The House of Representatives is considering a bill that proposes a minimum N500m fine for illegal transfers of payment data outside Nigeria.
The proposed legislation also recommends a prison term of up to 10 years. Offenders could face both penalties upon conviction.
The bill seeks to strengthen Nigeria’s control over financial transaction data. It also aims to reduce dependence on foreign data storage and processing facilities.
Sponsored by Lanre Okunlola, who represents Surulere II Federal Constituency in Lagos State, the bill seeks to establish a new regulatory agency.
The proposed agency is the National Payment Data Protection and Sovereignty Commission. It would oversee the protection and regulation of payment data generated within Nigeria.
Bill Proposes N1bn Fine for Financial Institutions
The proposed legislation also targets banks, fintech companies and payment service providers.
Under Section 22, institutions that fail to store payment data within Nigeria could face a minimum N1bn fine. They could also face additional daily penalties if they continue violating the requirement.
Section 23 outlines the penalties for unauthorised data transfers. It proposes up to 10 years in prison, a minimum N500m fine, or both.
The bill seeks to make local data storage the standard for domestic payment transactions.
Banks, Fintech Firms May Be Required to Store Data Locally
Section 8 classifies payment transaction data generated in Nigeria as a “Strategic National Economic and Security Asset”. Section 9 requires institutions to store such data within Nigeria.
The requirement covers banks, fintech companies, payment service providers and switching companies. Settlement system operators must also maintain their primary payment data infrastructure within the country.
Under Section 10, domestic payment transactions must pass through infrastructure physically located in Nigeria.
The bill also seeks to restrict financial institutions from hosting primary payment data abroad.
However, the proposed Commission could approve exceptions alongside the Central Bank of Nigeria.
Bill Allows Authorised Cross-Border Data Transfers
The proposed legislation recognises the need for international financial transactions.
However, Section 18 requires regulatory approval before anyone transfers strategic payment data outside Nigeria. Section 19 outlines the conditions for such approval.
Transfers must support legitimate international settlement obligations. They must also protect national security interests and meet adequate safeguards.
The Central Bank of Nigeria must also approve the transfers.
Proposed Commission to Oversee Cybersecurity Standards
The bill also gives the proposed Commission responsibilities for strengthening cybersecurity. It classifies payment transaction infrastructure as Critical National Information Infrastructure.
This would empower the Commission to establish minimum security and resilience standards.
The proposed legislation was introduced during a plenary session last week. Lawmakers are expected to debate it in the coming weeks.
If passed, the bill would establish a new framework for controlling and protecting Nigeria’s payment transaction data.
