Nigeria fast-tracks cloud certification for data rule

Nigeria’s National Information Technology Development Agency (NITDA) is spearheading the transition from policy to practice by establishing a comprehensive certification system for cloud providers, infrastructure vendors, and system integrators. This end-to-end certification framework, supported by a dedicated portal launching by October, aims to ensure that financial institutions and other regulated entities select only compliant providers ahead of critical deadlines like the Central Bank of Nigeria’s 2027 data localisation mandate. By integrating certification registers with a National Digital Marketplace, the initiative streamlines procurement and fosters confidence in sovereign cloud solutions, particularly within the banking sector.

The National Digital Cloud Policy delineates clear institutional roles to avoid conflicts of interest, assigning regulatory oversight, operational delivery, and compliance monitoring to three distinct bodies. This structural separation is reinforced by an enforcement taskforce chaired by the Communications Minister, which ensures accountability and adherence to the sovereignty framework. The taskforce coordinates regulators, government agencies, and private stakeholders, deploying technology that provides real-time visibility into cloud infrastructure to guarantee that sovereign data remains hosted within Nigeria’s borders and that all regulated institutions comply with the new cloud regulations.

Implementation of the National Sovereign Cloud Initiative follows a phased 24-month roadmap beginning with policy activation, baseline assessments, and institutional arrangements, progressing through the launch of the National Digital Marketplace and onboarding of certified providers, and culminating in scaling government migration, expanding infrastructure, and enhancing regional interconnection. This deliberate rollout is designed to attract up to $750 million in cloud and AI infrastructure investment, while simultaneously supporting digital sovereignty and boosting Nigeria’s capacity to export digital services.

The Central Bank of Nigeria (CBN) has mandated that all payment transaction data, core ledgers, and critical operational records must be stored within Nigerian borders by January 1, 2027, marking a pivotal shift towards enhancing financial sovereignty and regulatory oversight. This directive, which supplements the Nigeria Data Protection Act 2023, aims to ensure operational resilience amid geopolitical risks and undersea cable failures, while reducing the country’s $850 million annual foreign cloud expenditure paid in scarce dollars. However, the rapid enforcement timeline poses significant challenges due to insufficient local cloud infrastructure and unreliable electricity supply, forcing financial institutions to navigate complex migrations from foreign hyperscale providers like AWS, Microsoft Azure, and Google Cloud, none of which operate full data center regions in Nigeria.

Financial institutions face a dual compliance regime under the CBN’s data localisation mandate and the Nigeria Data Protection Act 2023, creating regulatory uncertainty with overlapping requirements and discretionary sanctions but no fixed penalties from the CBN. This layered regulatory environment complicates operational planning, especially as the CBN’s hard deadline approach leaves little room for infrastructure readiness, risking non-compliance and sector disruption. Industry players like MTN are spearheading collaborative efforts through vendor-neutral technical guides and ‘War Room’ roundtables to support migration and compliance, emphasizing the need for rigorous vendor vetting and stress testing of local data centers to ensure uptime and data sovereignty.

The data localisation policy is not merely a regulatory hurdle but a strategic enabler of digital innovation and financial system resilience, as it ensures critical financial data is governed under Nigerian law and hosted on scalable local infrastructure. Experts like Lynda Saint-Nwafor of MTN highlight benefits such as lower latency and faster response times, which are crucial for real-time transaction processing and fraud detection. Moreover, integrating data localisation with automated AML, CFT, and CPF monitoring systems strengthens transparency and operational oversight, positioning compliant institutions to leverage emerging technologies like AI while safeguarding Nigeria’s trillion-naira fintech ecosystem.

Despite broad support for data localisation as a means to protect Nigeria’s financial sovereignty and reduce foreign currency outflows, the sector grapples with infrastructural deficits including unreliable power and limited commercial data center capacity estimated at 50 to 56 megawatts. The absence of empirical, vendor-neutral benchmarks for domestic cloud platforms compels fintech teams to undertake rigorous stress testing to validate local infrastructure’s ability to handle mission-critical workloads. Bashir Dantata’s call for nuanced workload classification underscores the complexity of balancing compliance, operational resilience, and innovation, urging institutions to adopt hybrid cloud strategies that maintain global cloud capabilities while meeting localisation mandates.

Nigeria's ambitious National Digital Cloud Policy aims to attract $750 million in private investment within 24 months to develop local data centres, cloud infrastructure, and AI computing capacity, signaling a major push to reduce reliance on foreign providers. Early private sector commitments, such as Kasi Cloud’s Lekki campus designed to scale to roughly 100MW and MTN’s plans for an AI-enabled data centre, demonstrate tangible progress aligned with policy goals. Furthermore, the government’s Cloud-First strategy consolidates IT investments—over N3.8 trillion since 2023—by discouraging standalone data centres in ministries and promoting cloud adoption, creating a predictable market that encourages local technology growth and international hyperscaler collaboration.

To stimulate demand and foster domestic cloud service providers, the policy proposes pooling government cloud service requirements through a National Digital Marketplace, enabling coordinated procurement that reduces costs and strengthens local industry capacity. This strategic aggregation of government demand not only supports the scaling of local infrastructure but also maximizes economic value from the substantial IT investments already underway, positioning Nigeria to capture more of the $850 million annually currently spent on foreign cloud hosting.

Despite these promising developments, unreliable electricity supply remains a critical bottleneck for expanding data centre capacity, with assessments from the IMF, Oxford Insights, and Nigerian authorities highlighting this as the binding constraint. Industry voices like the African Energy Chamber argue that Nigeria’s abundant gas reserves could provide the necessary baseload power for hyperscale AI facilities, but this requires establishing effective investment frameworks to connect energy resources to cloud infrastructure projects, underscoring the need for integrated energy and digital infrastructure planning.

Nigeria’s National Sovereign Cloud Initiative marks a pivotal shift towards digital sovereignty by localizing data infrastructure and governance, enabling the country to control, secure, and govern its own data as a core element of national development. This digital self-determination is critical to supporting Nigeria’s rapidly expanding digital economy, which spans sectors such as digital banking, e-commerce, healthcare, and e-government, requiring resilient, scalable cloud infrastructure to sustain future growth and service delivery.

Beyond infrastructure, the initiative is designed to catalyze indigenous innovation, job creation, and economic growth by fostering a robust local cloud ecosystem that retains data and digital content within Nigeria. Dr. Kashifu Inuwa emphasizes that localizing workloads—currently over 85% on public cloud abroad—can unlock significant innovation and economic activity, reduce capital flight, and make digital services more affordable, while also building institutional and legal frameworks that Africa previously lacked during earlier industrial revolutions.

Strategically, Nigeria aims to position itself as the digital gateway for West and Central Africa by building sovereign cloud infrastructure that balances local data residency with global cloud innovation through hybrid and multi-cloud architectures. This inclusive approach encourages collaboration between local providers and global hyperscalers, as highlighted by Inuwa’s Technical Working Group, to create a resilient digital ecosystem that strengthens regional leadership and leverages Nigeria’s status as Africa’s largest fintech hub, processing over ₦1 quadrillion annually in digital payments.

The initiative’s emphasis on data sovereignty is not merely regulatory compliance but a strategic economic asset that enhances trust, resilience, and institutional capabilities within Nigeria’s digital economy. By mandating data localization for regulated sectors like finance, Nigeria aims to build trusted infrastructure that underpins scalable digital innovation and positions the country to lead the continent’s data-driven transformation in the Fourth Industrial Revolution.