The Central Bank of Nigeria’s (CBN) new payment system regulations could increase compliance costs for financial technology companies and other payment service providers, while creating fresh investment opportunities in local data centres, cloud infrastructure and cybersecurity, according to PwC.

In a report titled CBN Data Localisation and Market Structure Rules: Regulatory, Strategic and Technology Implications for Nigeria’s Payment Sector, PwC said the measures would require operators to reassess their business models, technology infrastructure and ownership structures ahead of two compliance deadlines at the end of 2026 and the beginning of 2027.

The CBN issued the circular on June 15, 2026, introducing market structure requirements, mandatory data localisation, ultimate beneficial ownership disclosure and enhanced systemic oversight across Nigeria’s payments ecosystem.

The rules apply to deposit money banks, microfinance banks, mobile money operators, switching and processing companies, payment terminal service providers, payment solution service providers, super agents and other licensed payment operators.

Under the market structure provisions, licensed operators that individually or as part of a group control more than 25 per cent of the market in consumer issuing or merchant acquiring must limit their market share to no more than 15 per cent in the other activity during the same rolling 12-month period.

The CBN also requires affected institutions to submit monthly market share returns in accordance with prescribed templates and timelines.

PwC said the requirements could force some dominant operators to reconsider integrated business models that combine payment instrument issuance, merchant acquisition, processing and other services.

Depending on how market share is measured and further regulatory clarification, affected institutions could consider divesting assets, winding down certain business lines or moderating expansion in one segment.

However, the report stressed that these are possible commercial responses rather than outcomes specifically prescribed by the CBN.

It warned that restructuring could erode business value if companies are forced to dispose of assets within a short period or struggle to find credible buyers. Scaling back operations could also reduce the efficiencies that integrated platforms derive from shared infrastructure, customer relationships and data.

PwC identified the definition of the relevant market as a major implementation challenge, noting that payment activities span card issuance, mobile money, instant transfers, point-of-sale acquiring, QR payments and digital wallets.

It said the regulator and operators would need clarity on whether market share would be calculated by transaction volume, value, transaction count or active users, as well as how group entities, agency networks and white-label arrangements would be treated.

The report added that the market structure rules could redistribute transaction flows across the sector, creating opportunities for smaller banks, fintech companies and independent payment providers to secure new partnerships and merchant relationships.

However, it cautioned that the benefits would depend on whether emerging players could combine regulatory compliance, reliable infrastructure and competitive services.

On data governance, the CBN requires payment transaction data generated in Nigeria to be stored and managed within the country in line with applicable data protection laws, including the Nigeria Data Protection Act, 2023.

The deadline for full compliance with the data localisation requirement is January 1, 2027, while operators must meet the market structure requirements by December 31, 2026.

PwC said the localisation rule could place significant financial pressure on smaller fintech companies that rely on international cloud providers for affordable and scalable technology infrastructure.

According to the report, replicating the reliability, security and service standards of global cloud providers locally could require substantial capital investment, potentially favouring larger operators with stronger financial capacity.

It noted, however, that the policy could stimulate demand for Nigerian data centres, local cloud services, cybersecurity capabilities and related technology infrastructure, encouraging domestic and foreign investment.

The report said foreign-backed payment businesses might also deepen their local presence and partnerships to meet the new requirements.

Beyond relocating primary databases, PwC warned that institutions would need to examine the wider movement and management of payment data across backup systems, disaster-recovery facilities, analytics platforms, third-party processors and technology vendors.

It said merely hosting a primary database in Nigeria might not be sufficient to demonstrate compliance if offshore copies of payment transaction data remained in backups, logs, testing environments or third-party systems.

The report also highlighted potential implications for fraud detection, artificial intelligence and analytics platforms that rely on globally distributed data environments.

Financial institutions, it said, would need to determine whether their existing technology arrangements could support localisation without weakening fraud controls, service reliability or business continuity.

PwC recommended that operators map their payment data flows, review hosting arrangements, update vendor contracts and establish technical evidence demonstrating where transaction data is stored, processed, replicated and accessed.

It also urged institutions to assess their ownership structures and beneficial ownership registers to meet disclosure obligations.

Although the CBN circular requires disclosure of the ultimate beneficial owners of significant shareholders, PwC noted that the term was not explicitly defined in the document.

The firm said existing CBN guidance and other regulatory instruments use a five per cent ownership or voting-rights threshold in identifying beneficial ownership interests, suggesting that operators could seek clarification from the regulator on whether this would serve as an appropriate compliance benchmark.

The CBN has indicated that it will monitor compliance and may impose supervisory sanctions under existing laws, regulations and guidelines.

PwC said the compressed implementation schedule would require institutions to undertake market assessments, technology migration, contract renegotiations and possible business restructuring within a short period.

It added that the rules could influence investment decisions in the payments industry, as investors weigh compliance costs and restrictions on scale against opportunities arising from stronger governance and local technology infrastructure.

The firm said the long-term impact would depend on how effectively the regulations balance competition, operational efficiency and systemic resilience.

It warned that restricting the scale of individual operators without strengthening shared payment infrastructure and interoperability could fragment the market and reduce the ability of Nigerian companies to compete with global payment platforms.

Nevertheless, PwC said stronger regulatory oversight, greater ownership transparency and increased investment in local infrastructure could improve confidence among consumers, merchants and investors.

It advised payment operators to begin compliance planning early, seek clarification from the CBN on unresolved technical and market measurement issues, and align their technology investments with the business models they intend to operate after the deadlines.

The report concluded that the rules represent a significant shift in the regulation of Nigeria’s digital payments industry, with compliance likely to require more than administrative adjustments and potentially drive changes in business strategy, infrastructure investment and market competition.