CBN Payment Data Localisation Circular 2026: What Banks, Fintechs and Customers Need to Know

The CBN payment data localisation circular 2026 is one of the biggest regulatory changes the Nigerian payments industry has faced in years. Issued by the Central Bank of Nigeria (CBN) in June, it requires banks, fintechs and other payment operators to store and manage payment transaction data generated in Nigeria inside the country. The same circular also introduces ownership disclosure rules and caps on market concentration. With the deadline only a few months away, here is what the circular says, who it affects and what the debate is about.

CBN Data Localisation Circular: Key Facts

Who Must Comply?

The circular is addressed to a wide range of institutions in the payments ecosystem:

• Deposit money banks (DMBs)
• Microfinance banks (MFBs)
• Mobile money operators
• Switching and processing companies
• Payment terminal service providers (PTSPs)
• Payment solution service providers (PSSPs)
• Super agents and other licensed payment operators

1. Data Localisation: What Changes

The core rule says that all financial institutions and participants facilitating payments in Nigeria must ensure that payment transaction data generated within Nigeria is stored and managed in Nigeria. The requirement takes effect from 1 January 2027 and is to be applied in line with Nigerian data protection laws.

Law-firm commentary notes that the rule is framed around where the data is generated, not where the company is based. That means foreign-owned or foreign-hosted operators serving Nigerian transactions may also be affected. Commentators also say the requirement may reach related systems such as analytics and monitoring platforms and test or development environments that use live payment data, although the exact scope will depend on how the CBN interprets the circular.

The CBN’s stated aims include strengthening data security, improving regulatory oversight and keeping critical payment information under Nigerian jurisdiction.

2. Ultimate Beneficial Ownership (UBO) Disclosure

Banks, payment service providers and other institutions with digital payments operations must disclose the ultimate beneficial owners of their significant shareholders. They must also keep accurate, up-to-date records of beneficial ownership and provide them to the CBN on request. The CBN says this is consistent with existing anti-money laundering, counter-terrorism financing and counter-proliferation financing rules.

3. Market Share Limits

The circular also introduces structural limits to reduce concentration in key payment segments:

• An institution with more than 25% of the consumer issuing market over a rolling 12-month period cannot hold more than 15% of the merchant acquiring market in the same period.
• An institution with more than 25% of merchant acquiring cannot hold more than 15% of consumer issuing.
• The limits apply whether the activity is carried out directly or through related entities within the same group.

All regulated entities must also submit monthly market share returns using templates prescribed by the CBN. Institutions have until 31 December 2026 to align their operations with these requirements, and the CBN says it will enforce compliance through supervisory measures.

How It Fits With the Nigeria Data Protection Act

Legal analysts say the circular supplements, rather than replaces, the Nigeria Data Protection Act 2023. Covered institutions will therefore have to comply with both the CBN rule and the NDPA at the same time.

The Debate: Support and Concerns

Many people support data sovereignty in principle, and the Association of Licensed Telecom Operators of Nigeria (ALTON) has been reported as backing the rule. Critics, however, question how practical the timeline is. One opinion piece argues the CBN gave the industry roughly six months to comply without making sure the local infrastructure, cloud ecosystem and operational readiness are in place. The same commentary points out that the circular does not define what “managed” in Nigeria means, which could create uncertainty about whether processing by offshore cloud providers or global vendors would be allowed. Compliance will probably be harder for firms that rely heavily on overseas cloud services or global processors.

These are views from commentators, not CBN positions. Watch for any further guidance or clarification from the regulator.

What It Means for Customers

For everyday users of bank apps, POS terminals and mobile wallets, there is no action to take. The rules are aimed at institutions. In practice, the changes could affect how providers host their systems and how fast they roll out new services, but the CBN says the goal is stronger oversight and a more competitive, resilient payments system.

What Companies Should Do Now

• Map where payment transaction data is stored, processed and backed up, including by third-party vendors.
• Check cloud, analytics and testing environments that use live data.
• Prepare beneficial ownership records for submission to the CBN.
• Review market share positions in consumer issuing and merchant acquiring.
• Seek legal advice on the circular’s scope and on how it interacts with the NDPA.

Frequently Asked Questions

When does the CBN data localisation rule start?

Data localisation takes effect on 1 January 2027, and the market structure requirements must be met by 31 December 2026.

Which data is covered?

Payment transaction data generated within Nigeria’s payments system.

Does it apply to fintechs?

Yes. The circular covers banks, fintechs, mobile money operators, switches, PTSPs, PSSPs, super agents and other licensed operators.

What is the market share rule?

A firm with over 25% of one segment (consumer issuing or merchant acquiring) cannot hold more than 15% of the other.

Is my personal data now stored only in Nigeria?

The circular covers payment transaction data generated in Nigeria. Your provider’s privacy policy will explain how it complies.

Where can I read the circular?

The circular is available on the CBN website under its payments system publications. Search for its reference number, PSS/DIR/PUB/CIR/001/004.