A bill before the House of Representatives has proposed a 10-year prison term and a minimum fine of N500 million for individuals who transfer strategic payment transaction data outside Nigeria without regulatory authorisation.
The proposed legislation also seeks to impose a minimum fine of N1 billion on financial institutions that fail to maintain their primary payment data infrastructure in Nigeria, alongside daily penalties for continued violations.
The bill Sponsored by Lanre Okunlola, member representing Surulere II Federal Constituency of Lagos State, the bill seeks to establish the National Payment Data Protection and Sovereignty Commission to regulate and protect payment transaction data generated within the country.
Titled A Bill for an Act to Establish the National Payment Data Protection and Sovereignty Commission, the proposed legislation seeks to strengthen Nigeria’s control over its financial data infrastructure, address cybersecurity threats and reduce dependence on offshore data storage and processing facilities.
The bill was introduced during a plenary session last week and is expected to be considered by lawmakers in the coming weeks.
Under Section 23, anyone who transfers payment data outside Nigeria without authorisation commits an offence and, upon conviction, faces imprisonment for up to 10 years, a fine of at least N500 million, or both.
Section 22 prescribes a minimum fine of N1 billion for institutions that fail to comply with the proposed data localisation requirements, alongside additional daily penalties for continued violations.
The bill seeks to require financial institutions to store and process domestic payment data within Nigeria, restricting their use of offshore infrastructure.
Section 8 classifies payment transaction data generated within Nigeria as a “Strategic National Economic and Security Asset”, while Section 9 requires such data to be stored within the country.
Under the provision, banks, fintech companies, payment service providers, switching companies and settlement system operators would be required to maintain their primary payment data infrastructure in Nigeria.
The bill also seeks to prohibit regulated financial institutions from hosting their primary payment data infrastructure abroad without approval from the proposed commission, in conjunction with the Central Bank of Nigeria (CBN).
Section 10 further requires domestic payment transactions to be processed through infrastructure physically located within Nigeria.
However, the proposed legislation allows for cross-border data transfers subject to regulatory approval.
Section 18 prohibits the transfer of strategic payment data outside Nigeria without authorisation from the proposed commission, while Section 19 outlines the conditions for granting such approval.
These include the need to fulfil international settlement obligations, protect national security interests, provide adequate safeguards and obtain CBN approval.
The bill also classifies payment transaction infrastructure as Critical National Information Infrastructure and empowers the proposed commission to establish security and resilience standards.
Related News
Source: