Six months data localisation directive not feasible-Experts - The Guardian Nigeria News

Central Bank of Nigeria headquarters, Abuja.

Central Bank of Nigeria headquarters, Abuja.

Industry experts and cybersecurity analysts have warned that the government’s six-month deadline for full data localisation by January 2027 is virtually impossible to achieve.

Citing severe infrastructure constraints, complex technical migrations, skyrocketing compliance costs, and largely poor Central Bank engagement, leaders from the banking, Fintech and tech sectors argued that forcing such an aggressive timeframe risks widespread service disruptions and standard compliance failures across the digital economy.

The Central Bank of Nigeria (CBN) issued a data localisation directive on June 15, 2026 (Circular PSS/DIR/PUB/CIR/001/004). It mandates all licensed financial institutions, payment service providers, and fintechs to store and process all Nigerian payment transaction data locally on domestic infrastructure by January 1, 2027.

While the directive aimed to enhance data sovereignty and security by keeping citizen data within national borders, stakeholders maintain that building compliant cloud architecture typically requires years, not months.

They stressed that without a phased implementation roadmap, major service providers may be forced to suspend operations.

These deliberations formed part of major discussions in Lagos, Thursday, during a panel session at the GrowthX Forum, organised by TechEconomy. Key tech leaders and banking executives expressed rising concern that the given six-month timeline is severely unfeasible.

Panelists argued that forcing full migration onto local servers by January 2027 risks forcing institutions into superficial “box-ticking” compliance rather than building operational resilience.

The Chief Technology Officer, FCMB, Blessing Ehize, highlighted a major regulatory gap.

He stressed that a major point of friction is the perceived lack of direct regulatory engagement trailing the policy announcement.

Ehize disclosed that despite attempts through groups like the Committee of Bank CIOs, clarity remains elusive regarding what specific data must sit on-premise versus what can reside in hybrid cloud environments.

“Now, this is the problem. To bring payment data back on-premise, for the last three months, we’ve not been able to engage effectively with the Central Bank as the Committee of Bank CIOs to get clarity on these issues. I mean, you can ask, I’m representing banks. From what I know, there’s not been a meeting held to say, ‘This is what it means’ in terms of clarity. So it’s vague. You start thinking, ‘Are we really trying to play with the financial sector?’ This is where we need to start from: draw a roadmap. By this milestone, we should have done this. We really have the capacity to do this as a country, but we just need to plan it and not rush the Nigerian way,” he stated.

On his part, Deputy Managing Director, eTranzact, Hakeem Adeniji-Adele, however, said the CBN has been engaging the Fintech community, “Maybe due to our sophistication and versatility, we have been engaged by the CBN. More discussions are still very much on.”

Adeniji-Adele, however, flagged the six months deadline, stressing that the timing is rather too short, looking at the enormous data sitting in the cloud somewhere.

“I believe, is quite short, simply because of the amount of load that needs to be moved. I feel the solution should be a phased approach. Compute and storage should be divided into two, as opposed to telling everyone to move at once.”

However, on the readiness of the tech and data ecosystem to host data, locally, the Chief Executive Officer, Open Access Data Centre (OADC), Dr Ayotunde Coker, advised banks to respond very quickly in assessing the data that they have locally and internationally.

Emphasising the readiness of the Data Centre sub-sector for the possible surge, Coker said: “They should also look at the capacity and capability of where they want to migrate to and to do that effectively, and then come up with the implementation plan. Banks should not see the directive from CBN as an impossible task.

“They should start off by architecting the solution and the roadmap to achieving it quickly. If there are any hiccups in that process, they can present it and demonstrate how they will manage the risk. Banks must be active and not passive in carrying out the CBN’s directive on data localisation.”

The OADC boss further advice the banks to spread their data to different data centres, since we have multiple data centres and multiple cloud providers. They should also begin the investigation of how the data centre services will be provided to meet bank’s migration plans.