Nigeria’s digital sovereignty conversation is beginning to take a more practical shape. The Central Bank of Nigeria’s circular of 15 June 2026 requires payment transaction data generated in Nigeria to be stored and managed in Nigeria from 1 January 2027.1 Nigeria’s 2025 National Artificial Intelligence Strategy takes up a related infrastructure problem. It calls for national high-performance computing centres, investment in AI-specific hardware and software, stronger data centres and more affordable access to computing resources.2
Both developments seek to give Nigeria greater control over the infrastructure on which important digital services depend, but they address different parts of that problem. Keeping data in Nigeria is not the same as building the capacity to process it here. A payment company can comply with a localisation rule by storing transaction records in a Nigerian data centre while still depending on foreign-owned cloud platforms, imported hardware, externally operated AI models and technical expertise located elsewhere.
The data may be in Nigeria while the capacity on which the service depends remains beyond Nigeria’s practical control. If the two are treated as interchangeable, a financial institution may satisfy a location requirement without reducing its dependence on infrastructure it cannot operate or replace. At national level, Nigeria may host more data without gaining the capacity to build and run the systems that use it.
The CBN requirement
Data localisation is primarily concerned with the geographical treatment of data. The CBN circular applies this idea to Nigeria’s payments system. It requires financial institutions and payment-system participants facilitating transactions in Nigeria to ensure that payment transaction data generated in Nigeria is stored and managed within the country. The circular sits within a larger package dealing with market structure, beneficial ownership disclosure and systemic oversight.3
The regulatory logic is understandable. Payments data is closely connected to financial stability, fraud monitoring, consumer protection and the CBN’s ability to supervise institutions operating within the system. If critical records are held abroad, questions can arise about regulatory access, foreign legal restrictions, service interruption and the speed with which records can be obtained during an investigation or crisis.
Localisation can reduce some of those risks. It can give the regulator a clearer line of sight over important data and encourage institutions to review where their payment systems store, replicate and back up information. It does not, however, answer every infrastructure question.
A Nigerian server location does not by itself reveal who owns the underlying infrastructure, who administers it, which foreign suppliers can access it remotely, whether encryption keys are controlled locally, or what happens when the provider withdraws a service. It also does not show whether the country has enough affordable capacity to support the growing demand for AI and other compute-intensive services. Physical location is part of control, but it is not the whole of it.
Storage is not computing capacity
Compute sovereignty concerns the capacity used to run digital services and the degree of control over that capacity.
For ordinary cloud services, compute includes the servers, processors, storage, networking and software environment used to operate an application. For modern AI, the requirement can be much greater. Training and running large models may depend on specialised chips, high-performance computing facilities, large amounts of electricity, cooling systems, technical expertise and reliable connectivity.
Nigeria’s National AI Strategy recognises this directly. Its first strategic pillar is the development of foundational AI infrastructure. The Strategy proposes national high-performance computing centres that researchers, start-ups and businesses can access. It also calls for investment in AI-specific hardware and software, with a preference for domestically produced solutions, and proposes energy arrangements under which each AI cluster would obtain less than half of its required power from the existing national grid.4
The Strategy is not simply asking where Nigerian data should be stored. It is asking whether Nigerians can obtain the computing resources required to research, build and deploy AI systems at a viable cost, which is a different policy problem from determining where particular data must be kept.
Who controls a locally hosted service?
Suppose a Nigerian payment company keeps all payment transaction data in a data centre in Lagos. On the face of it, the location requirement may be satisfied.
The service may nevertheless depend on a foreign cloud provider’s software and control plane. Its most important hardware may be imported. Technical support may be provided from another jurisdiction. The company may use an externally hosted fraud-detection model, or rely on contractual terms that permit the provider to discontinue a feature or change the service architecture.
None of this means the arrangement is necessarily unacceptable. Complete technological self-sufficiency is neither realistic nor required for every system. Digital infrastructure is built through international supply chains, and foreign providers can supply expertise, scale and security that would be expensive to reproduce. In-country storage does not remove those dependencies.
The relevant question is whether those dependencies are understood and whether the organisation and the country can continue an important service when one of them fails. Control may depend on contractual rights, technical architecture, access to replacement capacity, local skills and the ability to move workloads without losing essential functionality.
The cost of localisation
Localisation rules create demand for local infrastructure. That can help domestic data-centre operators and encourage investment. But if suitable local capacity is scarce, unreliable or substantially more expensive, the immediate result may be higher compliance costs.
Smaller fintechs are likely to feel that pressure more sharply. A large bank may be able to negotiate dedicated infrastructure, redesign its architecture and maintain parallel systems. A smaller payment company may depend on a limited number of compliant providers and have less bargaining power over price, audit rights and service terms.
There is also an operational risk in moving data simply to satisfy a deadline. Payment platforms are rarely built around a single database in one place. Transaction records may appear in primary systems, fraud tools, customer-support platforms, analytics environments, logs, backups and disaster-recovery arrangements. Some of these systems may be operated by vendors or integrated through application programming interfaces. An institution that asks only where its main database sits may therefore miss a substantial part of the data flow.
Compliance should begin with an accurate map of the payment transaction data: where it is collected, each system to which it is sent, every copy created, who can access it and what happens during backup, support and recovery. Contracts and privacy notices can then be tested against the system that actually exists.
Power, access and security
Building local computing capacity is not automatically an answer either. High-performance computing facilities consume substantial electricity and require dependable cooling, backup power, network infrastructure and specialist personnel.5 If the electricity is unreliable or prohibitively expensive, nominal capacity may exist without being commercially useful. If only a small number of institutions can afford access, local researchers and start-ups will remain dependent on foreign platforms.
Control also needs safeguards. Concentrating sensitive public, financial or health data within local infrastructure can increase the consequences of poor security or weak governance. A locally operated system can still be badly configured, vulnerable to unauthorised access or used without a lawful basis.
Sovereignty should not become an argument for weaker privacy, security or accountability. The aim is to give Nigeria greater practical control over important digital capacity while maintaining the protections expected of the systems running on it.
The National AI Strategy reflects part of this balance. Alongside compute infrastructure, it identifies responsible and ethical AI development and a robust AI governance framework as strategic pillars, while also proposing data-governance standards aligned with the Nigeria Data Protection Act.6 Infrastructure and safeguards need to develop together.
The questions institutions need to answer
For banks, fintechs and payment providers, the CBN circular should trigger more than a review of hosting addresses. The first exercise is to determine scope. Which information qualifies as payment transaction data generated in Nigeria? Which entities and services participate in its collection, processing, storage, support and recovery? Where does each copy sit, and from where can it be administered?
The next issue is architecture. Institutions will need to examine production systems, analytics environments, logs, fraud tools and backups, including arrangements that fail over to infrastructure outside Nigeria. Where vendors are involved, the contract should support the architecture the institution is relying on. Data-location commitments, subprocessor controls, access rights, incident support, audit evidence, exit assistance and deletion obligations need to be more than general assurances.
There is also a concentration question. If many institutions move critical workloads to a small number of local providers, an outage or security failure at one provider may affect a significant part of the payments system. A localisation policy intended to strengthen resilience can create a different systemic dependency if capacity does not grow alongside demand.
For clients adopting AI, counsel should run a separate compute analysis. Where is the model hosted? Is the organisation using a public application, an enterprise service, a dedicated cloud environment or infrastructure it operates itself? Which provider controls the model and its updates? Can the workload be moved? What would migration cost, and what functionality would be lost? These questions should be considered alongside the data analysis because they address a separate source of dependency.
Building capacity Nigeria can use
Nigeria should continue to clarify what localisation requires in practice, particularly the meaning of storing and managing payment transaction data in Nigeria, the treatment of backups and remote access, and the evidence institutions must retain to demonstrate compliance.
At the same time, implementation of the National AI Strategy should be measured against practical outcomes. It is not enough to announce computing centres. Researchers and businesses need to know what capacity is available, the cost of access, who receives priority, how uptime is measured, which security standards apply and how the facilities will be powered and maintained.
Public procurement can also be used more deliberately. Where government funds cloud, data-centre or AI infrastructure, the contract can require skills transfer, transparent service levels, security assurance, interoperability and workable exit arrangements. Local capacity will not become sovereign merely because it is physically located in Nigeria. Nigerian institutions must be able to understand, operate and, where necessary, replace what they rely on.
The stronger policy position is therefore not to choose between localisation and compute development. Nigeria needs both, but each should be pursued for the problem it actually solves.
Data localisation can improve regulatory access and reduce some forms of external exposure. Compute capacity can give local institutions a better chance to build, operate and adapt important systems. Reliable power, skilled people, security controls and credible governance determine whether either policy works in practice. If those elements do not develop together, Nigeria may succeed in keeping data within its borders while leaving the infrastructure needed to use it meaningfully beyond its control.
Footnotes
- Central Bank of Nigeria, ‘Circular on Introduction of Market Structure Requirements, Data Localisation, Ultimate Beneficial Ownership Disclosure, and Systemic Oversight Measures in the Nigeria Payments System’ (Circular No PSS/DIR/PUB/CIR/001/004, 15 June 2026) (CBN Circular) <https://www.cbn.gov.ng/> accessed 24 September 2026. ↩
- Federal Ministry of Communications, Innovation and Digital Economy, National Artificial Intelligence Strategy (September 2025) 31–32 <https://ncair.nitda.gov.ng/> accessed 24 September 2026. ↩
- CBN Circular (n 1). ↩
- Federal Ministry of Communications, Innovation and Digital Economy (n 2) 31. ↩
- International Energy Agency, Energy and AI (2025), ‘Energy demand from AI’ <https://www.iea.org/reports/energy-and-ai/energy-demand-from-ai> accessed 24 September 2026. ↩
- Federal Ministry of Communications, Innovation and Digital Economy (n 2) 4, 38, 43–45. ↩
