A bill before the House of Representatives has proposed a 10-year prison term and a minimum fine of N500m for anyone who transfers strategic payment transaction data outside Nigeria without regulatory authorisation.

The proposed legislation, exclusively obtained by The PUNCH, also seeks to compel banks, financial technology companies, payment service providers and other financial institutions to store their primary payment data infrastructure within Nigeria, with a minimum fine of N1bn for institutions that violate the requirement.

The bill, sponsored by the member representing Surulere 11 Federal Constituency of Lagos State, Lanre Okunlola, seeks to establish the National Payment Data Protection and Sovereignty Commission as the principal authority responsible for protecting, regulating and exercising sovereign control over payment transaction data generated within the country.

Titled, ‘A Bill for an Act to Establish the National Payment Data Protection and Sovereignty Commission,’ the proposed legislation is designed to strengthen Nigeria’s control over its financial information infrastructure, “address cybersecurity threats and reduce dependence on offshore payment data storage and processing facilities.”

Introduced during a plenary session last week, the bill is now expected to be debated in the coming weeks by lawmakers.

Under Section 23, the bill provides that anyone who transfers payment data outside Nigeria without authorisation commits an offence and, upon conviction, shall be liable to imprisonment for a term not exceeding 10 years, a fine of not less than N500 million, or both.

It states that “any person who transfers payment data outside Nigeria without authorisation commits an offence and shall be liable upon conviction to imprisonment for a term not exceeding ten years, a fine not less than ₦500,000,000 or both.”

Similarly, Section 22 prescribes a minimum fine of N1bn for any institution that fails to comply with the proposed data localisation requirements, in addition to daily penalties for continuing violations.

The section says that any institution that fails to localise payment transaction data “commits an offence and shall be liable to a fine not less than N1bn and additional daily penalties for continuing violations.”

In a major departure from the existing freedom of financial institutions to use offshore infrastructure where permitted by applicable regulations, the proposed law seeks to make local storage and processing the default requirement for domestic payment transactions.

Section 8 of the bill declares all payment transaction data generated within Nigeria a “Strategic National Economic and Security Asset.”

Section 9 further provides that all such data “shall be stored within the territory of the Federal Republic of Nigeria,” while banks, fintech companies, payment service providers, switching companies and settlement system operators must maintain their primary payment data infrastructure within the country.

The bill also seeks to prohibit regulated institutions from hosting their primary payment transaction data abroad, except with the approval of the proposed Commission in conjunction with the Central Bank of Nigeria.

Under Section 10, all domestic payment transactions must be processed through infrastructure physically located within Nigeria.

However, the proposed legislation recognises the need for international financial transactions, providing a framework for authorised cross-border transfers.

Section 18 stipulates that no person shall transfer strategic payment data outside Nigeria without the Commission’s authorisation.

Such authorisation, according to Section 19, may only be granted where the transfer is necessary for international settlement obligations, national security interests are protected, adequate safeguards exist and approval has been obtained from the Central Bank of Nigeria.

On cybersecurity, the bill classifies payment transaction infrastructure as Critical National Information Infrastructure and empowers the proposed Commission to establish minimum security and resilience standards.