If you judged the CBN’s latest payments circular by the online reaction alone, you’d think the entire Nigerian financial service industry has been turned upside down considering every time the Central Bank of Nigeria releases a new circular, two things happen almost immediately: People rush to LinkedIn to declare that everything has changed, and everyone else starts wondering which companies are about to be in trouble.
The latest circular on data localization, Ultimate Beneficial Ownership (UBO) disclosure, and market structure has triggered that very same reaction.
I’ve read through the circular, spoken to people across the financial and fintech ecosystems, and my first reaction was probably less dramatic than most and sincerely it has nothing to do with underestimating the circular, which carries real weight for the industry.
The reason is straightforward: much of what people are discussing today has been in existence for years. What has changed is the CBN’s decision to bring some of these expectations together into a formal policy document, make timelines explicit, and signal that enforcement will become much more deliberate.
So, if you’re expecting a sudden shake-up across Nigerian banks and fintech, you’ll probably be disappointed. If you’re looking at what this means for the country’s long-term financial infrastructure, this circular deserves far more attention than the headlines have given it.
Data localization has always been around
One of the biggest misconceptions I’ve seen since the circular was published is the idea that the CBN has suddenly invented data localization. It hasn’t, and anyone who has spent enough time building regulated financial products in Nigeria knows regulators have always paid close attention to where critical financial data lives, how it is managed, and who ultimately has access to it.
The difference today is that the CBN has decided to state the expectation considerably more clearly. The circular requires financial institutions and payment participants to ensure payment transaction data generated within Nigeria is stored and managed in Nigeria, with full compliance expected by January 1, 2027.
The wording greatly matters here because the circular repeatedly talks about payment transaction data. It does not say every application used by financial institutions must suddenly run from Nigerian infrastructure, rather does it prohibits cloud computing infrastructures like AWS, Microsoft Azure, or Google Cloud. It focuses specifically on payment transaction data.
That distinction matters because I’ve already seen people interpreting the policy far more broadly than the document itself suggests.
Not every system is suddenly affected
When people hear “data localization,” many immediately imagine banks scrambling to move every workload into Nigerian data centres, which isn’t what this circular says.
Banks and fintechs rely on dozens of software systems every single day. Customer support teams use CRMs; Finance teams use accounting software; Employees use email platforms; Internal communication happens over collaboration tools; Product teams manage work using cloud-based applications. Most of those services are still provided by companies like Microsoft and Google.
Even the CBN itself relies on Microsoft products in different capacities, just as many banks continue to rely heavily on Microsoft 365 and many newer fintech companies operate substantial parts of their business on Google’s ecosystem.
If someone tells you every one of those systems now has to move into a Nigerian data centre overnight, they’re reading far more into the circular than is actually written.
The document is much narrower in scope, focused specifically on operators who handle payment transaction data. Ergo, if your core business involves processing payment transactions in Nigeria, then complying with the localization requirement becomes part of doing business in the market.
All the banks are already running their core banking systems in Nigeria
Another reason I don’t expect the immediate disruption many people are predicting is because much of Nigeria’s payment infrastructure is already local. Take banking, for instance. Virtually every major Nigerian bank already operates its core banking systems within Nigeria and they have been doing that for decades.
The same applies to many of the country’s oldest payment infrastructure companies. NIBSS has always operated locally. Interswitch built its infrastructure long before cloud computing became the default choice. UPS, along with several other legacy players, developed their systems during a period when hosting data outside Nigeria simply wasn’t the standard approach.
History has already done a large part of the work this policy is trying to reinforce. That’s why I don’t expect January 2027 to suddenly produce a wave of emergency migrations across the entire financial industry. The organizations likely to spend the next several months making adjustments are those whose payment processing architecture has become more globally distributed as cloud-native infrastructure became the norm.
For everyone else, compliance may look less like rebuilding everything from scratch and more like tightening existing controls, documenting processes properly, and demonstrating that critical payment data remains where regulators expect it to be.
The UBO requirement isn’t quite new news
The other part of the circular that has generated plenty of discussion is the requirement around Ultimate Beneficial Ownership disclosures. Again, I don’t expect the reaction to match the reality.
If you’ve never gone through a CBN licensing process, this requirement may sound like a major new regulatory burden. However, if you have, your reaction is probably closer to relief that someone finally put this requirement on paper, since it’s been part of the job for years.
Anyone who has raised capital, structured shareholding, applied for licenses, or participated in regulatory engagements with the CBN knows that understanding who ultimately owns and controls a regulated institution has always mattered.
The circular requires institutions to maintain accurate and up-to-date records of their Ultimate Beneficial Owners and make that information available to the CBN when requested.
This aligns with how the regulator has approached financial oversight for a long time. The formalization matters because it creates greater consistency across the ecosystem, but I don’t see it introducing a radically different operating environment for companies that have already been taking compliance seriously.
Building local infrastructure has to start somewhere
One criticism I’ve already heard is that Nigeria simply doesn’t have the infrastructure to support a policy like this.
While we may not have cloud infrastructure at the same scale as AWS, Google Cloud, or Azure. Anyone building modern technology products knows these companies have spent decades investing billions of dollars in global infrastructure, redundancy, networking, and security. Expecting local providers to match that overnight is far from realistic.
But waiting until Nigeria has infrastructure on that scale before introducing policies that encourage local investment doesn’t make much sense either.
Every country that has built strategic digital infrastructure started somewhere. Nobody wakes up one morning with world-class data centres already built. Conditions have to be created that make investing in them worthwhile.
If regulators never communicate that local infrastructure matters, investors have very little incentive to build it. Demand remains weak, capital goes elsewhere, and years later everyone complains that the country still depends entirely on foreign providers.
At some point, someone has to make the first move, and I think that’s what this circular is trying to do. It will almost certainly create additional costs for some operators, and not every implementation will be smooth. But if Nigeria wants critical financial infrastructure to increasingly reside within its borders, then there has to be a starting point.
One thing I’d still like the CBN to fix
If there’s one area where the CBN still falls short, it has very little to do with data localization or beneficial ownership. It’s about discoverability. The CBN regulates one of the most important industries in the country, yet finding authoritative information can still be surprisingly difficult.
Today, if you’re looking for licensed commercial banks, microfinance banks, payment service providers, payment service banks, or other regulated institutions, you’ll often find yourself downloading Excel spreadsheets from different sections of the CBN website.
Those spreadsheets technically contain the information you’re looking for, but they don’t function like modern regulatory infrastructure. They’re difficult to search, harder to integrate into internal workflows, and not particularly friendly for founders, investors, journalists, researchers, compliance teams, or even regulated institutions trying to verify information quickly.
A single authoritative, searchable directory of every regulated entity would fix this. You could search by company name, license category and status, approval date, or registration number. Information could be updated in one place and consumed by everyone as the definitive reference point for all who depend on it.