“Banks, Fintechs Must Store Primary Payment Data In Nigeria” — Reps Bill Proposes ₦1bn Fine For Violators

A bill before the House of Representatives is seeking a prison term of up to 10 years and a minimum fine of ₦500 million for anyone who transfers strategic payment transaction data outside Nigeria without regulatory authorisation.

The proposed legislation would also require banks, financial technology companies, payment service providers, switching companies and other regulated financial institutions to maintain their primary payment data infrastructure within Nigeria, with a minimum fine of ₦1 billion proposed for institutions that fail to comply.

The bill, sponsored by the lawmaker representing Surulere II Federal Constituency of Lagos State, Lanre Okunlola, is titled A Bill for an Act to Establish the National Payment Data Protection and Sovereignty Commission.

It seeks to establish a National Payment Data Protection and Sovereignty Commission as the principal authority responsible for protecting, regulating and exercising sovereign control over payment transaction data generated within Nigeria.

The proposed law is intended to strengthen Nigeria’s control over its financial information infrastructure, address cybersecurity risks and reduce dependence on offshore facilities for the storage and processing of payment data.

The bill was introduced during a House plenary session last week and is expected to undergo further legislative consideration. It has not yet become law.

Under Section 23 of the bill, any person who transfers payment data outside Nigeria without authorisation would commit an offence and, upon conviction, face imprisonment for a term not exceeding 10 years, a fine of not less than ₦500 million, or both.

Section 22 separately proposes a minimum fine of ₦1 billion for institutions that fail to comply with the data-localisation requirement, alongside additional daily penalties for continuing violations.

The legislation would make the domestic storage and processing of payment transaction data the general rule, restricting the use of offshore infrastructure except where regulatory approval has been obtained.

Section 8 classifies payment transaction data generated within Nigeria as a “Strategic National Economic and Security Asset,” while Section 9 provides that such data must be stored within the territory of the Federal Republic of Nigeria.

Banks, fintech companies, payment service providers, switching companies and settlement system operators would consequently be required to maintain their primary payment data infrastructure within the country.

The bill would also prohibit regulated financial institutions from hosting their primary payment transaction data outside Nigeria unless approval is granted by the proposed Commission in conjunction with the Central Bank of Nigeria.

Under Section 10, domestic payment transactions would be required to pass through infrastructure physically located within Nigeria.

The proposal, however, recognises that cross-border transfers may be necessary for international financial transactions.

Section 18 provides that strategic payment data cannot be transferred outside Nigeria without authorisation from the proposed Commission, while Section 19 sets out circumstances under which such approval may be granted.

These include situations where the transfer is required to meet international settlement obligations, national security interests are adequately protected, sufficient safeguards are in place and approval has been obtained from the Central Bank of Nigeria.

The bill also places emphasis on cybersecurity by classifying payment transaction infrastructure as Critical National Information Infrastructure.

The proposed Commission would be empowered to establish minimum cybersecurity, resilience and data-protection standards for institutions handling payment transaction information.

If enacted, the legislation would introduce a dedicated regulatory framework for the localisation, security and cross-border transfer of Nigeria’s payment transaction data, while subjecting banks, fintech companies and other payment-sector operators to stricter requirements on where their core financial data may be stored and processed.

.. “Banks, Fintechs Must Store Primary Payment Data In Nigeria” — Reps Bill Proposes ₦1bn Fine For Violators … NewsNGR.