In less than nine weeks, every bank and payment company in Nigeria must keep its payment data at home. The Central Bank of Nigeria’s circular of 15 June leaves no doubt about the timing: “All affected financial institutions shall fully comply with this requirement effective January 1, 2027.”

I am not going to ask for more time. I want to ask for something cheaper: a clear answer on what the rule means for money that crosses the border. I work in cross-border payments, and that is the part of the rule that has had the least attention.

The circular, reference PSS/DIR/PUB/CIR/001/004, is two pages long. The operative sentence is in paragraph 2: “All financial institutions and participants facilitating payments within Nigeria shall ensure that payment transaction data generated within Nigeria are stored and managed in Nigeria in accordance with data protection laws and regulations applicable in Nigeria.” There are no definitions, no exceptions and no mention of cross-border payments.

“The strict reading has a second problem. Some institutions keep their disaster-recovery systems abroad precisely so that one local failure, a flood, a fire or a grid collapse, cannot take down both the main system and the backup. Moving everything into Nigeria in a hurry could leave a bank compliant on paper and more fragile in practice.”

Most of the debate since June has been about servers, power and cloud costs. Mine is a different question.

Take an ordinary transfer. A sender in Manchester uses a mobile app to send £300 to a relative in Ibadan. The app’s company records the sender’s details, the amount and the rate, then passes an instruction to a partner in Nigeria, and a bank here credits the account. That is at least three records: one in Britain and two at home. By design, the names of the sender and receiver travel with the payment, because FATF Recommendation 16 requires wire transfers to carry accurate information about both.

A cross-border payment can never be fully local. Data has to leave and arrive. I do not believe the CBN intends otherwise. But the sentence does not say so, and a strict reading creates real problems.

Read strictly, “stored and managed in Nigeria” would mean that every copy of payment data generated here, including backups, disaster-recovery copies and copies held by partners, must sit in Nigeria.

For a domestic transfer, that is demanding but possible. For an international payment, it cannot be done, because the foreign bank or transfer company at the other end must keep its own record under its own laws.

The strict reading has a second problem. Some institutions keep their disaster-recovery systems abroad precisely so that one local failure, a flood, a fire or a grid collapse, cannot take down both the main system and the backup. Moving everything into Nigeria in a hurry could leave a bank compliant on paper and more fragile in practice.

So three questions need answers.

First, what is “generated within Nigeria”? In the Manchester example, the debit happens in Britain and the credit here. The credit record is clearly Nigerian. The sender’s file in London clearly is not. Between them sit many records. The circular’s introduction speaks of “critical payment data”, while paragraph 2 speaks of “payment transaction data”. Neither is defined.

Second, does “stored and managed” mean a copy here, or the only copy here? A local copy is easy. “Managed” is harder. If it means the firm must run the data from Nigeria, a company with one global ledger would need a second ledger just for us. A company with small Nigerian volumes may decide the corridor is not worth it.

Third, how does the rule fit with the Nigeria Data Protection Act 2023? Section 41 of that Act already allows personal data to leave Nigeria if the recipient gives adequate protection or if a condition in section 43 applies. One of those conditions is that the transfer is necessary to perform a contract with the person concerned. A remittance is such a contract. The circular says localisation must follow “data protection laws and regulations applicable in Nigeria”. Is it adding a stricter rule for payment data, or confirming the Act? The answer changes the compliance work completely.

Coverage is unclear too. The circular is addressed to licensed Nigerian institutions, but paragraph 2 reaches “participants facilitating payments within Nigeria”, a phrase it does not define. Foreign transfer companies will feel the rule through their Nigerian partners either way.

This matters for families, not just compliance teams. A firm that cannot read the rule with confidence may raise prices, ask for more documents or quietly leave the corridor. People who depend on small, regular transfers from abroad will feel that first.

The CBN does not need to move the date or change the policy. It needs to publish a short set of questions and answers before 1 December so that firms have a month to act. Five points would do.

One, define “payment transaction data”, with examples that include cross-border payments. Two, say whether a Nigerian copy satisfies the rule, or whether the primary record must be held and managed here. Three, confirm that payment messages may still carry the information international standards require to foreign banks and schemes. Four, explain how the circular works with sections 41 to 43 of the Data Protection Act. Five, say how backups and disaster-recovery copies are treated so that compliance does not come at the cost of resilience.

That is one or two pages. The CBN can write it in a week. The industry cannot answer these questions for itself.

Tosin Folarin is a payment strategy leader who has driven regional product growth, monetisation modelling, and card scheme strategy across West Africa for major financial technology organisations. Drawing on his foundational management consulting experience and his track record of scaling digital infrastructure, Tosin brings an authoritative, practical perspective to discussions on emerging payment technologies and regulatory policy.