The Central Bank of Nigeria (CBN) has warned financial institutions against cybersecurity and operational risks associated with growing dependence on cloud computing and third-party technology providers, as more than half of industry respondents indicate readiness to comply with the regulator’s payment data localisation requirements ahead of the January 2027 deadline.
The regulator stressed that data localisation alone cannot guarantee the security of the financial system, urging banks, fintechs and payment infrastructure providers to strengthen cybersecurity, business continuity and risk management arrangements as digital financial services expand.
Lamido Abubakar Yuguda, deputy governor, financial system stability at the CBN, gave the warning at the CBN-National Information Technology Development Agency (NITDA) Executive Regulatory Dialogue on the implementation of the National Sovereign Cloud Initiative (NSCI) and data localisation in Lagos on Wednesday.
At the dialogue, NITDA also disclosed that a survey conducted to assess industry preparedness showed that more than 50 percent of respondents were ready to work towards compliance with the requirements.
The finding points to reported readiness rather than confirmation that the institutions have already fully complied with the directive.
Yuguda said the resilience of Nigeria’s financial system increasingly depended on the reliability and security of the digital infrastructure supporting financial services, as digital payments, fintech, mobile money and digital banking continued to expand.
He said financial institutions and their critical technology providers must maintain robust cybersecurity, business continuity, disaster recovery and risk management arrangements to ensure essential financial services remain secure and available.
“Localisation alone does not guarantee security,” Yuguda said, emphasising that responsibility for managing risks associated with third-party technology providers remained with regulated institutions.
The CBN expects regulated institutions to ensure that critical payment transaction data is stored and managed within Nigeria in line with applicable regulatory requirements and the January 1, 2027 implementation timeline.
Rakiya Opemi Yusuf, director of the CBN’s Payment System Supervision Department, said the requirement was necessary to strengthen regulatory oversight and ensure the regulator could access relevant transaction information when required.
She explained that traditional banking relied on physical documents, ledgers and vouchers stored in bank branches, but the increasing digitalisation of financial services required the CBN to adapt its supervisory approach.
According to Yusuf, payment data must remain accessible throughout its lifecycle, from creation to eventual destruction in line with applicable retention and archiving policies.
She said the regulator needed access to information showing who initiated a payment, what was paid and whether the transaction was successful, particularly for transactions originating in Nigeria.
Yusuf clarified that the requirement did not mean foreign recipients of cross-border payments would be compelled to disclose all information about their own customers. Rather, the focus was on ensuring that payment information generated within Nigeria remained accessible to the relevant authorities.
On enforcement, the CBN said sanctions would not be its first approach, as it preferred to work with stakeholders to achieve compliance. However, the regulator warned that deliberate attempts to disregard the requirements would attract sanctions.
The CBN also indicated that feedback from the industry could inform further consideration of implementation issues. It said responses received through its survey were being analysed and that suggestions would be assessed on their merits, although no change to the implementation deadline was announced at the dialogue.
Yuguda said the sovereign cloud initiative should not constrain innovation or isolate Nigeria from global technological developments, but should provide the security, resilience and regulatory certainty needed to support investment and sustainable growth.
“We must strengthen digital sovereignty while remaining globally competitive; enhance security without constraining innovation; and promote localisation while ensuring that the financial system continues to benefit from efficient and reliable technology,” he said.
Inuwa Abdullahi, director-general and chief executive officer of NITDA, said Nigeria needed greater control over the digital infrastructure on which its economy and financial system depended to protect essential services from external disruptions.
Abdullahi asked what would happen if a major submarine cable disruption or geopolitical crisis prevented Nigerian banks from accessing critical digital infrastructure hosted outside the country.
He said such a disruption could raise serious questions about the ability of citizens to transfer money, businesses to receive payments and banks to continue processing transactions.
“These questions are not technical. They are matters of our national economic security, financial stability and digital sovereignty,” he said.
Abdullahi said the initiative was intended to strengthen Nigeria’s capacity to deliver essential digital services without excessive dependence on external infrastructure, adding that digital sovereignty did not mean isolation or building every technology locally.
He said NITDA and the CBN were working together to make the financial sector the first to comply with the national sovereign cloud initiative, while encouraging collaboration among financial institutions, telecommunications companies, technology providers and the wider innovation ecosystem.
According to him, Nigerian technology companies have the capacity to support the transition, while the government intends to work with global technology providers and major cloud service providers to develop the required infrastructure.
He also said an assurance framework would help establish confidence in providers and their compliance with the requirements of the national sovereign cloud architecture.
The framework would draw on existing international certifications while exploring national certification options to ensure that infrastructure deployed in Nigeria meets the country’s requirements.
Abdullahi added that the initiative was intended to reduce the risk of institutions becoming locked into a particular technology provider, vendor or country, giving them greater flexibility in choosing their technology partners.
He said implementation would require engagement with banks, data centre operators and system integrators to identify existing capacity, address challenges and determine the support needed to meet regulatory requirements.
Yuguda said the CBN would continue to work with NITDA and other stakeholders to align financial-sector requirements with national digital infrastructure standards, noting that implementation required collaboration across regulatory and industry boundaries.
He urged stakeholders to focus on infrastructure readiness, cybersecurity, resilience, implementation challenges, regulatory expectations and the management of third-party and concentration risks.
The CBN said its objective was to build a digital financial ecosystem that supports innovation without compromising security, strengthens national control over critical infrastructure without isolating the country, and remains resilient enough to sustain public confidence.
Related News
Hope Moses-Ashike is an Associate Editor, Banking and Finance, with more than a decade of experience reporting on Nigeria’s financial system and broader economy. She closely tracks market movements, monetary policy decisions, company disclosures, regulatory actions, economic indicators, and global developments, and interprets what they mean for businesses, investors, policymakers, and households. Her reporting helps readers understand complex issues such as inflation trends, foreign exchange market dynamics, interest rate decisions, bank performance, and investment risks.
She also covers major international events and periodically travels to Washington, D.C., to report on the World Bank/IMF Spring and Annual Meetings.
Her dedication to financial journalism has earned her multiple recognitions and invitations to high-level professional development programmes. She is an alumna of the International Visitors Leadership Programme (IVLP) in the United States and holds an Advanced Financial Journalism Certificate from the Press Association Training in London, UK. Her other notable achievements include completing the Lagos Business School CMC Programme, the Bloomberg Media Africa Initiative Programme, and a Master Class in Journalism at Rhodes University in South Africa.
Source: