CBN directs banks, PSPs to store, manage payment transaction data : Here is what it means.
The Central Bank of Nigeria has told banks, fintech companies, and payment service providers to keep all payment transaction data generated in Nigeria right here in Nigeria and has given them until January 1, 2027 to comply.
The directive, contained in a circular signed by Rakiya Yusuf, director of the payments system supervision department, is part of a broader set of rules that also targets hidden ownership structures and the growing dominance of a handful of players in Nigeria’s digital payments market.
Here is what it all means and why it matters.
CBN issued three distinct directives:
The first is data localisation. Every financial institution and payment participant facilitating payments in Nigeria must ensure that the transaction data those payments generate is stored and managed within the country, in line with Nigerian data protection laws. The deadline is January 1, 2027.
The second is beneficial ownership disclosure. Banks, PSPs, and other financial institutions with digital payment operations must disclose the ultimate beneficial owners, particularly where significant shareholding is involved. This is tied to Nigeria’s anti-money laundering and counter-terrorism financing obligations. Institutions must keep these records accurate, up to date, and available to CBN on request.
The third is market concentration limits. No single institution can dominate both major ends of the card payment chain at the same time. Any institution controlling more than 25 percent of the card issuing market will be restricted to no more than 15 percent of the merchant acquiring market, and vice versa. All affected institutions must submit monthly market share returns to CBN and must comply with the new market structure rules by December 31, 2026.
Why CBN is doing this
On data localisation, the concern is straightforward: a large portion of Nigerian payment transaction data currently sits on servers outside the country in the United States, Europe, and elsewhere. When CBN or Nigerian law enforcement needs to investigate fraud, a dispute, or a financial crime, they often have to go through foreign companies or foreign legal processes to get that data. Localisation fixes this by keeping the data within Nigerian jurisdiction where regulators can access it directly.
On beneficial ownership, the problem CBN is responding to is that many fintech and payment companies are structured in ways that make it hard to know who truly owns them. Offshore holding companies, nominee shareholders, and complex group arrangements can obscure the real owners. Without knowing who ultimately controls a payments institution, it becomes difficult to know whether sanctioned individuals, politically exposed persons, or bad actors have exposure to Nigeria’s payment infrastructure.
On market concentration, the numbers speak for themselves. Interswitch’s Verve card network holds approximately 75 percent of Nigeria’s card issuing market, with over 85 million cards issued. That is significant dominance in a critical piece of financial infrastructure. The new rules are designed to prevent any single institution from controlling both the card issuing side and the merchant acquiring side of the market simultaneously which would effectively give them end-to-end control over how Nigerians pay and how merchants get paid.
What it means for different players
For large companies like Interswitch, OPay, and Moniepoint, this is the most disruptive development. Companies that have built dominant positions across multiple segments of the payments chain will need to restructure before the December 2026 deadline. Some may need to divest parts of their operations, create separate legal entities, or voluntarily scale back in one segment to remain active in another.
For foreign-backed players like Flutterwave and Paystack, the UBO requirement is particularly relevant. Both are ultimately controlled by foreign investors and will need to be fully transparent about that ownership structure, all the way up to the ultimate beneficial owners, not just at the level of their Nigerian operating entities.
For smaller fintechs and payment companies, the market concentration caps could create new opportunities. If dominant players are forced to pull back in certain segments, space opens up for others to grow. The monthly market share reporting CBN is mandating will also give the regulator visibility to detect if smaller players are being squeezed out of the market unfairly.
For data centre operators in Nigeria, this directive is a significant business opportunity. Banks and PSPs that currently store data on foreign cloud servers will need to migrate to local infrastructure before January 2027. Nigerian data centre operators and local cloud providers stand to benefit considerably from that migration.
The tensions and risks to watch
Compliance cost is a real concern. Building or leasing local server infrastructure is expensive. Large banks and well-funded fintechs can absorb that cost. Smaller payment operators may struggle, and if they cannot comply, they risk either sanctions or being pushed out of the market entirely — which would ironically worsen the concentration problem CBN is trying to solve.
Cross-border transactions also create complexity. Many payment companies process transactions that touch multiple countries. CBN’s directive needs to be clearer about how “data generated in Nigeria” is defined when a single transaction involves parties or infrastructure in more than one jurisdiction. That guidance will matter for international payment processors operating in Nigeria.
Enforcement is the final variable. CBN has a track record of issuing strong directives and then enforcing them unevenly. The December 2026 and January 2027 deadlines will be the true test of whether this circular has real teeth or becomes another regulation that is honoured mostly in the breach.
The directive set off immediate debate online, with fintech workers and tech commentators split on whether it’s workable.
Some reactions focused on the economic downside:
The bigger picture
What CBN issued this week is essentially a maturity test for the industry. The message is clear: the era of building fast and figuring out the regulatory details later is over. The infrastructure of Nigerian payments must now be transparent, locally accountable, and structured in a way that no single failure can bring down the whole system.
Whether the institutions affected will comply on time, and whether CBN will enforce consistently, is the story to watch between now and the end of 2026.
