Digital-Asset Licensing in Nigeria: What Businesses Need to Know

Operating a virtual asset service provider (VASP) business in Nigeria without the right regulatory authorisation is not simply a compliance gap — it is a direct exposure to enforcement action, frozen banking rails and the loss of the ability to serve clients at all. As supervisory regimes across Africa converge on the international FATF model, Nigeria's digital-asset sector has moved from regulatory ambiguity to structured licensing requirements in a compressed timeline. The Securities and Exchange Commission of Nigeria (SEC Nigeria) now administers a formal licensing regime for digital-asset businesses, and the Central Bank of Nigeria (CBN) retains parallel authority over payment-related activity. For any inbound operator or locally incorporated business, understanding how these two authorities interact is the starting point — not an afterthought.

This page sets out the Nigerian regulatory environment for digital-asset businesses: who needs a licence, what the process involves, how the cross-border reality affects structuring decisions, and where the common mistakes occur. It is written for the general counsel, founder or CFO deciding whether Nigeria belongs in their licensing stack.

Who Regulates Digital Assets in Nigeria?

Two federal bodies share jurisdiction over digital-asset activity in Nigeria, and a business that maps only one risks falling squarely inside the other's enforcement perimeter. SEC Nigeria is the primary regulator for digital-asset businesses, operating under a framework that classifies most crypto-assets as securities or investment products unless proven otherwise. The CBN retains authority over payment systems, stablecoins with payment features, and the banking rails that digital-asset businesses depend on.

SEC Nigeria issued its first substantive framework for digital-asset businesses through its rules on digital assets, establishing categories for digital-asset offering platforms, digital-asset exchange operators, digital-asset custodians, and digital-asset fund managers. Each category carries its own authorisation requirement, capital posture and ongoing obligation set. The CBN's position has evolved: after an earlier directive that restricted banks from servicing crypto entities, the CBN lifted that restriction and signalled a more structured co-regulatory approach with SEC Nigeria, particularly for businesses that touch the payment stack.

A business sitting between exchange activity and payment settlement — a common profile in Nigeria's fintech market — must therefore map its activities against both regulatory perimeters before it can determine which licence or licences it needs. In our practice, this dual-authority analysis is the first task we perform for any Nigeria-facing client, because the wrong assumption at the outset delays every subsequent step.

The FATF Travel Rule (the obligation to pass originator and beneficiary data with a virtual-asset transfer) applies in Nigeria as part of the country's FATF member obligations, and SEC Nigeria's AML/CFT expectations for licensed VASPs mirror the FATF Recommendation 15 standard. Businesses moving from registration to full authorisation face detailed AML programme requirements from day one.

To map your regulatory perimeter across both SEC Nigeria and CBN before you begin the authorisation process, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts — the entity, the user base, the banking — change the analysis.

Who Needs a Digital-Asset Licence in Nigeria?

Any business that offers, operates, exchanges, custodies or manages digital assets for clients in Nigeria falls within the SEC Nigeria licensing perimeter, regardless of where the entity is incorporated. The reach of the regime is conduct-based, not domicile-based. An offshore company targeting Nigerian users through a Nigerian-language interface, accepting Nigerian payment methods, or employing Nigerian-resident staff in a client-facing role will be treated as carrying on regulated activity in Nigeria.

The categories that most commonly arise in practice include:

• Digital-asset offering platforms — businesses that conduct or facilitate token offerings to Nigerian investors, including initial exchange offerings (IEOs) and digital-asset security offerings.
• Digital-asset exchange operators — centralized and, increasingly, decentralized exchange interfaces that permit Nigerian residents to buy, sell or swap crypto-assets.
• Digital-asset custodians — entities holding private keys or digital-asset balances on behalf of Nigerian clients, whether as a primary service or embedded within a broader product.
• Digital-asset fund managers and portfolio managers — entities that exercise discretion over digital-asset portfolios on behalf of Nigerian investors.

The boundary cases are instructive. A pure technology provider that supplies white-label exchange infrastructure to a licensed Nigerian operator, without itself holding client assets or taking orders, may not require its own authorisation — but that analysis turns on the specific commercial arrangements, and regulators have been willing to look through label-based distinctions to the economic substance of the relationship.

Foreign operators frequently assume that an offshore licence — in a MiCA jurisdiction, for instance, or in an ADGM-regulated entity — is sufficient to serve Nigerian clients. It is not. Nigeria's regime operates independently of foreign authorisation, and SEC Nigeria does not grant automatic recognition to foreign licences. A business with strong EU or Gulf credentials must still seek Nigerian authorisation if it actively targets Nigerian clients.

What Are the Licence Categories and What Does the Process Involve?

SEC Nigeria's digital-asset framework operates a staged process: a business first applies for registration as a digital-asset business, which leads to a no-objection approval, and subsequently moves toward full licensing once the regulator has conducted a more detailed review of systems, controls and personnel. The precise stages, timelines and capital requirements are set out in SEC Nigeria's rules and are subject to ongoing revision as the regime matures — any business should work from the current regulatory text, not a historical summary.

The application process typically involves:

1. Entity incorporation — a locally incorporated Nigerian entity (typically a private limited company) is required; offshore structures acting through a branch are not the standard route for exchange or custody operations.
2. Minimum capital subscription — SEC Nigeria sets minimum paid-up capital requirements that vary by licence category. These figures are set in the rules and should be confirmed against the current regulatory text before any commitment, as they have been revised since the regime's inception.
3. Fit-and-proper assessment — directors, controlling shareholders and key executives must pass a regulatory vetting process, including background checks, financial soundness review and assessment of relevant industry experience.
4. Technology and systems review — the applicant must demonstrate that its trading, custody or offering platform meets SEC Nigeria's technical and cybersecurity expectations, including segregation of client assets.
5. AML/CFT programme documentation — a full AML/CFT policy, customer due-diligence procedures, transaction monitoring protocols and Travel Rule compliance mechanisms must be submitted and approved.
6. Regulatory engagement — SEC Nigeria expects active engagement during the review process; applications that sit dormant without follow-up typically experience extended review periods.

Timelines for Nigerian regulatory authorisation vary considerably depending on the completeness of the application, the category of licence and the regulator's current review capacity. In our experience advising on Africa-facing licensing structures, applicants that submit complete, well-documented files with experienced legal and compliance support move through the process more efficiently than those filing without professional guidance. Treating the process as administrative form-filling, rather than a regulatory dialogue, is the single most common mistake we observe.

A micro-matter from our practice: in a recent licensing matter, a payments-adjacent token platform incorporated in a common-law offshore jurisdiction sought to onboard Nigerian institutional clients. The platform had assumed its existing regulatory authorisation was portable. We identified the dual-authority gap — SEC Nigeria's conduct-based reach and the CBN's payment-layer requirements — restructured the entity's Nigerian operations into a locally incorporated subsidiary and prepared a phased application strategy that addressed both regulators' concerns simultaneously. The business launched its Nigerian operations on a compliant basis without the disruption of an enforcement inquiry.

How Does the Cross-Border Reality Affect the Licensing Structure?

For most businesses seeking Nigerian authorisation, the licensing question does not exist in isolation. The Nigerian entity is typically part of a wider group that operates across West Africa, holds its treasury in a Gulf or European hub, and banks through correspondent relationships that sit outside Nigeria. Each of those layers creates a cross-border legal question that intersects with the Nigerian licence.

Three cross-border interactions deserve particular attention.

Group-level AML and Travel Rule obligations. A Nigerian licensed VASP operating within a wider group must ensure that its AML controls satisfy both SEC Nigeria's requirements and the requirements of whichever jurisdiction the group entity is licensed in. FATF's Recommendation 15 is the common baseline, but the specific technical implementation — which Travel Rule messaging standard, which data fields, which de-minimis threshold — varies by jurisdiction. A Nigerian subsidiary receiving transfers from a MiCA-authorised EU entity must be able to receive and act on Travel Rule data in a way that both regulators accept.

Banking and payment rail access. The CBN's evolving posture toward crypto entities affects which Nigerian banks will open accounts for licensed digital-asset businesses. Some businesses we advise access their Nigerian banking through fintech infrastructure providers that sit within the CBN's payment-system framework, rather than through a direct commercial banking relationship. That structure has its own regulatory logic — and its own compliance overhead.

Token offering cross-border distribution. A token offering conducted by a Nigerian-licensed platform that is also distributed to investors in the EU or the Gulf triggers the offering rules of those jurisdictions in addition to Nigeria's. MiCA's whitepaper obligation and VARA's offering-activity rules do not switch off because the primary platform is Nigerian. Cross-border token distribution must be mapped jurisdiction by jurisdiction before the offering launches.

If your group structure spans Nigeria and one or more offshore hubs, we can map the full licence, banking and compliance stack before you commit. Write to OBOLUS at info@oboluslaw.com. If a prior application stalled or an account was closed, a second review can surface the structural reason and the route forward.

What Are the AML and Travel Rule Obligations for Nigerian VASPs?

Nigeria's AML/CFT framework for digital-asset businesses is anchored in the country's obligations as a FATF member and reflects the FATF Recommendation 15 standard for virtual-asset service providers. SEC Nigeria expects licensed VASPs to maintain a full AML/CFT compliance programme — not merely a policy document, but an operationally implemented system with customer due-diligence procedures, transaction monitoring, suspicious-transaction reporting and an appointed compliance officer.

The Travel Rule requires that any VASP originating a virtual-asset transfer collects and transmits identifying information about the originator and beneficiary to the receiving VASP. The practical implementation challenge in Nigeria — as in most emerging-market VASP regimes — is that the majority of counterpart VASPs a Nigerian business will transact with may not yet have deployed a compliant Travel Rule messaging solution. A licensed Nigerian VASP must have a documented policy for how it handles transfers to and from non-Travel-Rule-compliant counterparties. Regulators in advanced FATF-member jurisdictions are looking at exactly this point when they assess whether to permit their own VASPs to transact with Nigerian platforms.

Customer due diligence in the Nigerian market carries its own complexity. The standard verification stack — government ID, proof of address, source of funds — must be adapted for a population where formal documentation coverage varies significantly by region and by demographic. SEC Nigeria has acknowledged this practical reality, but the expectation of risk-based CDD is clear: enhanced due diligence for higher-risk customers and transaction patterns, documented and auditable.

Businesses we advise routinely underestimate the ongoing compliance overhead of a Nigerian digital-asset licence. Licensing is the entry point. The annual filing, audit, and regulatory reporting obligations — and the expectation that the compliance programme evolves as the regime does — represent a sustained cost that must be built into the business case from the outset.

How Do Banking Access and Tax Interact With the Nigeria Licence?

Securing a digital-asset licence from SEC Nigeria does not automatically open banking doors. The CBN's framework for which payment and banking institutions may service crypto businesses continues to evolve, and the practical reality for many licensed operators is that banking access requires its own parallel engagement track — separate from the SEC Nigeria application process and sometimes more difficult to resolve.

The tax treatment of digital-asset activity in Nigeria is governed by the Federal Inland Revenue Service (FIRS). The broad principle — that income derived from digital-asset trading, exchange operations and token issuance is taxable — is established, but the detailed treatment of specific transaction types, staking rewards, and cross-border flows is still developing through practice and administrative guidance rather than comprehensive legislation. Operators should treat Nigerian tax compliance as a live advisory question, not a settled one.

For businesses operating in a hub-and-spoke structure — a Gulf or EU holding entity with a Nigerian operating subsidiary — transfer-pricing and permanent-establishment considerations compound the domestic tax question. If the Nigerian entity is performing functions that generate economic value for the group (market access, client relationships, local compliance infrastructure), the allocation of that value for tax purposes must be documented and defensible. This is an area where we see under-investment: businesses focus on the licence application and leave the tax and transfer-pricing architecture for later, only to find it requires restructuring at precisely the moment the business is scaling.

How Does Nigeria Compare for an Inbound Operator?

Nigeria presents a specific risk-and-opportunity profile that differs materially from the flagship licensing hubs an inbound operator typically evaluates alongside it.

The opportunity is scale. Nigeria has one of the largest retail crypto-asset user bases on the continent, a large and digitally active population, and a persistent demand for dollar-denominated digital assets driven by naira volatility. For a business whose target market is West African retail and institutional clients, no other jurisdiction offers comparable direct market access.

The regulatory environment is maturing but not yet at the predictability level of, say, the MiCA regime in the EU or the VARA regime in Dubai. SEC Nigeria's digital-asset rules have been revised multiple times since their initial publication. The CBN's posture has shifted more than once. Businesses that require regulatory certainty as a precondition for entry may find Nigeria premature for a primary licensing play, though several operators we advise treat Nigeria as a market-access licence rather than a flagship compliance brand — they hold their primary regulated status in a more established hub and seek Nigerian authorisation specifically to serve the Nigerian market.

Decision matrix by operator profile:

Profile A — West Africa-focused exchange or wallet provider: Nigerian authorisation is the core licence. The group structure should be built around the Nigerian entity from the outset, with a Gulf or EU holding structure for treasury and banking. Timeline is a function of application completeness; budget for a multi-month process and ongoing compliance overhead.

Profile B — EU or Gulf-licensed operator seeking Nigerian market access: Nigerian authorisation is a market-access add-on. The primary compliance brand remains the offshore licence. The Nigerian entity is a regulated subsidiary rather than the group head. Key risk: underestimating the self-contained nature of the Nigerian regime — the offshore licence gives no credit in Abuja.

Profile C — Token issuer distributing to Nigerian investors: SEC Nigeria's rules on digital-asset offerings apply regardless of where the issuer is incorporated. Nigerian legal counsel is required before any offer document is circulated to Nigerian-resident investors. Retroactive compliance is significantly more difficult than pre-offer structuring.

Operators we advise routinely find that the cross-border structuring question — where the entity sits, where the banking lives, where the compliance function is based — determines the regulatory outcome more than any single application document.

What Are the Most Common Mistakes Businesses Make?

The most consequential mistake is timing. Businesses that begin regulatory engagement only after a banking account is closed, an enforcement inquiry is received, or a significant client demands compliance documentation are operating at a structural disadvantage. Enforcement timelines are compressed once a regulator has opened an inquiry. Banking remediation — restoring access to a closed account or finding an alternative rail — takes months, not days. A licence application filed under enforcement pressure is reviewed with a different lens than one filed by a business approaching the market in good faith and in advance.

A common assumption is that a single offshore licence is sufficient to serve clients globally. It is not — and in Nigeria specifically, the conduct-based reach of SEC Nigeria's regime means that an offshore structure providing services to Nigerian clients without Nigerian authorisation is not protected by the offshore licence. The cost of that assumption, in terms of enforcement exposure and remediation work, consistently exceeds the cost of proper pre-entry structuring.

Other recurring mistakes include:

• Underestimating the fit-and-proper vetting timeline for directors and key personnel — this is often the longest sub-process in the application.
• Filing an incomplete AML/CFT programme in the expectation that the regulator will flag deficiencies and allow resubmission — SEC Nigeria's review posture does not guarantee that opportunity.
• Treating the CBN banking-access track as a post-licence task rather than a parallel process — the two tracks should run simultaneously.
• Failing to document the group-level corporate structure in a way that maps cleanly to SEC Nigeria's beneficial-ownership requirements — complex offshore chains are a common friction point.

Related at OBOLUS

• Licensing and Registration for Digital-Asset Businesses – how we map the full licence stack across 70+ jurisdictions for exchanges, custodians and token issuers.
• EMI Licence for Crypto Firms: Early-Stage Founders – payment-layer authorisation options for crypto businesses at the formation stage.
• Banking, Payments and EMI Onboarding for Digital-Asset Businesses – securing and maintaining banking access for licensed and pre-licence digital-asset operators.

FAQ

How long does a crypto licence take to obtain?

In Nigeria, the timeline for SEC Nigeria digital-asset authorisation varies by licence category, application completeness and regulatory capacity. A well-prepared application with full documentation — including a compliant AML/CFT programme, fit-and-proper materials for all relevant personnel, and a complete technology review — moves faster than an incremental submission. Applicants should plan for a multi-month process. Parallel engagement with the CBN on banking access adds a separate track with its own timeline. No timeline can be guaranteed; the regulator controls the pace of review.

Which jurisdiction is best for licensing my crypto business?

There is no universal answer. The right jurisdiction depends on the target market, the business model, the ownership structure and where banking can be maintained. For a business primarily serving West African clients, Nigerian authorisation is the core requirement. For a business seeking a primary regulatory brand with global passportability, the MiCA regime, the VARA regime in Dubai, or the MAS framework in Singapore may be more appropriate — with Nigeria added as a market-access licence. A multi-jurisdiction stack is common. We map each layer before recommending a structure.

Do I need a separate custody licence?

In Nigeria, digital-asset custody is a distinct regulated activity under SEC Nigeria's framework. A business that holds client private keys or digital-asset balances — even as an ancillary feature of an exchange or fund-management product — must assess whether its custody activity requires separate authorisation or falls within the scope of its primary licence. The analysis turns on the specific activities performed and how they are characterised under the current SEC Nigeria rules. Businesses that embed custody in a broader product without addressing this question create an unlicensed-activity exposure.

OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before you commit — so that the authorisation you obtain matches the business you intend to operate, not the business you had in mind when you first filed. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com or message us via t.me/oboluslaw.

By Aisha Tan, Licensing & Jurisdictions Analyst — specialising in Africa-facing and multi-hub digital-asset licensing structures, with a focus on SEC Nigeria and cross-border VASP authorisation strategy.

This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.