Reps propose 10-year jail term for illegal payment data transfers

The proposed legislation also seeks to require banks, financial technology companies, payment service providers and other financial institutions to keep their primary payment data infrastructure within the country.

Also read: Adeboye seeks stronger Nigeria-Morocco sports partnership

Under the bill, institutions that fail to comply with the proposed data localisation requirements could face a minimum fine of N1bn, alongside additional daily penalties for continuing violations.

Sponsored by the member representing Surulere II Federal Constituency of Lagos State, Lanre Okunlola, the bill seeks to establish the National Payment Data Protection and Sovereignty Commission as the principal authority responsible for regulating and protecting payment transaction data generated in Nigeria.

Titled, A Bill for an Act to Establish the National Payment Data Protection and Sovereignty Commission, the proposed legislation is intended to strengthen Nigeria’s control over its financial information infrastructure, address cybersecurity threats and reduce dependence on offshore payment data storage and processing facilities.

The bill was introduced during a plenary session last week and is expected to be considered by lawmakers in the coming weeks.

Section 23 of the proposed legislation provides that anyone who transfers payment data outside Nigeria without authorisation commits an offence.

Upon conviction, the individual could face imprisonment for a term not exceeding 10 years, a fine of at least N500m, or both.

The bill states that anyone who transfers payment data abroad without the required approval would be liable to the prescribed penalties.

Similarly, Section 22 proposes a minimum fine of N1bn for financial institutions that fail to comply with the data localisation requirements, in addition to daily penalties for continued violations.

The provisions would introduce stricter obligations for financial institutions handling payment transactions generated within Nigeria.

Under Section 8, the bill classifies all payment transaction data generated within Nigeria as a “Strategic National Economic and Security Asset”.

Section 9 further proposes that such data must be stored within Nigerian territory.

Banks, fintech companies, payment service providers, switching companies and settlement system operators would also be required to maintain their primary payment data infrastructure within the country.

The proposed legislation seeks to prohibit regulated institutions from hosting their primary payment transaction data abroad without approval from the proposed commission, in conjunction with the Central Bank of Nigeria.

Section 10 also provides that domestic payment transactions must be processed through infrastructure physically located within Nigeria.

Despite its emphasis on local data storage and processing, the proposed legislation recognises the need for international financial transactions.

Section 18 provides that strategic payment data must not be transferred outside Nigeria without authorisation from the proposed commission.

Under Section 19, approval may be granted where the transfer is necessary to meet international settlement obligations, national security interests are protected, adequate safeguards are in place and the Central Bank of Nigeria has given its approval.

The bill also seeks to strengthen cybersecurity protections by classifying payment transaction infrastructure as Critical National Information Infrastructure.

It would empower the proposed commission to establish minimum security and resilience standards for payment data infrastructure.

Also read: Adeboye seeks stronger Nigeria-Morocco sports partnership

If passed and assented to by the President, the legislation would introduce a new regulatory framework governing how financial institutions store, process and transfer payment transaction data in Nigeria.