Nigeria · Compliance
PCI DSS compliance in Nigeria
Achieve PCI DSS compliance in Nigeria with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Compliance, end to end
- Lagos office team
- Effivity software included
- Academy training included
Who asks for PCI DSS in Nigeria
Clients include
PCI DSS compliance in Nigeria at a glance
Central Bank of Nigeria circular on the timeline for PCIDSS certification refers to PCI DSS, yet none of the Nigerian instruments checked makes it compulsory. Buyers in Nigeria ask for it anyway.
Nigeria has had PCI DSS on its banking agenda for years: the Central Bank of Nigeria's 2014 circular is titled as setting the timeline for PCI DSS certification by deposit money banks, switches and processors. Beyond that circular, the requirement travels by contract. Acquirers and payment brands decide who validates, since the PCI Security Standards Council says it does not enforce compliance, and a Nigerian BPO, fintech or e-commerce platform meets the standard when it handles card data for a client or a scheme. PCI DSS is not a certificate: a Qualified Security Assessor writes a Report on Compliance, or a self-assessment questionnaire applies, and the Nigeria Data Protection Act's own duties stay separate. Sterling's Lagos office helps scope the cardholder data environment, reduce it where possible and prepare evidence before the assessor starts, with Effivity and Sterling Academy included with the engagement.
Who needs PCI DSS in Nigeria, and what happens without it
These are the organisations in Nigeria that most often need to show PCI DSS.
- Banks, switches and card processorsThe Central Bank of Nigeria has issued a circular on the timeline for PCI DSS certification by deposit money banks, switches and processors.
- Fintechs, payment gateways and wallet providers handling card dataAcquirers and payment brands decide who must validate compliance and how, whatever Nigerian rules say.
- Merchants and e-commerce platforms accepting cardsAcquirers set validation levels, usually by transaction volume and channel, through a questionnaire or an assessor's report.
- BPO and contact-centre firms handling card data for overseas clientsThe client's acquirer or payment brand usually asks the provider for validated compliance.
- Financial institutions facing the Central Bank's cybersecurity frameworksPCI DSS controls overlap with, and are separate from, the Bank's risk-based cybersecurity expectations.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the PCI DSS readiness checkPCI DSS requirements in Nigeria
Strip away the vocabulary and PCI DSS asks any business that stores, processes or transmits card data to comply in six areas.
In Nigeria these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: PCI DSS explained →
How to achieve PCI DSS compliance in Nigeria
One team from the Lagos office carries the work from scoping to sign-off. Clients across Nigeria are served from Sterling's Lagos office, on-site where the work needs it and remotely otherwise.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against PCI DSS and the Nigerian requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
- Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does PCI DSS compliance take in Nigeria?
There is no standard duration: it depends on your scope and on how much of the system already runs. In Nigeria these are the factors that set the timeline.
- Size of the cardholder data environment and its segmentation
- Number of payment channels, systems and service providers
- Maturity of logging, vulnerability management and access control
- Acquirer and assessor scheduling
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does PCI DSS compliance cost in Nigeria?
The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In Nigeria these factors move both.
- Scale of the in-scope environment and merchant or service-provider level
- Assessor fees, quoted separately from readiness consulting
- Segmentation, tokenisation or tooling changes
- Scanning and penetration testing
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
PCI DSS consultants and assessors in Nigeria
Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers PCI DSS and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in Nigeria are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive PCI DSS in Nigeria (3)
| Instrument | How it treats the standard |
|---|---|
| Central Bank of Nigeria circular on the timeline for PCIDSS certification | Refers to / expects Circular BPS/DIR/GEN/CIR/01/004 of 24 April 2014 is titled as concerning the timeline for PCI DSS certification by all deposit money banks, switches and processors; confirm its current effect with the Bank. |
| PCI Security Standards Council — role and programmes | Scheme rule The Council develops the standard and lists assessor programmes, says it does not enforce compliance, and leaves the requirement to comply or validate to organisations that manage compliance programmes such as payment brands and acquirers. |
| Nigeria Data Protection Act, 2023 — security duty | Related The Act separately requires appropriate security measures for all personal data; PCI DSS covers payment account data and does not replace it. |
Accreditation, audit language and remote audits in Nigeria
PCI DSS is a compliance obligation set through the payment brands and acquirers, not a certificate. Depending on volume and role, validation is by a Qualified Security Assessor producing a Report on Compliance or by a self-assessment questionnaire, as your acquirer requires. Neither Sterling nor an ISO certification body validates it, and the PCI Security Standards Council says it does not enforce compliance. The Central Bank has addressed PCI DSS certification for banks, switches and processors in a 2014 circular; confirm your own obligations with your acquirer and the Bank. Edition and transition details: PCI DSS hub →
Audit language
English is the usual audit and document language; agree it with the certification body at application, and say early if interviews will run in another language.
Remote and on-site
Assessors review systems, networks and records; evidence collection and walkthroughs are often remote, and data centres or payment operations rooms in scope may be visited.
PCI DSS in Nigeria: questions clients ask
Is PCI DSS mandatory for Nigerian banks and processors?
The Central Bank issued a circular in 2014 on the timeline for PCI DSS certification by deposit money banks, switches and processors, so the subject has been regulated for them. What the circular requires today is for the Bank to confirm. Acquirers and payment brands may add contractual terms, so check both before you plan.
Who validates PCI DSS compliance in Nigeria?
Your acquirer or payment brand sets the route. For larger volumes it is usually a Qualified Security Assessor, who produces a Report on Compliance; for smaller ones, a self-assessment questionnaire. The PCI Security Standards Council lists assessors but says it does not enforce compliance. Neither Sterling nor an ISO certification body validates it. Ask your acquirer which route applies.
Does PCI DSS compliance satisfy the Nigeria Data Protection Act?
No. PCI DSS protects payment account data, while the Act governs all personal data, including registration, notices, data subject rights, breach reporting and transfers abroad. The security controls overlap, which helps, but one does not stand in for the other. Ask your counsel or the Commission where your obligations differ.
Does a Nigerian BPO need PCI DSS to process card data for an overseas client?
Usually the client's acquirer or payment brand will ask for validated compliance whenever the BPO touches card data, regardless of local rules. The size of the cardholder data environment and how well it is segmented then drive the effort. Ask the client which validation route it accepts before you scope any work.
More on PCI DSS for Nigerian organisations
- PCI DSS: the complete guide
- Watch: How to implement PCI DSS
- Banking and financial services: PCI DSS for the sector
- BPO and contact centres: PCI DSS for the sector
- E-commerce and retail: PCI DSS for the sector
- Fintech and payment facilitators: PCI DSS for the sector
- Healthcare providers and insurers: PCI DSS for the sector
- Hospitality and travel: PCI DSS for the sector
- Software and hosting: PCI DSS for the sector
- Sterling in Lagos
- PCI DSS compliance in Nigeria and every other standard Sterling delivers there
Other standards Nigerian businesses ask Sterling for
Organisations in Nigeria often combine PCI DSS with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Lagos office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Central Bank of Nigeria circular on the timeline for PCIDSS certification — cbn.gov.ng (accessed 11 Oct 2026)
- PCI Security Standards Council — role and programmes — pcisecuritystandards.org (accessed 11 Oct 2026)
- Nigeria Data Protection Act, 2023 — security duty — ndpc.gov.ng (accessed 11 Oct 2026)
Talk to a consultant
Plan your certification with the Lagos team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Lagos office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice