The Central Bank of Nigeria (CBN) has dropped a bombshell on the country's payment industry: every bank, fintech, and payment service provider must now reveal who really owns them and keep all payment data inside Nigeria.

In a circular released Monday, the CBN ordered Deposit Money Banks, Payment Service Providers, and other financial institutions with digital payment footprints to disclose the Ultimate Beneficial Ownership (UBO) of significant shareholders. That means they've got to name the actual human beings behind the companies — not just shell companies or nominee directors.

The directive aligns with existing Anti-Money Laundering, Combating the Financing of Terrorism, and Counter-Proliferation Financing (AML/CFT/CPF) regulations. The CBN said the goal is to promote transparency, reduce market concentration risks, and make the payments ecosystem more resilient.

Institutions must keep accurate and up-to-date UBO records and hand them over to the CBN whenever the bank asks.

But the circular didn't stop there. The CBN also mandated that all payment transaction data generated in Nigeria must be stored and managed locally, in line with data protection laws. Full compliance kicks in on 1 January 2027.

"Institutions shall maintain accurate and up-to-date UBO records and make such information available to the CBN upon request," the apex bank said.

The rapid growth of electronic payments has raised red flags about market concentration, operational dependence, and ownership transparency, the CBN explained. The increasing adoption of digital financial services and the rise of dominant players also sparked concerns about where critical payment data is kept.

New market share limits for card issuing and

merchant acquiring

The CBN introduced fresh rules to prevent any single institution from dominating both card issuing and merchant acquiring. Here's how it works:

  • Any licensed financial institution that controls more than 25% of the card-issuing market in any rolling 12-month period can't hold more than 15% of the merchant-acquiring market during the same period.
  • Similarly, an institution with more than 25% market share in merchant acquiring is capped at 15% in card issuing.

The rules apply whether the institution operates alone or as part of a group of related entities. Affected institutions have until 31 December to comply.

All regulated entities must also submit monthly market-share returns using templates and timelines prescribed by the CBN. The bank warned it will monitor compliance and slap supervisory sanctions on anyone who fails to follow the rules.

The new requirements hit at the heart of Nigeria's booming fintech sector. Companies like Interswitch, Flutterwave, Paystack, and Moniepoint have grown rapidly, processing billions of naira in transactions. The CBN's move forces them to open up their ownership structures — something many have been reluctant to do.

Data localisation is another big shift. Currently, some payment data is processed or stored outside Nigeria, often on cloud servers abroad. From next year, all that data must stay inside the country, which could mean higher costs for companies that have to build or rent local data centres.

The market share caps are clearly aimed at preventing a single player from controlling both sides of the card business — issuing cards to customers and acquiring payments from merchants. This could reshape the competitive landscape, especially for banks that dominate both areas.

Financial institutions have until the end of 2026 to comply with the market structure rules and until 1 January 2027 to fully implement data localisation. The CBN will be monitoring closely, and non-compliance could mean fines, suspension of operations, or other sanctions.

For now, the payment industry is digesting the circular and figuring out how to adjust. The era of hidden ownership and offshore data storage in Nigeria's payment sector is coming to an end.