CBN and NITDA partner on sovereign cloud drive as banks face January 2027 deadline to keep payment data onshore

Two of Nigeria's most powerful regulators have joined forces over where the country's money moves. The Central Bank of Nigeria and the National Information Technology Development Agency, meeting with banking sector executives at an executive regulatory dialogue held in Lagos, presented their joint work on a national sovereign cloud initiative, an infrastructure programme intended to ensure that the country's financial data stays on Nigerian soil as the compliance deadline for payment data localisation draws closer.

The deadline that changes the cloud map

The sovereign cloud programme exists to serve a hard regulatory date. Payment service providers in Nigeria, from commercial banks through to fintech processors, are required to retain customer and transaction data within the country in line with the central bank's data localisation requirements, with full compliance expected by January 2027. Until now, the domestic market has managed this through hybrid arrangements, with providers hosting data in-country where possible and managing a complex patchwork when domestic capacity falls short. The January deadline converges the two into a single standard, and regulators want the infrastructure to be in place before the enforcement clock runs down.

At the dialogue, the NITDA leadership presented the findings of its cloud readiness survey of the financial sector, which measured how far banks and payment companies have moved towards domestic hosting and how prepared the country's infrastructure providers are to receive that workload. The agency's presentation was paired with the central bank's own message to regulated institutions: the localisation requirement is not being postponed, and institutions should treat sovereign infrastructure as a compliance path rather than an optional upgrade.

[irp][irp][irp][irp][irp]

What a sovereign cloud actually is

Sovereign cloud refers to computing infrastructure that is physically located within a country's borders, operated under its laws and subject to its data-governance rules for the storage and processing of defined classes of data. The distinction matters most in financial services, where transaction and customer data is both commercially sensitive and a matter of national security. A sovereign arrangement gives Nigerian regulators direct oversight of where payment data lives, who can access it and under what legal circumstances, capabilities that cross-border cloud arrangements do not provide in the same direct way.

The initiative's architecture, as presented to banking executives, involves accredited domestic infrastructure providers meeting security and availability standards that the two regulators set jointly. Banks and payment companies would migrate classified workloads onto that infrastructure under the supervision of both agencies, with certification providing the compliance evidence the central bank will examine as the 2027 deadline approaches. The programme parallels sovereign cloud exercises in other large economies, where the same logic, that financial infrastructure is critical national infrastructure, has driven similar investments.

The cost of compliance and what it buys

The initiative's economics will be tested across the financial sector. Banks and payment companies already operate sizeable data infrastructure, but the sovereign cloud programme asks them to prove resilience, security and locality in a single assessment, a standard that requires investment in capacity for some providers and rearchitecting of workloads for others. Readiness, as NITDA's survey will show, is uneven: larger institutions with existing data centres are closer to compliance than smaller payment companies that depend on global providers.

What the sector gains from the programme is a compliance framework that is explicit rather than discretionary. Institutions that attain certification will know their infrastructure satisfies the central bank's localisation rule without bespoke negotiation, and the deadline gives them a fixed window in which to complete the transition. For the broader economy, the programme signals that Nigeria intends to treat payment data, one of the most valuable datasets the country produces, as an asset to be governed at home rather than exported wholesale to foreign clouds.

Between now and January 2027, the sequence is predictable: survey findings will become sector guidance, certification standards will be published, and banks will begin moving workloads in tranches. The dialogue in Lagos was the first formal step of that coordination, and the message to the industry from both regulators was the same in substance: the deadline is real, the infrastructure is being built, and the institutions that move earliest will find the transition cheapest.