PSS/DIR/PUB/CIR/001/004, issued on and signed by Dr. Rakiya Yusuf, Director of Payments System Supervision.
The circular requires all financial institutions to store and manage payment data generated in Nigeria inside the country. It lines up with the Nigeria Data Protection Act, 2023, and the stated aims are national data sovereignty, consumer privacy, and timely access for regulators.
The volumes involved explain the infrastructure appetite. The NIBSS Instant Payment platform handled 120% more volume between 2022 and 2024, reaching a record 11.2 billion transactions in 2024 alone. Pair that with a five-year retention requirement and domestic data center operators are looking at sustained demand for server racks, cloud storage, and high-speed connectivity. Analysts at PwC and KPMG both describe the mandate as a fundamental re-engineering of Nigeria’s tech backbone.
Keeping the Database at Home Does Not Satisfy the Rule
PwC stresses that hosting a primary database in Nigeria is only the start. Compliance means full-stack localization: backups, disaster-recovery replicas, analytics extracts, logs, and test environments all have to sit locally too. The firm also warns that poorly designed local recovery sites could weaken systemic resilience, since moving primary and recovery environments into Nigeria without redesigning them may leave both exposed to the same failures.
Institutions will have to prove it. That means assembling a technical evidence pack, including data-flow maps and confirmed hosting locations, well before the deadline. PwC puts the test plainly: Its success will depend on three things: credible compliance, demonstrated through clear technical evidence rather than location alone; payment services that remain reliable throughout and after the transition; and a competitive, sustainable financial industry that can continue to invest and innovate.
Local Operators Have Gaps, Smaller Fintechs Have Bills
The demand is real, but KPMG‘s Tech Risk evaluation found domestic data centers are not fully ready to absorb it. The gaps it flagged include:
- Insufficient power, cooling, and network redundancy
- Limited capacity
- Security and compliance maturity
- Inadequate disaster recovery
- Operational excellence and specialized technical skills
Costs will not fall evenly either. PwC warns the shift favors established incumbents, while smaller fintechs that lean on global cloud providers face higher bills. Matching hyperscaler reliability and compliance locally takes serious capital, which could prove difficult for thinner balance sheets and strengthen better-funded players.
Hashlytics Take
The CBN can legislate demand, but it cannot legislate power and cooling. The gaps KPMG listed are basic ones, and they sit on the supply side of a market that is about to receive a deadline-driven rush of orders. Our read is that the pinch point before 2027 will be capacity rather than willingness to pay, and smaller fintechs will be bidding for the same limited space as incumbents with deeper pockets. The full-stack requirement adds another trap: a bank that simply lifts its existing setup into a local facility may tick the location box while building a more fragile system. The institutions that treat this as an architecture project rather than a hosting move will be the ones with something real to show when the evidence pack is due.
Follow Hashlytics on Bluesky, Facebook, LinkedIn , Telegram and X to Get Instant Updates
