Nigeria's Certified Cloud Register Will Decide Who Handles Banks' Sensitive Data

Beginning in October 2026, organisations operating in regulated sectors in Nigeria will be able to verify whether cloud service providers, data centre operators, managed service providers and artificial intelligence infrastructure companies have been certified under the National Information Technology Development Agency's new National Sovereignty framework.

The certified cloud register effectively decides which providers can handle banks', fintechs' and public institutions' most sensitive workloads. Local data centre companies and international cloud giants will compete on the same regulatory footing, with certification becoming a key requirement for winning contracts involving regulated data.

Why certification is a market gate

More than 85 per cent of Nigerian businesses already use cloud platforms, according to NITDA, with most relying on infrastructure hosted outside the country. That dependence has long sat uneasily with data protection obligations, supervisory expectations and sovereignty concerns around financial and government data.

By creating an official approval system and encouraging certified infrastructure inside Nigeria, policymakers hope to retain more technology spending domestically while strengthening oversight of critical data. For providers, failing to make the register could mean exclusion from the regulated segment entirely.

Banks are already spending heavily on IT

Nigeria's ten largest banks spent N177.91 billion on information technology in the first quarter of 2026, an increase of almost 31 per cent year on year. That spending boom — covering core banking, cybersecurity, digital channels and cloud migration — is the prize the register now allocates.

Certification will not stop banks from using global cloud regions for non-regulated workloads, but it will shape which providers are entrusted with core systems, customer data and AI training pipelines that regulators increasingly want visible and auditable.

What happens next

NITDA is preparing to launch the national digital regulatory platform and publish the first register of approved providers. The early lists will signal which local operators and international firms cleared the bar, and how demanding the certification really is. If the register is rigorous, it becomes a competitive moat for compliant providers and a cost of entry for everyone else. If it is captured or cosmetic, it will not change where Nigeria's banks keep their data.