How Nigeria's overlapping data rules affect fintechs and banks

In a quiet office in Lagos, a team of developers at a fintech startup huddles around a flickering screen. The screen displays a line of code that will soon be required to be stored on a local data centre, not in a cloud server overseas. The team’s project manager, Awe, looks up from her laptop, her face lit by the glow of the monitor, and sighs. “It’s a puzzle,” she says, and the room falls into a moment of collective understanding, a puzzle that is not just technical, but regulatory.

On June 15, 2026, the Central Bank of Nigeria (CBN) rolled out rules that mandate financial institutions and payment system participants to store and manage payment transaction data generated within Nigeria locally by January 1, 2027. The CBN’s focus is clear: safeguard financial stability, payment systems, and operational risk. For banks, this means every transaction record must live on a server that sits within Nigerian borders, even if the bank’s core banking software runs on a global cloud platform.

Two months later, the Nigerian government unveiled its National Digital Cloud Policy. This policy is not a narrow directive but a comprehensive framework covering cloud adoption, data classification, cybersecurity, and digital infrastructure. NITDA, the National Information Technology Development Agency, is charged with setting technology standards and overseeing cloud infrastructure. Its remit is broader than the CBN’s, encompassing all digital systems across the country, not just financial ones.

The overlapping mandates create a landscape where a single institution can be regulated by multiple bodies simultaneously. A bank, for instance, is governed by the CBN while also hosting its applications on a cloud provider that must meet NITDA standards. A fintech that processes payments under a CBN licence may rely on local data centres, foreign software, or cross‑border backup services, all of which fall under NITDA’s purview. Awe explains, “I look at it more as a question of regulatory overlap.” The CBN can impose technology and cloud requirements on financial institutions because of its sector‑specific mandate, while NITDA has a broader responsibility for national information technology and cloud policy. The Nigeria Data Protection Commission adds another layer, especially where personal data and cross‑border transfers are concerned.

For the fintech team in Lagos, the new rules mean re‑architecting their data storage strategy, negotiating with local data centre providers, and ensuring that every transaction record complies with both CBN and NITDA requirements. The cost of compliance is not just monetary; it is also about time and expertise. The team’s lead developer, Awe, notes that the dual‑regulation environment forces them to hire a compliance officer, a role that did not exist before. The added overhead is a reminder that regulatory clarity is as important as technological innovation.

From my perspective as a writer who follows the pulse of African tech, the real challenge lies in harmonising these overlapping mandates. The current structure risks creating a costly compliance maze for fintechs and banks alike. A clearer, unified framework would allow innovators to focus on building services rather than navigating a labyrinth of regulations. Until then, the fintech ecosystem in Nigeria will continue to tread a tightrope between localisation demands and global cloud opportunities.

The next step for Nigeria will be to convene stakeholders from the CBN, NITDA, and the Nigeria Data Protection Commission to draft a cohesive data‑localisation strategy. Only then can the country fully harness the potential of its burgeoning fintech sector without compromising on security or operational efficiency.