A bill introduced in Nigeria’s House of Representatives seeks to make payment data a national strategic asset, stored and processed on Nigerian soil. Banks, fintechs and payment operators that failed to comply would face a fine of at least 1 billion naira. The bill comes as the Central Bank already requires this data to be localized by January 1, 2027, and many institutions are not ready.
What the bill contains
The bill seeks to create a “national payment data protection and sovereignty commission”. It is sponsored by lawmaker Lanre Okunlola, who represents the Surulere II constituency in Lagos, and was presented in plenary session during the week before November 2, 2026, according to Business Post and TheNigeriaLawyer, which detail its sections:
- section 8: transaction data generated in Nigeria becomes a strategic asset for the country’s economy and security;
- sections 9 and 10: it must be stored within the country, and domestic payments must pass through infrastructure physically located in Nigeria;
- sections 18 and 19: any transfer abroad requires the approval of the future commission, granted only if the transfer serves international settlement obligations, national security is preserved, adequate safeguards exist and the Central Bank (CBN) has given its approval;
- section 22: an institution that does not comply with the localization requirement faces a minimum fine of 1 billion naira, plus daily penalties for as long as the violation continues;
- section 23: an unauthorized transfer out of the country can lead to up to ten years in prison and a fine of at least 500 million naira, or either penalty.
The scope is broad: banks, fintechs, payment service providers, switching companies and settlement system operators. The bill also classifies payment infrastructure as critical information infrastructure and tasks the commission with setting minimum cybersecurity and resilience standards. The articles consulted, however, do not specify the composition, funding or governance of this new authority, nor the amount of the daily penalties.
A bill that duplicates a directive already in force
The bill does not start from scratch. According to Techpoint Africa, the CBN issued a directive on June 15, 2026 requiring providers to keep their payment data in Nigeria by January 1, 2027 at the latest. Business Post specifies that this requirement covers point-of-sale terminal, web and mobile transactions, which must be stored and processed in local data centers. The Central Bank sees it in particular as a way to curb capital flight, according to Business Post.
What changes with the bill is the nature of the constraint. The directive is a Central Bank circular; the bill would add criminal penalties, including prison for individuals, and a new body whose approval would be required in addition to the CBN’s for any transfer abroad. Techpoint Africa sums up the split: the 2027 deadline stems from the existing circular, while the commission and the penalties depend on the bill being passed.
Institutions far from ready
The timeline is already a problem. Techpoint Africa cites a survey by the national IT agency, NITDA, conducted in October 2026: only 59% of the financial institutions surveyed had completed, or expected to be able to complete, the necessary work before the January deadline. Of 44 respondents to this question, 22 had not started. The same agency estimates that Nigerian companies spend more than $850 million a year on cloud computing services.
The firm PwC, again according to Techpoint Africa, warned that these rules could put pressure on small operators that rely on international cloud providers. According to Business Post, institutions will have to invest heavily in local cloud infrastructure or partner with Nigerian data center operators, which immediately increases their costs, particularly for startups.
What to watch
The text is only a bill. Techpoint Africa stresses that it is not a requirement in force, and Business Post says debates are expected in the coming weeks. Several points will determine its scope: the conditions for authorizing flows linked to international settlement obligations, the division of roles between the future commission and the CBN, and the level of the daily penalties. For regulated institutions that currently host their payment data abroad, the stakes are direct: according to TheNigeriaLawyer, the bill would prohibit them from doing so without the approval of the commission and the CBN.
Frequently asked questions
Is local storage of payment data already mandatory in Nigeria?
Yes, under a Central Bank directive issued on June 15, 2026, which sets the deadline at January 1, 2027. The bill would add criminal penalties and a dedicated commission.
Who would be affected by the 1 billion naira fine?
Regulated institutions that do not localize their data: banks, fintechs, payment providers, switching companies and settlement operators. Unauthorized transfers also expose the individuals responsible to a prison sentence.
Can the bill still change?
Yes. It has been presented in plenary session and is not yet law; according to Business Post, lawmakers are expected to examine it in the weeks following its presentation, and its content may change in the meantime.
Sources
- Banks, Fintechs Face N1bn Fine for Exporting Payment Data Under New Bill — Business Post Nigeria, 2026-11-02
- Banks, Fintechs Must Store Primary Payment Data In Nigeria — Reps Bill Proposes ₦1bn Fine For Violators — TheNigeriaLawyer, 2026-11-02
- Nigeria considers ₦1 billion penalty for payment data violations — Techpoint Africa, 2026-11-06