A joint assessment by the NITDA and the CBN found that only 26 of 44 responding financial institutions, or 59 percent, had completed or were likely to complete the required actions before the deadline. The survey was self-reported rather than a compliance audit, so it reflects what respondents worry about, not a verified picture of the industry. Even so, a gap that wide with the deadline this close is hard to wave away.
Local servers do not automatically mean safer data
The case for localization is real. Nigeria’s reliance on foreign cloud infrastructure leaves critical services exposed to international connectivity failures, policy shifts abroad and contract terms that Nigerian regulators do not control. A stronger domestic cloud sector would also create jobs, keep spending in the country and give regulators more direct oversight.
But geography is not security. A poorly configured Nigerian database is as exposed as a foreign one, and a local provider without disaster recovery can go dark for days. Concentrating essential workloads among a handful of domestic providers could also swap foreign dependency for systemic risk at home. As the CBN’s push for local infrastructure gathers pace, localization should be judged by the risks it removes, not just the workloads it relocates.
The framework is there, the definitions are not
NITDA released its National Cloud Computing Guideline in August 2026. It sets a Cloud First mandate for federal institutions, targets 75 percent cloud adoption by the end of 2030 and classifies government data by sensitivity. It also covers service levels, audit rights, business continuity, portability and exit provisions.
What institutions still lack are binding answers to basic questions:
- What exactly counts as “payment transaction data”?
- Does “managed in Nigeria” mean the physical hardware, administrative control, encryption keys, support staff, or all four?
- How should replicated backups and fraud monitoring that span several jurisdictions be treated?
Without answers, institutions either delay investment or rush migrations that introduce new vulnerabilities, while providers make expensive capacity bets on assumptions that may later prove wrong. The fix is a joint CBN and NITDA implementation circular with binding definitions, technical controls, evidence requirements, exception procedures and phased milestones. Publishing an anonymized version of the readiness survey would also help the industry tell isolated problems from systemic ones.
Boards need to own this too. Localization is not just an IT infrastructure project. It touches operational resilience, compliance, customer trust, procurement, legal liability and capital allocation. Every affected institution needs a board-approved programme covering data inventory, workload classification, third-party dependencies, migration testing, business continuity and provider exit strategies.
Competition has to survive the mandate
Provider assurance should rest on independent testing of uptime, physical security, incident response, recovery capability, staff competence and financial sustainability. Regulators also need to resist turning local-content goals into a protected market for a small group of suppliers. Local cloud providers deserve a fair chance to grow, but customers must keep their bargaining power through open standards, interoperable architectures, transparent pricing and enforceable exit terms. Government procurement should follow normal public-procurement safeguards. Without competition, localization simply replaces foreign vendor lock-in with the domestic kind.
Sovereignty rules must not become a barrier to lawful cross-border digital activity either. Nigeria’s Data Protection Commission should clarify how localization interacts with lawful international transfers, data-protection impact assessments and the duties of controllers, processors and sub-processors. African regulators made the same warning at the recent Data Protection Africa Summit in Lagos, where they said divergent national laws and interpretations can obstruct cross-border digital commerce.
Hashlytics Take
The 59 percent figure is less alarming than it looks, because it comes from 44 self-reporting institutions and not an audit. The more telling signal is the list of questions institutions still cannot answer. Nobody can finish a migration when “managed in Nigeria” has no fixed meaning, and a deadline set before the definitions exist tends to produce paperwork compliance rather than real resilience. If regulators publish the technical rules before mid-2027, the January date can still drive real change. If they do not, expect a wave of institutions that meet the letter of the mandate while keeping the keys, and the risk, exactly where they were.
Follow Hashlytics on Bluesky, Facebook, LinkedIn , Telegram and X to Get Instant Updates
