Introduction
This update examines the legal and regulatory implications of the Central Bank of Nigeria’s (CBN) Circular No. PSS/DIR/PUB/CIR/001/004, dated 15 June 2026, concerning market structure requirements, data localisation, ultimate beneficial ownership (UBO) disclosure and systemic oversight within Nigeria’s payments system.
The central question is whether the Circular establishes a proportionate and workable framework for regulating payment service participants while protecting competition, personal data and operational resilience. This update considers the scope of the obligations, their interaction with existing legislation, the compliance risks they create and the measures affected institutions should adopt.
Legal and Regulatory Framework
The Circular reflects the CBN’s statutory responsibility for regulating Nigeria’s banking and payments system. Its stated regulatory objectives include improving transparency, limiting excessive market concentration, strengthening oversight of critical payment infrastructure and ensuring greater domestic control over payment transaction data.
The Circular applies to a broad range of regulated participants, including deposit money banks, microfinance banks, mobile money operators, switching and processing companies, payment terminal service providers, payment solution service providers, super agents and other licensed operators in the Nigerian payments ecosystem.
Its requirements address four connected areas: market concentration, localisation of payment transaction data, beneficial ownership transparency and enhanced regulatory reporting. These obligations should be interpreted alongside applicable CBN guidelines, anti-money laundering requirements and the Nigeria Data Protection Act 2023 (NDPA).
Data Localisation and Data Protection
A significant provision of the Circular requires payment transaction data generated within Nigeria to be stored and managed within the country, with full compliance required by 1 January 2027. The obligation has material implications for institutions that rely on foreign cloud infrastructure, offshore disaster recovery facilities or international payment-processing arrangements.
Although the Circular does not comprehensively define payment transaction data, a prudent compliance approach would encompass transaction records, payment references, settlement information, authentication logs and associated technical records necessary to process or verify payments. Institutions should not assume that maintaining a Nigerian copy of their records automatically satisfies the requirement.
The reference to data being both stored and managed locally raises a broader question concerning the location of processing, administrative access, backups and replication. Accordingly, regulated institutions should identify where payment information is collected, transmitted, processed, accessed and retained throughout its lifecycle. Particular attention should be given to cloud platforms, third-party APIs, analytics tools and systems used for testing or fraud monitoring.
The Circular must also be read alongside the NDPA. The NDPA regulates the processing of personal data and international transfers, subject to applicable legal requirements and safeguards. However, compliance with those transfer rules does not necessarily establish compliance with the CBN’s separate localisation directive. A transfer that may be permissible under data protection law could nevertheless conflict with the more specific requirements imposed on payment transaction data.
Conversely, localisation does not remove an institution’s data protection responsibilities. Security, lawful processing, accountability and appropriate access controls remain important. Institutions should therefore pursue compliance with both regimes rather than treating them as alternatives.
The practical difficulty is that some international technology providers may not offer the required Nigerian hosting or management arrangements under existing contracts. Institutions should consequently review their infrastructure and outsourcing agreements, assess migration costs and establish contingency arrangements before the January 2027 deadline.
Market Structure and Competition
The Circular introduces restrictions intended to address concentration across card issuing and merchant acquiring activities. As explained in the accompanying regulatory commentary, an institution exceeding 25% market share in either activity is restricted to a maximum of 15% market share in the other activity during the relevant rolling twelve-month period.
The measure appears designed to discourage excessive concentration across complementary segments of the payments value chain. Nevertheless, its application may create substantial commercial and legal challenges for institutions with established positions in both markets.
A central issue is the methodology used to calculate market share. Participants require clarity on the relevant measurement period, the treatment of affiliated entities, the applicable transaction or volume metrics and the circumstances in which a market position triggers the restriction. Ambiguity could lead to inconsistent reporting and disputes over compliance.
The restrictions may also affect expansion plans, partnerships, acquisitions and corporate restructuring. An institution contemplating a transaction should assess its likely effect on market share before completion and determine whether the resulting business model would remain compliant. Where necessary, restructuring options should be considered carefully, taking account of applicable regulatory approvals and other legal obligations.
The CBN’s objective of preserving a competitive payments ecosystem is legitimate. However, effective implementation should also account for the risk that rigid restrictions could discourage investment or prevent efficient business expansion. Clear measurement rules, consistent supervision and appropriate transitional arrangements would help reconcile competition objectives with continued innovation.
Ultimate Beneficial Ownership Disclosure
The Circular reinforces ownership transparency by requiring covered institutions to maintain accurate and current information concerning their ultimate beneficial owners and make the information available to the CBN upon request.
This requirement is particularly relevant to institutions whose ownership involves holding companies, nominee arrangements, private investment vehicles or multiple corporate layers. Identifying the ultimate natural persons who own or exercise effective control may require more than reviewing the immediate shareholder register.
The obligation supports regulatory investigations, risk assessment and the enforcement of anti-money laundering and counter-terrorist financing requirements. It also strengthens the regulator’s ability to understand who ultimately controls a licensed payment institution.
Institutions should maintain documentary evidence supporting ownership information, introduce periodic verification procedures and establish internal responsibility for responding to regulatory requests. Corporate secretarial, legal, compliance and investor-relations functions should coordinate to ensure that material ownership changes are identified and recorded promptly.
Disclosure obligations must, however, be implemented consistently with applicable confidentiality and data protection requirements. Such requirements should not be treated as a reason to disregard a lawful regulatory disclosure obligation, but institutions should ensure that information is handled securely and disclosed through appropriate channels.
Systemic Oversight and Enforcement
The Circular’s reporting and supervisory measures reflect the CBN’s concern that the failure of a significant payment operator could affect a wider network of financial institutions, merchants and consumers.
Monthly market-share reporting, ownership records and greater visibility over payment infrastructure provide the regulator with information necessary to identify emerging risks. Failure to meet applicable requirements may expose institutions to supervisory action or sanctions under the relevant legal and regulatory framework.
Compliance should therefore be treated as an ongoing governance responsibility rather than a one-off technical exercise. Boards and senior management should receive regular updates on implementation, material risks and unresolved compliance gaps. Institutions should also maintain reliable records demonstrating the steps taken to meet their obligations.
Recommendations
In view of the foregoing, affected institutions should prioritise the following measures:
- Conduct a compliance assessment: Map applicable obligations against existing policies, systems and regulatory reporting processes.
- Localise payment data: Identify offshore storage, processing and backup arrangements and develop a documented remediation plan ahead of 1 January 2027.
- Review third-party contracts: Address hosting locations, subcontracting, audit rights, security incidents, regulatory access and termination rights.
- Monitor market concentration: Calculate market shares regularly, assess cross-market exposure and prepare for the applicable 31 December 2026 compliance deadline.
- Strengthen ownership records: Verify beneficial ownership through the corporate ownership chain and establish procedures for timely updates and disclosure.
- Improve governance: Assign accountable executives, provide board-level oversight and retain evidence of implementation and ongoing compliance.
Conclusion
The Circular represents a significant strengthening of regulatory oversight within Nigeria’s payments ecosystem. Its combined focus on data localisation, market structure, beneficial ownership and systemic supervision seeks to improve resilience, transparency and competition.
Nevertheless, the practical effectiveness of these measures will depend on clear implementation standards, consistent regulatory interpretation and the ability of institutions to adapt their technology and business arrangements without compromising security or service continuity.
Covered institutions should treat the Circular as a binding regulatory development requiring timely legal, operational and technological preparation. Early assessment and documented implementation will be essential to reducing exposure to supervisory sanctions and protecting business continuity.
Please note that this material is not legal advice. For professional support, please reach out to info@coventlegal.com