Introduction
Nigeria’s digital payments ecosystem has experienced remarkable growth over the past decade. In response, the Central Bank of Nigeria (CBN) issued its circular titled “Introduction of Market Structure Requirements, Data Localisation, Ultimate Beneficial Ownership Disclosure, and Systemic Oversight Measures in the Nigeria Payments System.” The circular introduces a comprehensive framework to strengthen competition, improve transparency, enhance operational resilience, and safeguard the country’s payment infrastructure.
For banks, fintech companies, payment service providers (PSPs), investors, and corporate groups operating within Nigeria’s payments ecosystem, the circular represents more than just another compliance obligation and raises interpretive and structural questions that will require reassessing business models, ownership structures, technology infrastructure, and expansion plans.
Why the CBN Introduced These Measures
According to CBN, the reforms became necessary following the rapid expansion of electronic payments and digital financial services across the country. The rapid evolution of the digital landscape and increasing digitalisation of financial services have driven the growth of electronic payments, delivering significant benefits including improved efficiency in payment systems. At the same time, there have been several emerging risks such as the increased concentration of market power among a few dominant operators, growing dependence on foreign infrastructure for critical payment data, and limited transparency regarding the true owners of payment institutions.
The circular therefore seeks to ensure that innovation continues, but within a competitive, transparent, and resilient regulatory environment. Two deadlines anchor these reforms: market-structure compliance and data localisation.
December 31, 2026 – Institutions exceeding 25% market share threshold in card issuing or merchant acquiring must achieve the required caps.
January 1, 2027 – All payment transaction data generated in Nigeria must be stored and managed on servers within Nigeria.
Market Structure
One of the most significant aspects of the circular is the introduction of market-structure requirements aimed at preventing excessive concentration in the payments industry. The circular provides that any licensed financial institution that holds more than 25% market share in card issuing within a rolling 12-month period is restricted to a maximum of 15% market share in merchant acquiring over the same period. Conversely, any institution holding more than 25% market share in merchant acquiring may not hold more than 15% market share in card issuing within that same rolling 12-month period.
For context, a merchant acquirer means “a CBN licensed institution that has agreement with the relevant card scheme to contract with merchants to accept payment cards as means of payment.” Card issuing is the business of providing payment instruments, such as cards, to customers for initiating payment transactions. A card issuer is therefore a licensed financial institution that issues these payment tokens or payment instruments to customers. For example, where a bank enables a supermarket to accept Visa or Mastercard payments and processes those transactions on the supermarket’s behalf, the bank is acting as the merchant acquirer, while the bank that issued the customer’s card is the card issuer.
The CBN’s concern is that an operator dominant on one side could leverage that strength to dominate the other. In addition, it requires all regulated entities to submit monthly market share returns to the CBN using prescribed templates and timelines that are, however, yet to be issued.
The practical implications of the circular may necessitate genuine structural change for operators with strong positions across both issuing and acquiring well before the December 2026 deadline. It will include divesting parts of a business, separating activities into distinct legal entities, or voluntarily scaling back in one segment to remain active in another. Each of these options will carry significant corporate, tax, competition, and contractual rearrangements.
Mandatory Data Localisation
Perhaps the most widely discussed aspect of the circular is the mandatory localisation of payment transaction data. Currently, a significant portion of Nigerian payment transaction data is hosted on servers outside the country through international cloud infrastructure. In simple terms, data localisation means that the records of payments made in Nigeria must be stored and managed on servers physically located within Nigeria, in accordance with applicable Nigerian data protection law. The requirement applies broadly across financial institutions and participants facilitating payments in the country, with full compliance expected by January 1, 2027.
The objective behind the requirement is understandable, considering that reports have disclosed that Nigeria is estimated to spend approximately US$850 million annually on offshore data hosting, with nearly 90% of its data hosted outside the country, coupled with the growing importance of payment data as critical national infrastructure and the exponential growth of digital payments. As a result, regulators are increasingly seeking greater data sovereignty and visibility over transactions occurring within their jurisdiction.
A key concern is that the circular is unlikely to affect all institutions equally. Commercial banks typically built their core systems on physical, locally hosted infrastructure long before the widespread adoption of cloud computing. As a result, cloud services are often layered onto existing on-premise environments for specific functions, meaning compliance may largely involve auditing and validating existing data storage arrangements. By contrast, many fintechs and mobile payment service providers were built as cloud-native organisations, with core operations heavily dependent on cloud infrastructure. For these entities, compliance is likely to require more extensive operational and technological changes, including migrating and localising critical payment data and systems.
However, this has a few business implications for companies which currently rely on global cloud platforms or multinational data centres. These institutions may need to migrate payment databases to Nigerian infrastructure, review and renegotiate cloud and outsourcing agreements, update their cybersecurity frameworks, reassess cross-border data-transfer mechanisms, and confirm continued compliance with Nigerian data protection legislation.
Ultimate Beneficial Ownership Disclosure
CBN now requires regulated institutions with digital payment operations to maintain accurate and up-to-date records of their Ultimate Beneficial Owners (UBOs) and to make that information available to the regulator on request. An Ultimate Beneficial Owner is the natural person who ultimately owns or exercises effective control over a company, regardless of how many intermediary holding companies or investment vehicles sit in between.
This circular builds upon the CBN’s earlier Guidance on Beneficial Ownership of Legal Persons and Legal Arrangements. This obligation expressly ties into and reinforces existing Anti-Money Laundering, Combating the Financing of Terrorism and Countering Proliferation Financing of Weapons of Mass Destruction in Financial Institutions Regulations, 2022 (AML/CFT).
This will ensure that CBN can access and supervise the payment system during investigations, regulatory examinations, fraud incidents, and enforcement proceedings without relying on infrastructure outside its jurisdiction. For companies with complex corporate governance structures, this requires a careful mapping of the ownership chain down to the natural person, and a considered view on how disclosure interacts with confidentiality obligations to investors.
Practical Compliance Steps for Financial Institutions, FinTech Companies and Payment Service Providers
In response to the CBN circular, these operators within the financial sector should prioritise the following practical compliance actions:
For Market Structure
– Assess consumer issuing and merchant acquiring market shares on a rolling 12‑month basis, including across related entities, to monitor compliance with the 25%/15% market concentration thresholds.
– Implement remediation measures where concentration limits may be exceeded to achieve compliance.
– Submit monthly market share returns to the CBN in the prescribed format and timelines.
For Data Localisation
– Review where payment transaction data is stored, processed, accessed, and backed up to identify any offshore hosting or processing arrangements.
– Update data governance frameworks, policies, and vendor arrangements to ensure ongoing compliance with data localisation requirements.
For UBO Disclosure
– Review ownership structures to identify the natural persons who ultimately own or control significant shareholdings.
– Maintain accurate and up-to-date UBO records, supported by appropriate due diligence and periodic verification processes.
– Establish governance processes to ensure UBO information can be promptly provided to the CBN upon request.
Implications for Investors
The Circular is also expected to have a significant impact on investment activity within Nigeria’s fintech sector. Investors conducting due diligence on financial institutions will need to expand the scope of their reviews beyond traditional financial and commercial considerations. They should assess a target company’s readiness to comply with the new data localisation requirements, the transparency of its ultimate beneficial ownership disclosures, its regulatory reporting obligations, and the strength of its governance and compliance frameworks.
Beyond due diligence, the Circular is likely to influence how transactions are structured and executed. Buyers considering acquisitions or strategic investments should assess at an early stage whether the proposed transaction would trigger any regulatory approval requirements, including obtaining the CBN’s approval for a change in control or whether the combined entity could exceed the prescribed market-share thresholds, which may require the transaction to be restructured before completion.
These regulatory requirements are also likely to affect transaction documentation. For example, parties may include conditions requiring the necessary regulatory approvals to be obtained before closing, while buyers may seek warranties confirming the target’s compliance with the Circular, including its data localisation and disclosure obligations.
Looking Ahead
The Circular reflects a broader shift in the CBN’s regulatory approach towards greater oversight of Nigeria’s payments ecosystem. Its emphasis on data localisation, ownership transparency, market structure, and systemic oversight signals the CBN’s intention to strengthen domestic control over critical payment infrastructure while promoting transparency, competition, and financial stability. For regulated institutions, the implications extend beyond compliance and affect technology and outsourcing arrangements and corporate governance decisions.
Nimma Jo-Madugu, Partner, and Chinemenma Igbokwe and Adedola Adetokunbo-Ajayi, Associates – KENNA’s Banking, Finance and Capital Market.
The Legal Insights column by KENNA provides thought leadership on the legal and business issues shaping today’s commercial landscape.
Comments
Start the conversation about this story.