
The first three drops made an engineering and commercial argument for keeping intelligence close to where the work happens. This drop is the part where the argument stops being ours to make, because the regulator has already made it.
The Central Bank of Nigeria has directed that payment transaction data generated in the country must be stored and managed in Nigeria, with effect from 1 January 2027. The directive covers deposit money banks, microfinance banks, mobile money operators and payment solution providers. Read that list against our portfolio and the scope is not partial.
The Nigeria Data Protection Act sits underneath it, permitting cross-border transfer only in defined circumstances and only with protections in place. Together they draw a boundary, and an AI system is not outside it. A model is the product of the data fed into it, and inference requires continuous access to that data. An AI strategy that has not answered the residency question is a compliance exposure wearing a strategy's clothes.
That date is one hundred and one days from today. There is a version of this that is only a cost, where we lift and shift into a local data centre and carry on renting exactly as before. There is another version where the constraint does what constraints usually do, which is force a better architecture. This is why the sequence in the memorandum matters. Identity, data and knowledge are ours already. Decisions, actions and learning are where the economics sit. Only the middle is rented, and only the middle is what anyone is currently selling.
One hundred and one days. That is not a compliance timetable, it is an architecture timetable, and architecture takes longer than a migration.
Tomorrow, the last one, and the only one with a proposal in it: we do not own the hardware, and that is the opportunity rather than the complaint.