Nigeria has just handed the entity that collects and manages identity data for over 200 million people the authority to also regulate how that data is protected. That is not a governance reform — it is a governance contradiction, and Nigerian fintechs will pay the price.
The revised National Identification Number (NIMC) Act carries data privacy provisions that, on paper, appear progressive. But the legislation simultaneously sidelines the National Data Protection Bureau — the independent regulator explicitly designed to enforce data protection obligations — and consolidates privacy oversight inside NIMC itself Source: FIJ NG. The structural problem is elementary: you cannot meaningfully self-regulate privacy when institutional self-interest runs in the opposite direction. NIMC's mandate is to maximise enrolment and data utility; a privacy regulator's mandate is to constrain those very impulses. Merging both functions inside one agency does not create efficiency — it creates impunity.
What the Law Changes — and What It Doesn't
The Act does not abolish the National Data Protection Bureau. It appears, rather, to carve out NIMC's identity data operations from the Bureau's effective jurisdiction — leaving the Bureau with nominal authority but without the enforcement reach over Nigeria's most consequential data infrastructure. This is a meaningful distinction. Nigerian fintechs handling KYC, lending decisioning, and payments verification rely directly on NIMC's identity stack through the Bank Verification Number system and NIN-linked APIs. The compliance question they now face is not abstract: when a data incident touches identity data sourced from NIMC, which regulator do they answer to, under which framework, and through which enforcement channel? The Act has not answered this clearly.
The Fintech Exposure Is Concrete
Nigeria's fintech sector — encompassing licensed payment service providers, digital lenders, neobanks, and the infrastructure startups serving all of them — operates under a compliance architecture that depends on clear regulatory demarcation. The Central Bank of Nigeria governs payments conduct; the Securities and Exchange Commission governs investment products; the National Data Protection Bureau was positioned to govern data handling obligations across all of them. Removing that Bureau's independent authority over identity data does not simplify compliance — it fragments it. Founders at Lagos-based fintechs building on NIMC APIs now have a material regulatory ambiguity in their compliance stack that they did not have before this Act was signed.
For international investors and institutional partners — European development finance institutions, US-headquartered venture funds, global payment networks — this matters beyond optics. GDPR-aligned due diligence requires evidence of independent supervisory authority over personal data. A self-regulating NIMC does not satisfy that standard, and founders pitching to international capital will increasingly field uncomfortable questions about Nigeria's privacy governance architecture that they cannot easily answer.
A Regional Pattern Worth Watching
Nigeria is not alone in this trajectory. Across the continent, digital identity infrastructure is consolidating inside state agencies whose primary incentive is enrolment scale, not rights protection. The question worth asking — though not yet answerable from available evidence — is whether this represents a deliberate regional trend: African governments reclaiming direct control over identity data stacks as geopolitical and economic assets, with independent regulators treated as inconvenient friction rather than structural safeguards. CIPESA's analysis of digital rights across the continent flags increasing foreign and state influence over digital infrastructure as a live governance risk Source: CIPESA. Nigeria's NIMC Act fits that pattern, whether or not that was the legislative intent.
Meanwhile, competing fintech hubs are not standing still. Kenya's Nairobi International Financial Centre added 15 firms in a Sh25.8 billion investment push, signalling that East African regulators are actively competing for the capital that governance uncertainty in Lagos may dislodge Source: TechTrendsKE.
What Nigerian Regulators Must Do Now
The National Data Protection Bureau should issue an immediate public clarification — not a press release, but a formal regulatory notice — specifying its jurisdiction over NIMC-sourced data and the enforcement mechanisms available to it under the revised Act. Silence from the Bureau will be read by the market as confirmation of its marginalisation. The National Assembly's committees on digital rights and financial services should convene a joint hearing to force the exact compliance question onto the record: when a Nigerian fintech suffers a data breach involving NIN-linked identity data, which regulator has primary enforcement authority, and what is the penalty regime?
Privacy language in a law means nothing if the entity empowered to enforce it is the same one with a structural incentive to overlook violations. Nigeria's fintech ambitions are real, its talent base is formidable, and its market scale is unmatched in West Africa. None of that survives a governance architecture that international partners cannot trust.