Special edition, publishing off our usual Wednesday schedule. This one couldn’t wait.
On June 15, 2026, the Central Bank of Nigeria’s Payments System Supervision Department issued circular PSS/DIR/PUB/CIR/001/004. It runs two pages. It may end up being the most consequential regulatory document Nigerian fintech has seen since the PSB licensing framework.
Most of the coverage so far has focused on one provision: the requirement that payment transaction data generated within Nigeria be stored and managed in Nigeria by January 1, 2027. Data centre operators are understandably celebrating. Nigeria’s local operators have spent a decade building capacity, and the CBN has just handed them the strongest demand signal in the history of the Nigerian cloud market, with billions of dollars in data centre investment now projected through 2027.
But read the circular itself, and three things stand out that the headlines have missed.
1. The data localisation clause is a single paragraph, and that ambiguity is the risk
The entire localisation mandate is one paragraph. It contains no definition of “payment transaction data.” No distinction between primary storage, backups, and disaster recovery replicas. No carve-out for data processing versus data storage. No guidance on whether analytics environments, fraud engines, or customer support systems that touch transaction records fall within scope.
Most consequentially, the operative phrase is “stored and managed in Nigeria.” Storage is a question of where your servers sit. Management is a question of who administers them, and from where. Read strictly, a fintech that migrates its database to a Lagos data centre but administers it through a cloud control plane in Virginia may still have a compliance problem. Read loosely, a local read replica might suffice. Nobody knows yet, because the circular doesn’t say.
For the tier-one banks, this ambiguity is a legal department problem. For the more than 200 licensed PSSPs, PTSPs, switching companies, mobile money operators, and super agents the circular is addressed to, it is an existential architecture question with a six-month fuse. Many of them were built cloud-native on AWS, Azure, or Google Cloud from day one. The institutions that wait for the CBN to publish implementation guidance before starting will not have time to migrate when it arrives.
2. The deadline everyone is quoting is the second deadline
January 1, 2027 is the date in every headline. But the circular contains an earlier one: the market structure requirements must be complied with not later than December 31, 2026. That is one day earlier on paper. In practice the gap is much wider, because monthly market share returns are required in the interim, meaning the reporting obligation begins effectively immediately.
Those market structure rules deserve more attention than they are getting. Any licensed institution, individually or as part of a group of related entities, holding more than 25% market share in consumer issuing within a rolling twelve-month period may not hold more than 15% share in merchant acquiring during the same period, and vice versa. This is a structural separation rule aimed squarely at the handful of players who have built dominant positions on both sides of the payments market. The “group of related entities” language means holding company structures won’t shield anyone.
For the market’s giants, this could force divestitures, restructuring, or deliberate market share management, decisions with real M&A and valuation consequences. For everyone else, it creates something new: a monthly regulatory reporting obligation, in prescribed templates, that most mid-tier operators have no process for today. The templates haven’t been published. The obligation has.
3. UBO disclosure quietly raises the bar for foreign-owned fintechs
The first item in the circular is not about data at all. Every deposit money bank, payment service provider, and financial institution with a digital payments footprint must disclose the ultimate beneficial ownership of significant shareholders under AML, CFT, and CPF regulations, maintain accurate records, and produce them to the CBN on request.
Paired with the localisation mandate, the direction of travel is unmistakable: the CBN wants to know who owns Nigeria’s payment rails and where the data those rails generate physically lives. For fintechs with layered offshore holding structures built through Delaware topcos, Mauritius vehicles, and VC syndicates, the disclosure exercise will be non-trivial, and the timing pressure is real.
What this means in practice
The circular closes with a single sentence on enforcement: the CBN may impose supervisory sanctions where necessary. In the current supervisory climate, no licensed operator should treat that as boilerplate.
The winners over the next six months will be, in order: local data centre and cloud operators, who capture the migration; the global hyperscalers, if they respond by standing up local capacity or partnering with Nigerian facilities rather than ceding the market; and the fintechs that start their architecture assessments now, while there is still engineering runway and colocation capacity to choose from.
The losers will be the operators who assume January 1 is far away. Between now and then sit a market structure deadline, a monthly reporting regime, a UBO disclosure exercise, and a cloud migration that, for a payments company that cannot tolerate downtime, normally takes longer than six months even when the requirements are clear. Here, they are not.
Two pages. Four obligations. Two deadlines. The clock started on June 15.
Harmattan covers African capital markets and the policy decisions that move them. If your institution is assessing its position under this circular, reply to this email or book a call directly: Book a call.
P.S. If you emailed us in recent weeks and didn’t hear back, our mailbox had a technical issue that has now been fixed. Please resend to hello@harmattanintel.com.
Nothing published in Harmattan constitutes financial advice. Always consult a qualified financial adviser before making investment decisions.
Bestman Eleanya
Founder, Harmattan
hello@harmattanintel.com | harmattanintel.substack.com