Nigeria Payment Data Rule Sets 2027 Onshore Hosting Deadline

Nigeria’s central bank has turned payment-data residency into a dated infrastructure requirement: Capacity Media reported that licensed payments companies must keep locally generated transaction data inside the country from 1 January 2027.

The circular covers banks, fintechs, mobile-money operators and other payment system participants.

It narrows the room for firms that previously relied on cross-border transfer safeguards, because payment data must now be hosted and managed in Nigeria not merely covered by contractual transfer clauses.

That makes the Central Bank of Nigeria rule a data-centre demand signal as much alongside the payments-compliance change.

The Nigeria Data Protection Act 2023 still governs broader cross-border data movement, but the CBN circular treats payment records as a more sensitive category that needs an onshore location.

Transaction Growth Raises The Hosting Requirement

CBN figures cited by industry analysts put Nigeria’s electronic payment transactions at 16.3 billion in 2021 and 38.7 billion in 2023, with volumes projected to exceed 60 billion this year.

Each additional transaction increases the storage, processing, backup and resilience burden that local facilities must absorb before the 2027 deadline.

Data-centre operators are already attaching capacity plans to that demand.

Capacity identified Equinix’s LG3 project in Lagos as a $22 million facility with a first-quarter opening target, within an Africa programme budgeted at $100 million.

Airtel’s Nxtra unit has started a separate Lagos campus with 38MW of planned capacity and $120 million of backing.

Kasi Cloud opened a Lekki campus in May that it describes as ready for hyperscale and AI workloads, with a plan to expand the site to 100MW.

Lagos state wants citywide data-centre capacity above 250MW by 2030, giving the residency rule a local infrastructure target beyond the legal compliance date.

Power Supply Remains The Capacity Constraint

The rule does not solve Nigeria’s electricity bottleneck.

Capacity put national generation around 3,000MW to 4,000MW and cited a more than 64% rise in data-centre energy costs since the start of the year.

That gap leaves payment firms and infrastructure providers working against two clocks.

Regulators have set a fixed residency deadline, while operators still need reliable power, cooling, network redundancy and disaster-recovery capacity for data that the payments system treats as critical.

For banks and processors, the practical work will be portfolio-by-portfolio rather than abstract.

Each hosted service, card link, fraud tool, backup copy and outsourced payments workflow has to be mapped against the new location rule before the deadline.

The September ITW Africa and Datacloud Africa meetings in Nairobi are expected to put those issues in front of regulators and infrastructure investors, including Nigeria’s Data Protection Commission, NITDA, ATCON and ICASA.

Capacity did not identify the enforcement process for firms that miss the January 2027 deadline, leaving the penalty path as the main unresolved operating detail.