Get Guardian on GoogleBy Tawa Bolarin and Adebola Adefarati
The announcement from Nigeria’s National Digital Cloud Policy and the Central Bank’s directive for banks and fintechs to host their data in Nigeria by January 2027 has got us all excited, anxious or concerned, depending on which side of the value chain you and your organisation sit. There are a couple of theoretical assumptions that miss the point:
The first: that this development marks the beginning of the end for international cloud providers in Nigeria, a quiet way of pushing out AWS, Microsoft and Google in favour of local players.The second: that this development is a handout to promote local content for indigenous data centre and cloud operators, insulated from real competition simply by being Nigerian.
Neither of these assumptions is true, and the implications of either shape where businesses host their infrastructure, whether investors see Nigeria’s digital economy as open, and whether consumers should expect their banking app to get worse before it gets better.
A cohesive direction
The cloud policy sets the national framework: certain categories of data, including those tied to national security, critical financial infrastructure and citizens’ most sensitive information, should be stored, processed and auditable within Nigeria’s borders.The CBN directive gives that principle a deadline for one sector, by telling the institutions that hold Nigerians’ financial data when it needs to be home.Both policies are requirements about where, how and when the work happens, not who can do the work. This distinction between control and exclusion is where most are missing the point.
Theory 1: The beginning of the end for international players
Not the case. Global cloud providers aren’t prohibited from operating in Nigeria. They’re being asked to localise specific workloads, or partner with in-country infrastructure providers, for specific categories of data. This is not an exit announcement. It is an invitation to show up differently, with a physical, auditable local presence, rather than purely cross-border infrastructure.The great news is that several international players are already doing exactly this. The result will be an acceleration of what was already in play. That is the opposite of isolation.
Theory 2: A handout to promote local content
Also, not the case. Whilst a localisation requirement benefits in-country infrastructure, by design, favouring a location is not the same as favouring a provider. On the contrary, the bar for local operators goes up. Providers hosting financial and sensitive data now sit squarely in the line of sight of regulators and of the banks that must prove compliance. Being a local content entity doesn’t exempt anyone from meeting a global-grade standard on security, reliability and auditability. If anything, it puts them under closer scrutiny.
A fairer field, not a protected one
We are headed for a market where competition is decided by who meets the bar, not where a company happens to be headquartered. International providers who localise well can compete strongly. Local providers who fall short won’t win just for being local.
There is no better time than now to re-emphasise why neutrality matters. Localisation should not mean swapping dependence on one offshore platform for dependence on one local one. Carrier- and cloud-neutral infrastructure lets a bank choose among international and local cloud providers, connect to multiple networks, and keep its options open as the rules and the market evolve. That is how you get sovereignty without isolation.
Your call to action as January 2027 moves closer
For banks and fintechs, the question was never “local or international”. It is whether your data and your customers’ data are safe, available and compliant, irrespective of the hosts. With the deadline close, four steps are worth taking now:
Map your data. Know what you hold, where it sits today, and what falls under the new requirements.
Build the roadmap early. Start by designing the migration path, not by listing why it is hard. Surface the risks and demonstrate how you’ll manage them.
Avoid single points of failure. Separate your primary and disaster recovery sites, and keep your cloud options open rather than committing everything to one provider or one location.
Ask your data centre provider for evidence. Ask every provider what capacity is live and contracted today versus planned, which certifications they hold, and how they handle audits and incident reporting.
The future is mutually rewarding for all, especially the consumer: providers are held to a consistent standard, and the digital economy keeps growing because both local and global players have reason to invest in Nigeria.
Welcome to a fairer field where businesses, consumers and the economy all come out ahead.
*Bolarin is Chief Commercial Officer at Rack Centre, while Adefarati is Head of Marketing and Communications at Rack Centre.
