The House of Representatives is considering a bill that proposes a minimum fine of ₦500 million and up to 10 years imprisonment for anyone who transfers Nigeria’s strategic payment transaction data abroad without regulatory approval.
The proposed legislation also seeks to compel banks, fintech companies, payment service providers and other financial institutions to keep their primary payment data infrastructure within Nigeria. The bill, exclusively obtained by The PUNCH, is sponsored by Lanre Okunlola, who represents Surulere II Federal Constituency of Lagos State.
Titled, ‘A Bill for an Act to Establish the National Payment Data Protection and Sovereignty Commission,’ the proposed law seeks to give Nigeria greater control over financial information generated within its borders. According to the bill, the proposed commission would serve as the main authority responsible for protecting and regulating payment transaction data. It would also oversee the country’s control of financial information infrastructure.
The legislation aims to “address cybersecurity threats and reduce dependence on offshore payment data storage and processing facilities.” Introduced during a plenary session last week, the bill is expected to be debated by lawmakers in the coming weeks. Under Section 23, anyone who transfers payment data outside Nigeria without authorisation would commit an offence. If convicted, the person could face up to 10 years in prison, a fine of at least ₦500 million, or both.
The bill states that “any person who transfers payment data outside Nigeria without authorisation commits an offence and shall be liable upon conviction to imprisonment for a term not exceeding ten years, a fine not less than ₦500,000,000 or both.” Financial institutions that fail to comply with the proposed local data storage requirement could also face a minimum fine of ₦1 billion, alongside additional daily penalties for continued violations.
Section 22 provides that any institution that fails to localise payment transaction data “commits an offence and shall be liable to a fine not less than N1bn and additional daily penalties for continuing violations.” The proposal would change how financial institutions manage and process domestic payment information. Rather than relying on overseas data infrastructure, institutions would be required to store and process such information within Nigeria.
Section 8 of the bill classifies all payment transaction data generated in Nigeria as a “Strategic National Economic and Security Asset.” Section 9 further requires that such information “shall be stored within the territory of the Federal Republic of Nigeria.” Banks, fintech companies, payment service providers, switching companies and settlement system operators would also be required to maintain their primary payment infrastructure locally. The bill also proposes that domestic payment transactions must be processed through infrastructure physically located in Nigeria.
However, the legislation does not completely rule out international data transfers. It recognises that some cross border transactions require information to move outside the country. Under Sections 18 and 19, such transfers would require approval from the proposed commission and the Central Bank of Nigeria. Approval may be granted where the transfer is necessary for international settlement, national security is protected and adequate safeguards are in place.
The proposal also seeks to classify payment transaction infrastructure as Critical National Information Infrastructure, giving the proposed commission powers to establish minimum cybersecurity and operational security standards. If passed, the legislation would introduce stricter controls over how Nigeria’s financial institutions store, process and transfer payment data.
