is examining gas-based captive power at OADC’s site. “Africa’s opportunity has actually become power,” he says. Imported equipment adds foreign-exchange exposure, which Ibironke says compounds the challenge alongside power generation and cooling costs.

The ADCA estimates Africa held about 360MW of live data-center capacity in 2026, with 238MW under construction and 656MW planned, yet the continent accounts for only about 0.6% of global capacity despite roughly one-fifth of the world’s population. Nigeria is competing not merely to satisfy a domestic compliance deadline but to capture a share of a far larger market. For Ibironke, ownership means having enough local infrastructure, talent and capability to decide where data lives and how it serves African enterprise. The first test of whether Nigeria’s institutions can deliver on that arrives next January.