From hidden ownership to data sovereignty, the Central Bank of Nigeria is confronting risks lurking beneath Nigeria’s fintech boom, writes Festus Akanbi
The Central Bank of Nigeria’s (CBN) latest directive to banks, fintechs and payment service providers marks a significant shift in the regulation of Nigeria’s financial system. By requiring the disclosure of Ultimate Beneficial Owners (UBOs), the localisation of payment transaction data by January 1, 2027, and compliance with new market concentration limits, the apex bank is seeking to prevent innovation from becoming a channel for hidden ownership, weak governance, and systemic risk.
The directive comes at a critical moment. Nigeria’s payments industry has expanded rapidly, transforming electronic payments into the engine of daily commerce. NIBSS data showed that electronic payment transactions rose to N284.99 trillion in the first quarter of 2025, up from N234.49 trillion a year earlier. The CBN also reported that nearly 11 billion transactions passed through the NIBSS Instant Payments platform in 2024, up from about five billion in 2022. The system has become too large and interconnected to be governed by loose ownership disclosure and offshore data dependence.
As digital finance grows, the identity of those who ultimately control banks, fintechs and payment platforms becomes a matter of national financial security. Hidden ownership is not merely a legal issue; it can determine who controls customer data, influence credit flows, benefit from market dominance, and potentially exploit the financial system for illicit purposes.
This explains the directive’s emphasis on Ultimate Beneficial Ownership. According to the Executive Director, Operations at DataPro Limited, Mr. Oladele Adeoye, the requirement aligns with FATF Recommendations 10 and 25 by enabling the CBN to identify the natural persons behind financial institutions and prevent sanctioned persons or disguised interests from controlling the ecosystem.
Similarly, the Head of ERM Advisory Services at DataPro, Mr. Shittu Idris, described the disclosure requirement as a critical safeguard for sustaining Nigeria’s anti-money laundering progress. He noted that the directive aligns with FATF Recommendations 24 and 25, which place strong emphasis on beneficial ownership transparency to prevent criminals, tax evaders and shell companies from concealing illicit financial flows through opaque corporate structures. According to him, the measure will also reduce “proxy risks” in which cross-border criminal actors exploit local fintech platforms as intermediaries for financial crimes.
Nigeria’s experience with the Financial Action Task Force (FATF) lends additional significance to the reform. In February 2023, Nigeria was placed on the FATF grey list due to weaknesses in its anti-money laundering and counter-terrorist financing framework. FATF required improvements in areas such as risk-based supervision, beneficial ownership transparency, enforcement, and financial intelligence. Although Nigeria exited the grey list in October 2025 after completing its action plan, the episode demonstrated how weaknesses in financial integrity can damage a country’s international reputation.
The banking industry has already witnessed the consequences of governance failures. In January 2024, the CBN dissolved the boards and management of Union Bank, Keystone Bank and Polaris Bank over governance concerns and regulatory non-compliance. The controversy surrounding Titan Trust Bank’s acquisition of Union Bank also highlighted how questions about ownership, funding sources and control can create uncertainty around major financial transactions.
Heritage Bank provided another warning. In June 2024, the CBN revoked its operating licence after the bank failed to recover from persistent financial weakness. Although the case was not solely about ownership disclosure, it illustrated how weak governance, poor risk management, and ineffective supervision can ultimately threaten financial stability.
The fintech sector presents a different but equally important challenge. Many leading fintechs are privately held, rapidly expanding, and backed by multiple layers of local and foreign investors. While this does not imply improper ownership, it can make ultimate control less visible than in publicly listed banks.
Companies such as Moniepoint, OPay, PalmPay, Flutterwave, Paga and Kuda have become central to payments, transfers, merchant services and digital banking. Reuters reported in 2024 that Moniepoint raised $110 million from investors including Google, DPI, Lightrock and Verod Capital, lifting its valuation above $1 billion. The Financial Times reported that PalmPay, launched in 2019, had grown to 35 million registered users. Such a scale makes regulatory clarity over ownership, governance, and data management essential.
The CBN has consequently designated several leading fintechs as systemically relevant participants. That designation means these firms are no longer peripheral technology start-ups but part of the country’s critical financial infrastructure. A major failure, cyberattack, or compliance breach affecting any of them could have consequences for millions of consumers and businesses.
This concern explains the second pillar of the directive: data localisation. From January 1, 2027, payment transaction data generated in Nigeria must be stored and managed within the country. While the concept may seem technical, it is central to financial sovereignty. Payment data reveals how money moves across the economy, how businesses operate, and how consumers transact. If such information is held offshore, regulators may encounter delays, legal hurdles or jurisdictional constraints during investigations.
Data localisation could also stimulate investment in local data centres, cybersecurity infrastructure and cloud services, creating opportunities for domestic technology providers and skilled professionals. However, it will increase compliance costs, particularly for smaller fintechs that depend heavily on foreign cloud infrastructure. Some of these costs may eventually be passed on to customers.
The third element of the reform addresses concentration risk. Under the new framework, an institution controlling more than 25 per cent of the card-issuing market cannot hold more than 15 per cent of the merchant-acquiring market, and vice versa. The objective is to prevent excessive dominance across critical segments of the payment chain.
In a market where digital payments have become indispensable, excessive concentration can weaken competition, discourage innovation, and create institutions that are effectively too important to fail. The new limits are therefore designed to preserve competitive balance while reducing systemic vulnerability.
The benefits of the directive are evident. Greater ownership transparency can reduce illicit financial flows, strengthen investor confidence, and support international banking relationships. Data localisation can improve regulatory oversight and cybersecurity control, while market-share restrictions can promote competition and reduce systemic risk.
The challenges are equally clear. Compliance costs will increase, smaller operators may struggle to adapt, and some institutions may be forced to restructure ownership or technology arrangements. Nevertheless, the long-term direction is difficult to fault. Nigeria’s digital payments ecosystem has outgrown the light-touch assumptions that characterised its early years and now requires rules that reflect its size, influence and importance.
The CBN’s directive is therefore more than a routine regulatory circular. It is an attempt to strengthen the foundations of digital finance by making ownership more transparent, data more secure, and competition more balanced. If implemented effectively, it could help Nigeria build a payments system that is not only innovative but also resilient, transparent, and trusted.
