CBN's New Payments Circular: What Banks & Fintechs Must Do Before 2027
The Central Bank of Nigeria
1. Introduction
On June 15, 2026, the Central Bank of Nigeria issued Circular PSS/DIR/PUB/CIR/001/004, signed by Rakiya O. Yusuf, Director of the Payments System Supervision Department. It is addressed to deposit money banks, microfinance banks, mobile money operators, switching and processing companies, payment terminal and solution service providers, super agents, and all other licensed payment operators.
The circular introduces four simultaneous interventions: payment data localisation, market share caps, ultimate beneficial ownership (UBO) disclosure, and systemic oversight measures. Each carries distinct obligations and deadlines.
The CBN's rationale is that the rapid growth of digital payments has created structural concerns like market concentration among dominant operators, opacity of ownership, and over-reliance on foreign infrastructure. This circular addresses all four at once.
2. Data Localisation
All payment participants in Nigeria must ensure that payment transaction data generated within Nigeria is stored and managed within Nigeria, in line with applicable data protection laws. Full compliance is required by January 1, 2027.
The scope is wide. Transaction records, BVN data, card data, settlement records, payment instructions, authentication credentials, associated metadata, and the systems that consume this data; fraud models, analytics pipelines, risk-scoring engines are all covered.
Critically, access is itself a form of processing: a foreign-based team with login access to your Nigerian payment data constitutes a cross-border transfer, regardless of where the servers sit.
The obligation attaches to the data, not the company's domicile. Foreign-headquartered platforms processing Nigerian user transactions are squarely within scope.
This directive reinforces the Nigeria Data Protection Act 2023, the Central Bank of Nigeria Regulatory Framework for Bank Verification Number Operations, and the Banks and Other Financial Institutions Act 2020.
3. Market Structure Requirements
The circular caps market dominance across the two core segments of the card payments chain. Any institution controlling more than 25% of card issuing within a rolling 12-month period cannot simultaneously hold more than 15% of merchant acquiring and vice versa.
To clarify: card issuing is the provision of debit, credit, and prepaid cards to customers. Merchant acquiring is the processing of card payments on behalf of merchants. The CBN's concern is that operators dominating both ends of this chain simultaneously create systemic dependencies and harm competition.
The caps apply at group level, across all affiliated entities. A group routing card issuing through one subsidiary and merchant acquiring through another is not exempt.
All regulated entities must submit monthly market share returns using CBN-prescribed templates. Full compliance is required by December 31, 2026, one day before the data localisation deadline.
4. Ultimate Beneficial Ownership Disclosure
All deposit money banks, PSPs, and other financial institutions with digital payments operations must disclose the Ultimate Beneficial Ownership (UBO) of significant shareholders.
in line with Nigeria's AML/CFT laws. Institutions must maintain accurate, up-to-date UBO records and produce them to the CBN on request.
A beneficial owner is the natural person who ultimately owns or controls a legal entity, even through layers of intermediate companies, trusts, or nominees. The CBN is concerned that complex ownership structures have been used to obscure control of regulated entities, creating risks around money laundering, illicit flows, and regulatory accountability.
The obligation connects to CAMA 2020 register of members requirements and SCUML/NFIU obligations. For institutions with foreign investors, parent companies, or layered holding structures, the practical task is confirming that your shareholder register identifies the natural persons at the top of the chain and is ready to be produced on demand.
This is an ongoing obligation, not a one-time filing. Changes in shareholding that affect beneficial ownership must be updated promptly.
5. Enforcement and Risk
The CBN has stated explicitly that compliance will be monitored and supervisory sanctions imposed where necessary. The recent enforcement actions against fintech platforms confirm that the CBN acts publicly and at scale.
Beyond regulatory sanctions, there is material investor risk: compliance is now a due diligence indicator. A documented failure to implement a CBN circular covering four separate obligations is a governance red flag that affects deal terms and can stall funding rounds.
Where to Begin
Audit your Data Footprint
Commission a structured assessment of every system, vendor, and integration that touches Nigerian payment data. Establish server locations, data types, contracts, and remote access points for each.
Assess your market share
Calculate your card issuing and merchant acquiring share across all affiliated entities over a rolling 12 months. The 25%/15% cap applies to groups, not individual licences.
Trace your ownership chain
Identify your ultimate beneficial owners, update your records, and establish a process for keeping them current and available to the CBN on demand.
Build a staged migration plan
Prioritise by data sensitivity and transaction volume. Start with core payment processing infrastructure and work outward. Build testing windows between each stage.
Review and renegotiate vendor contracts
Identify which providers offer Nigerian data residency and which do not. For those that do not, begin finding alternatives or negotiating bespoke arrangements now.
Run a joint NDPA compliance check
The data localisation obligation overlaps substantially with the NDPA's cross-border transfer rules. A joint programme addressing both frameworks is more efficient and better positioned for regulatory scrutiny.
This publication is a general legal overview and does not constitute legal advice.
