CBN DATA LOCALISATION RAISES SKILLS, SECURITY CONCERNS

Experts and industry stakeholders have said Nigeria has sufficient data-centre capacity to support the Central Bank of Nigeria’s new data localisation requirement, but warned that shortages of specialised skills and security risks to fibre infrastructure could complicate the transition.

The concerns were raised during a data localisation roundtable in Lagos, as banks, fintech companies and other payment operators prepare to comply with the CBN’s directive requiring payment transaction data generated in Nigeria to be stored and managed locally. The compliance deadline is January 1, 2027.

Industry stakeholders said existing data centres and planned expansion provide a basis for financial institutions to meet the requirement. However, they noted that moving critical workloads requires specialised engineers and careful planning to ensure that financial services remain secure and reliable during and after migration.

The security of fibre-optic infrastructure was also identified as a major concern. Industry experts warned that vandalism or disruption of fibre networks could affect connectivity and potentially disrupt financial services hosted within Nigeria. The Nigerian Communications Commission has classified fibre-optic cables, data centres and other telecommunications infrastructure as critical national information infrastructure requiring protection.

Experts also called for properly trained and certified personnel to handle the migration process. They said institutions must pay attention to encryption, firewalls, secure connectivity, backup arrangements and other security measures rather than treating localisation as simply moving data from foreign servers to Nigerian facilities.

The CBN’s policy comes amid rapid growth in Nigeria’s digital payments ecosystem and increasing investment in local data-centre infrastructure. Industry operators say the directive could stimulate further investment, create jobs and expand Nigeria’s capacity to provide cloud and digital services within the country and across Africa.

However, some technology and banking stakeholders have questioned whether the six-month implementation window is sufficient, warning that rushed migration could create operational and compliance challenges. They have called for clear guidance and a practical implementation process to minimise disruption to financial services.

With the January 2027 deadline approaching, banks, fintechs and payment service providers are expected to accelerate their preparations while the industry continues to assess the infrastructure, skills, cost and security implications of the new requirement.