The House of Representatives is considering a bill seeking to impose a 10-year prison sentence and a minimum fine of N500m on individuals who transfer Nigeria’s strategic payment transaction data abroad without regulatory approval.
The proposed legislation also recommends a minimum fine of N1bn for banks, financial technology companies and other financial institutions that fail to keep their primary payment data infrastructure within the country.
The bill, sponsored by the lawmaker representing Surulere II Federal Constituency of Lagos State, Lanre Okunlola, seeks to establish the National Payment Data Protection and Sovereignty Commission to oversee the protection, regulation and control of payment transaction data generated in Nigeria.
Titled, A Bill for an Act to Establish the National Payment Data Protection and Sovereignty Commission, the proposal is aimed at strengthening Nigeria’s control over its financial data, tackling cybersecurity threats and reducing reliance on foreign data storage and processing facilities.
Introduced during a plenary session last week, the bill is expected to undergo legislative debate in the coming weeks.
Under Section 23, anyone found guilty of transferring payment data outside Nigeria without authorisation would face imprisonment of up to 10 years, a fine of at least N500m, or both.
The bill states that anyone who transfers payment data abroad without approval “commits an offence and shall be liable upon conviction to imprisonment for a term not exceeding ten years, a fine not less than ₦500,000,000 or both.”
It also proposes a minimum N1bn penalty for financial institutions that fail to comply with the stipulated data localisation requirements, alongside additional daily fines for continued violations.
Section 8 of the proposed law classifies all payment transaction data generated within Nigeria as a “Strategic National Economic and Security Asset.”
Similarly, Section 9 mandates that such information must be stored within Nigeria, requiring banks, fintech firms, payment service providers, switching companies and settlement system operators to maintain their primary payment data infrastructure locally.
The legislation further seeks to make domestic processing of payment transactions within Nigeria compulsory, while restricting financial institutions from hosting their primary payment data infrastructure abroad without regulatory approval.
However, the proposal makes provisions for international financial transactions, allowing cross-border transfers under specified conditions.
Section 18 prohibits the transfer of strategic payment data outside Nigeria without the commission’s authorisation, while Section 19 outlines conditions for granting such approval.
These include the necessity of the transfer for international settlement obligations, protection of national security interests, adequate safeguards and approval from the Central Bank of Nigeria.
On cybersecurity, the bill proposes classifying payment transaction infrastructure as Critical National Information Infrastructure, empowering the proposed commission to establish minimum security and operational resilience standards.
If passed into law, the legislation would introduce stricter requirements for how financial institutions store, process and transfer payment data generated within Nigeria.
