Q1. How long should customer data be kept in Nigeria?

There is no single data retention period for all customer data. Relevant AML records generally have a five-year minimum retention requirement, while other personal data should be retained only as long as necessary under applicable law and guidance.

Q2. Does the NDPA specify a data retention period?

The NDPA requires personal data to be retained no longer than necessary for its purpose. The applicable period depends on the data and any other legal or regulatory obligation. GAID provides additional guidance on retention and deletion.

Q3. How long should banks retain KYC records?

Relevant KYC and customer due diligence records are generally subject to a minimum five-year retention period under the MLPPA, typically measured from the end of the business relationship. Banks should verify the exact requirements and trigger applicable to each record.

Q4. When should customer data be deleted?

Customer data should be deleted or securely disposed of when it is no longer needed for its purpose and no applicable legal obligation, legal claim or other lawful basis justifies continued retention.

Q5. Can financial institutions retain data after an account is closed?

Yes. They may need to retain certain records to meet AML, regulatory or other legal obligations. However, closing an account does not justify keeping every category of customer data indefinitely. Each record should follow its applicable data retention period.

Data Retention Policy in Nigeria: Guide for Banks

Financial institutions collect large amounts of customer information, from identity documents and BVN details to transaction records and fraud investigation reports. But how long should they keep this information, and when should it be deleted?

A data retention policy helps banks, fintechs and other financial institutions answer these questions. It defines what information an organisation keeps, why it needs the information, how long it should remain in its systems and when it must be securely deleted.

In Nigeria, the answer depends on the type of record and the laws that apply to it. The Nigeria Data Protection Act (NDPA) requires organisations to limit how long they retain personal data, while the Money Laundering (Prevention and Prohibition) Act 2022 (MLPPA) imposes specific recordkeeping obligations on financial institutions. The Nigeria Data Protection Commission (NDPC) also provides implementation guidance through its General Application and Implementation Directive (GAID).

For financial institutions or banks, an effective data retention policy must balance these obligations. Keeping customer information longer than necessary increases privacy and security risks, but deleting records too early can undermine regulatory compliance and investigations.

This guide explains how data retention works in Nigeria, how to determine the right data retention period for different financial records, and how institutions can manage customer data retention without conflicting with their legal obligations.

What Is a Data Retention Policy in Nigeria?

A data retention policy is a documented set of rules that explains what data an organisation keeps, why it keeps it, how long it retains it and how the information is securely deleted or disposed of when it is no longer needed.

In Nigeria, the policy should reflect the NDPA 2023, applicable NDPC guidance, anti-money laundering laws and any relevant sector-specific requirements from regulators such as the Central Bank of Nigeria (CBN).

For a bank or fintech, a data retention policy may cover:

Customer identification records: BVN, NIN, identity documents and verification results.
Transaction records: Payment details, account activity and transaction histories.
AML records: Customer due diligence, suspicious transaction investigations and regulatory reports.
Account records: Account-opening documents, agreements and correspondence.
Consent and marketing records: Customer preferences, consent records and withdrawal requests.
Fraud investigation records: Alerts, investigation findings and documented decisions.

Each category may have a different retention requirement. An institution should therefore avoid assigning one blanket data retention period to every record in its systems.

For example, a transaction record that must be preserved under anti-money laundering legislation should not be deleted simply because the customer has closed their account. At the same time, the institution should not assume that every document collected during onboarding must be kept indefinitely.

The purpose of a data retention policy is to establish a defensible rule for each category of information, supported by the relevant legal or business requirement.

How Long Should Financial Institutions Keep Customer Data?

There is no single data retention period that applies to every type of customer data in Nigeria. The appropriate period depends on the purpose for which the information was collected, the applicable legal requirements and whether a continuing lawful reason exists to retain it.

Two important frameworks guide financial institutions.

1. The NDPA 2023 and GAID 2025

Section 24 of the NDPA establishes data protection principles, including purpose limitation and the requirement to retain personal data only for as long as necessary for the purpose for which it is processed.

The NDPC's General Application and Implementation Directive (GAID) 2025 provides further operational guidance on retention and deletion. Article 49 addresses the end of the retention period where no time-bound legal obligation applies, while Article 21(2) addresses personal data collected during pre-contract due diligence where no contract follows.

2. The Money Laundering (Prevention and Prohibition) Act 2022

Section 8 of the Money Laundering Prevention and Prohibition Act (MLPPA), 2022 establishes recordkeeping obligations for financial institutions. Relevant customer due diligence and transaction records generally have a minimum five-year retention requirement, with the starting point depending on the record type. Customer due diligence records are generally retained for at least five years after the end of the business relationship, while transaction records are generally retained for at least five years after completion of the transaction.

Nigeria's central bank and financial regulator also sets relevant recordkeeping requirements for institutions under its supervision. These requirements mean that a data retention period must be determined record by record. The institution should identify the legal basis for keeping each category and the event that starts the retention clock.

Where a statutory obligation requires a record to be retained, the organisation must account for that obligation before deleting the information under its general retention schedule. Once the required period ends, the institution should reassess whether another lawful purpose justifies continued storage.

A data retention policy should therefore specify not only how long data is kept, but also when the period starts, what exceptions apply and what happens when the retention period expires.

What Should a Data Retention Policy Include?

A useful data retention policy should give employees clear instructions they can apply in daily operations. It should cover the following areas.

1. Data categories and purposes

List the types of personal and business data the institution collects, where the data is stored and why it is needed. This helps distinguish information required for AML compliance from data used for marketing, customer support or product analytics.

2. Retention periods and legal basis

Specify the applicable data retention period for each category and document the relevant law, regulation, contract or legitimate business requirement. Avoid unsupported blanket rules.

3. Retention triggers

State when the retention clock begins. For example, the relevant trigger may be the completion of a transaction, the end of a business relationship or the point at which a processing purpose has been fulfilled.

4. Access and security controls

Limit access to retained information to authorised personnel. Use appropriate access permissions, monitoring and security controls to reduce the risk of unauthorised disclosure.

5. Deletion and disposal procedures

Explain how records are deleted, anonymised or securely disposed of when retention is no longer justified. Include applicable backups, third-party systems and archived records.

6. Exceptions and legal holds

Provide a documented process for records that must be preserved for litigation, investigations or regulatory requirements. A legal hold should identify the affected records, reason for preservation and conditions for release.

7. Accountability and review

Assign responsibility for the policy to the relevant teams, including compliance, legal, IT and data protection personnel. Review it regularly as laws, business processes and systems change.

A data retention policy is only useful if these rules are reflected in actual systems and workflows. A written document cannot prevent over-retention if nobody knows which records are due for deletion.

What Nigerian Laws and Regulations Govern Data Retention?

Financial institutions and banks in Nigeria may have to comply with several overlapping requirements. The main frameworks to consider include the following.

- Nigeria Data Protection Act 2023

The NDPA is Nigeria's principal data protection law. Section 24 includes the storage limitation principle, requiring personal data to be retained no longer than necessary for its processing purpose. Section 34 also establishes data subject rights, including the right to request erasure, subject to applicable conditions and exceptions.

This means a data retention policy must consider why information is being kept and whether the purpose or legal basis for retaining it still applies.

Read our guide to NDPA 2023 for financial institutions in Nigeria.

- NDPC General Application and Implementation Directive (GAID) 2025

The GAID provides implementation guidance for the NDPA. Its provisions address matters including data retention, deletion, data subject rights and compliance processes.

For example, Article 49 addresses the retention and deletion of personal data when no time-bound legal obligation requires continued storage. Article 21(2) addresses personal data collected during pre-contract due diligence where no contract follows.

- Money Laundering (Prevention and Prohibition) Act 2022

The MLPPA establishes recordkeeping obligations for relevant financial institutions. Section 8 requires covered records to be retained for specified periods, including at least five years for relevant customer due diligence and transaction records, with different triggers depending on the record.

These obligations are particularly important for KYC files, transaction records and evidence supporting AML investigations. A financial institution should not delete records subject to a statutory retention requirement simply because a customer requests erasure or closes an account.

- Central Bank of Nigeria requirements

Banks and other CBN-regulated institutions must consider the recordkeeping obligations applicable to their activities. These may cover customer identification, due diligence, transactions and evidence supporting compliance decisions.

Institutions should consult the current CBN regulations and guidance applicable to their licence and operations rather than assume that one schedule covers every financial service.

The CBN's 15 June 2026 payment data localisation circular also introduces a separate requirement concerning where payment transaction data generated in Nigeria must be stored and managed, with compliance from 1 January 2027. This is a data location requirement, not a universal retention period.

Taken together, these frameworks mean that data retention requires both a clear understanding of the relevant obligations and a process for applying them to each record category.

How Long Should Different Types of Financial Records Be Kept?

The correct data retention period depends on the record, its purpose and the applicable legal requirements. The following table provides a practical starting point for Nigerian financial institutions. It is not a substitute for checking the current rules applicable to a specific institution.

Record type	Retention approach
1. Customer due diligence and relevant KYC records	Generally retain for at least five years after the end of the business relationship where the MLPPA applies.
2. Transaction records	Generally retain for at least five years after completion of the transaction where the MLPPA applies.
3. AML investigation and regulatory reporting records	Apply the specific statutory requirements and relevant starting dates for the record type.
4. Records from onboarding applications that never became a contract	Assess GAID Article 21(2), including its six-month destruction rule and applicable exception for justified legal claims.
5. Marketing and consent records	Retain while needed to demonstrate and manage the relevant processing basis, preferences and obligations. Review and delete when no longer justified.
6. Customer communications and account correspondence	Apply relevant statutory and regulatory requirements, then reassess whether continued storage is necessary.
7. Fraud investigation records	Retain according to applicable legal obligations, investigation needs and documented legal holds.
8. Backups and archived data	Include them in the retention schedule and apply appropriate deletion or expiry controls.

The five-year AML period should not be applied indiscriminately to every record held by a financial institution. Likewise, the six-month rules in GAID should not be treated as overriding a specific statutory obligation to preserve a record.

A practical example: a fintech customer closes an account

Imagine a Nigerian fintech customer closes their account on 30 June 2026. The fintech holds identity verification records, transaction history, marketing preferences and an application from another person who abandoned onboarding before becoming a customer.

The institution should not simply set every record to delete five years after account closure.

KYC and transaction records: Determine which records fall under the MLPPA's five-year requirements and apply the correct trigger for each record.
Marketing preferences: Assess whether the information is still needed to manage the customer's preferences or demonstrate compliance. The AML retention period does not automatically justify retaining marketing data for five years.
Abandoned onboarding data: Apply the relevant GAID requirements where no contract followed, including the applicable six-month rule and any justified exception.
Records under investigation or legal hold: Preserve the relevant material for as long as the applicable legal obligation or documented hold requires it.

The fintech should also document the basis for each decision and ensure that deletion covers relevant copies and third-party systems. This approach makes customer data retention more precise and reduces the risk of deleting records too early or keeping unnecessary information indefinitely.

How Should Financial Institutions Implement a Data Retention Policy?

Implementing a data retention policy requires more than agreeing on retention periods. Institutions must connect those periods to their systems, responsibilities and daily processes.

Step 1: Map the data you hold

Create an inventory of customer information, transaction records, KYC files, AML reports and other relevant data. Identify where each category is stored, who can access it and which teams or vendors process it.

Step 2: Match each category to its legal requirements

Work with compliance and legal teams to identify the applicable NDPA, GAID, MLPPA, CBN and other sector-specific obligations. Record the legal basis and retention trigger for each category.

Step 3: Create a retention schedule

Set out the record type, purpose, required retention period, starting event, responsible team and action required when the period expires.

Step 4: Automate review and deletion

Where possible, configure systems to flag records approaching the end of their retention period. Automate deletion or anonymisation where appropriate, while allowing documented legal holds and statutory exceptions.

Step 5: Keep evidence of compliance

Maintain records of deletion actions, approved exceptions, policy reviews and retention decisions. This evidence helps demonstrate that the institution applies its policy consistently.

Step 6: Review vendors and third parties

Check how verification providers, cloud platforms, outsourced service providers and other processors retain and delete data. Contracts and operating procedures should support the institution's obligations.

Step 7: Audit the policy regularly

Review retention periods when laws change, products evolve or new data categories are introduced. Check that the schedule is being followed in practice.

A well-implemented data retention policy helps institutions apply the right data retention period to each record instead of relying on manual decisions or indefinite storage.

Best Practices for Data Retention in Nigerian Financial Institutions

The following practices help financial institutions make data retention more consistent and easier to manage.

1. Retain data for a defined purpose: Every category should have a clear reason for continued storage.

2. Use record-specific retention periods: Avoid assigning the same data retention period to unrelated records.

3. Separate statutory records from optional business data: An AML obligation to preserve one record does not automatically justify keeping every related piece of information.

4. Automate where practical: Use alerts, retention schedules and deletion workflows to reduce reliance on manual tracking.

5. Control access: Limit retained information to authorised users and review permissions regularly.

6. Include vendors and backups: Ensure retention and deletion processes account for data held outside the institution's primary systems.

7. Document exceptions: Record why information must be retained beyond its usual period and when the exception should be reviewed.

8. Train staff: Help employees understand when data should be preserved, reviewed or securely deleted.

These practices support an effective data retention policy while reducing unnecessary data exposure. They also help financial institutions demonstrate that their approach to customer data retention is deliberate, documented and aligned with applicable obligations.

Complying with Data Retention Requirements in Nigeria with Youverify

Financial institutions collect a lot of customer information during onboarding and identity checks. Knowing what to keep, who can access it and when to delete it can be difficult, especially when records are stored across different systems.

Youverify assists financial institutions to verify customer identities and manage KYC and AML compliance processes. These solutions support customer onboarding and help teams carry out the checks needed to meet compliance requirements.

However, collecting and verifying customer information is only part of the process. Financial institutions also need clear rules for how long to keep records, how to protect them, and when to delete information they no longer need.

With a clear data retention policy and the right compliance tools, institutions can manage customer records more effectively while meeting their legal obligations.

Speak with us or book a demo to learn more.