New Payment Data Bill Could Hit Firms With Huge Fines

Nigeria is considering tougher rules on how banks and fintechs handle your payment data, and the punishment for breaking it could be very heavy.

A new bill before the House of Representatives wants to make payment data generated in Nigeria a national asset that must stay inside Nigeria. If you are a bank, fintech like Opay, Moniepoint, or even a switching company, you must store your main payment data here, not on servers abroad.

What the bill says in simple terms

The bill is called A Bill for an Act to Establish the National Payment Data Protection and Sovereignty Commission. It was sponsored by Lanre Okunlola, the lawmaker representing Surulere II, Lagos.

According to Techpoint Africa and BusinessPost, the idea is simple:

Your ATM card swipe, POS transaction, bank transfer, mobile money payment - all that information is called payment transaction data. Right now, many companies store or process some of that data outside Nigeria, maybe on cloud servers in US or Europe.

This bill says no. That data is now a "Strategic National Economic and Security Asset". So:

• All payment data generated in Nigeria must be stored inside Nigeria.
• All local payments must be processed through infrastructure physically located in Nigeria.
• You cannot transfer that data outside Nigeria without permission from the new commission.

This builds on what CBN already did. On June 15, 2026, CBN issued a circular saying banks, fintechs, mobile money operators and payment processors must keep payment data locally. They have till January 1, 2027 to comply. This new bill wants to make it a full law with its own commission, not just a CBN directive.

The bill is still a proposal. It was introduced last week in House plenary and has not become law yet. But it shows where government is going.

The possible fine and prison term

This is the part that got banks talking.

For individuals: Section 23 of the bill says if any person transfers payment data outside Nigeria without authorisation, he commits an offence. On conviction, punishment is up to 10 years in prison, or a fine of not less than ₦500 million, or both.

For companies: Section 22 says any bank, fintech, payment service provider or switching company that fails to keep its primary payment data infrastructure in Nigeria will face a minimum fine of ₦1 billion. Plus daily penalties for as long as violation continues.

To put it: If you are a staff who knowingly moves customer transaction data to a foreign server without approval, you could personally go to jail for 10 years and pay ₦500m. If your company does not build local servers, company pays ₦1bn minimum.

Section 19 says transfer abroad is not totally banned - you can still do it if you get approval from the commission together with CBN and meet conditions. But default is local.

Why payment data matters to users

You may ask - why should I care if my data is in Nigeria or America?

Three reasons:

1. Your money safety. Payment data includes where you spend, how much you spend, your account patterns. If that data is stored outside Nigeria, CBN cannot easily monitor fraud or breach. If it stays local, regulators can quickly check when something goes wrong.

1. National security. In 2024, Nigeria had issues with fraud and data breaches. Government argues that if all payment data is inside, it is harder for foreign hackers to access and easier to protect as critical national infrastructure.

1. Cost and jobs. If companies must build data centres in Nigeria, it creates jobs for tech guys here, not just abroad. It also means when you do POS, transaction doesn't have to travel to Europe before coming back to Nigeria - so faster.

For users, this could mean banks and fintechs will spend more money to build local data centres. That cost might come to customers later as fees. But also, if done well, your data is more protected under Nigerian law (NDPA) and CBN rules, not foreign law.

For fintechs like Flutterwave, Paystack, Moniepoint, this means double chPhotoeck - by January 1, 2027 you must be compliant with CBN, and if bill passes, you also face the commission.