Circular PSS/DIR/PUB/CIR/001/004

Prove where your payment data lives.

Moving data to Nigeria is the straightforward part. Showing an examiner what moved, when, and on whose authority is what takes the work.

Built for banks · microfinance banks · mobile money operators · switching companies · PSSPs · super agents

Offshore AWS · Azure · GCS COUNTED · MOVED · CONFIRMED Nigeria Local facility 3 of 3 confirmed at destination certificate issued · keys destroyed
days remaining

From 1 January 2027, payment transaction data generated in Nigeria must be stored and managed in Nigeria. That covers primary processing, databases, backups and operational control, not merely a local copy. Market structure and beneficial ownership requirements fall due a day earlier.

What we do

Three things, each producing something you can hand over

The obligation is wider than a migration. It starts with knowing what you hold.

Data inventory

A register of every system holding payment data, including the databases, backups and log stores no migration tool can move. You cannot attest to what nobody has written down.

Read more

Verified migration

Object storage moved from any S3-compatible source to a Nigerian provider. The source is counted first, every object is read back and size-matched, and interrupted transfers resume rather than restart.

Read more

Attestation pack

One document covering the register, the migrations behind it, and the declarations supporting the rest — with the difference between proven and declared stated on every line.

Read more
Evidence, not assurance

A certificate that refuses to lie

A completion record is issued only when every enumerated object has been confirmed present at the destination. If anything failed, or could not be checked, it refuses and gives its reasons instead of producing a document that looks reassuring.

It states what moved between two named endpoints at a stated moment. It never claims your organisation is compliant, because that judgement is a regulator's.

How the evidence works
Migration completion record SCOPEDELIVERY JURISDICTIONCREDENTIALS 3 objects, counted 13:51 3 of 3 confirmed at size declared by a named person destroyed after verification ISSUED
supplied used once destroyed
Credential handling

We do not keep your keys

Credentials are supplied by you, encrypted, used to perform the migration, then destroyed automatically the moment every object has been confirmed. A transfer that fails keeps them so it can be retried. One that succeeds leaves nothing behind.

No standing access to your storage, and nothing worth stealing in a breach of our database. It is the shortest answer we can give to the question your security review asks first.

Why we build this way

Where are you in the programme?

Whether the migration is in hand and it is the evidence that worries you, or you are still working out what the circular means, we would like to hear where you are.

Get in touch