Operating a crypto exchange in Nigeria without proper authorisation exposes the business to enforcement by the Securities and Exchange Commission of Nigeria, blocked banking rails and the loss of correspondent relationships that are already difficult to secure in the region. The regulatory question is not hypothetical: Nigerian authorities have signalled, through formal directives and public guidance, that unlicensed virtual-asset activity will attract consequences. For an inbound operator – a business incorporated outside Nigeria but targeting Nigerian users or routing value through Nigerian payment infrastructure – the compliance picture is more complex still, because the regulator looks at economic substance, not registration addresses alone.
Crypto exchange setup in Nigeria requires engagement with the Securities and Exchange Commission of Nigeria (SEC Nigeria), which has asserted primary supervisory authority over virtual asset service providers (VASPs – businesses that offer exchange, custody or transfer of digital assets). Under the applicable VASP provisions now in force, exchanges operating in or into Nigeria must register and comply with the SEC Nigeria regime, including its AML/KYC and Travel Rule (the obligation to pass originator and beneficiary data with every qualifying transfer) requirements. This page sets out the regulated perimeter, the application process, the cross-border interactions that most operators underestimate, and the decision point at which counsel becomes essential.
What Does the Nigerian Regulatory Perimeter Cover for Crypto Exchanges?
The regulated perimeter in Nigeria extends to any business that offers exchange services between virtual assets and fiat currency, between different virtual assets, or that provides custody, transfer or related services to Nigerian persons. SEC Nigeria treats the economic reality of the business – where users are located, where value is settled – as the primary jurisdictional hook, not the place of incorporation. A business incorporated in the BVI or Malta that markets to Nigerian users and processes naira settlements is squarely within scope.
The applicable regime draws a structural line between exchanges that hold client assets and those that do not. Custodial exchanges attract the more demanding set of obligations, including capital adequacy expectations and segregation requirements. Non-custodial platforms face a lighter registration path, though AML/KYC obligations apply to both categories. The regime also addresses token classification: an exchange listing instruments that bear the economic characteristics of securities – rights to profit participation, governance claims, or investment returns – must assess whether those tokens trigger the securities regime in addition to the VASP registration.
SEC Nigeria has, in practice, required exchanges to appoint a local compliance officer, maintain books and records in a recoverable format and submit to periodic supervisory review. These are structural commitments, not administrative formalities. Operators that treat registration as a checkbox exercise – rather than a live compliance programme – have found that the regulator's follow-up examination surfaces gaps quickly.
The cross-border dimension tightens the analysis further. Nigeria operates active foreign-exchange controls administered by the Central Bank of Nigeria (CBN). The interaction between crypto-asset flows and those FX controls is an area of active regulatory attention. An exchange moving value in both directions across the naira/USD corridor must understand both the SEC Nigeria VASP regime and the CBN's position on crypto-related FX flows – these are separate regimes with separate compliance obligations and, critically, separate enforcement channels.
How Does the VASP Registration Process Work in Nigeria?
The VASP registration process under the SEC Nigeria regime requires an applicant to demonstrate regulatory fitness across several dimensions before a registration decision is issued. The process is sequential: a pre-application review, a formal application with a defined document set, a suitability assessment of controllers and senior managers, and a post-registration compliance review.
At the pre-application stage, the regulator expects an operator to have resolved its structural questions: the legal entity, the ownership chain, the AML/KYC programme in draft form and the technology architecture. Arriving at the pre-application meeting with structural gaps – an incomplete beneficial-ownership map, an unresolved question about whether a token constitutes a security – extends the timeline materially. In our cross-border practice, we have seen the pre-application phase consume as much time as the formal review where operators have not prepared the underlying corporate structure in advance.
The formal application requires the incorporation documents of the applicant entity, a comprehensive AML/CFT policy aligned with FATF Recommendation 15 requirements (the FATF standard addressing virtual-asset risk), a technology risk assessment covering the exchange's custody and settlement architecture, a business plan and projected financial statements, and fit-and-proper documentation for each director, controller and ultimate beneficial owner. The completeness of this package determines how quickly the formal review period begins. An incomplete submission is returned; the clock restarts.
Following submission, SEC Nigeria undertakes a substantive review. The timeline for this review is not fixed by public rule to a specific number of business days – the regulator retains discretion based on workload and complexity. Operators we advise plan for a process measured in months, not weeks. Engaging a local compliance officer and a structuring counsel before submission – not after – compresses the back-and-forth with the regulator that otherwise extends the process.
Post-registration, the exchange is subject to ongoing reporting obligations, periodic supervisory review and capital maintenance requirements. A change in beneficial ownership or a material change in business activity generally triggers a notification or re-application obligation. Operators expanding their product set – moving from spot exchange to lending or staking services – should treat each new activity as a potential separate authorisation question.
CTA #1
The registration path described above is the standard route. Your specific facts – the entity's incorporation, your user geography, your product scope and your banking relationships – change the analysis at every stage. For a scoped assessment of your Nigeria entry, contact OBOLUS at Map your options.
How Do Tax and Banking Interact With a Nigerian Crypto Licence?
Banking is the operational choke-point for exchanges in Nigeria, and it should be addressed in parallel with the regulatory application – not after the licence is in hand. Nigerian commercial banks remain cautious about onboarding crypto-exchange customers, partly because of historical CBN guidance restricting financial institutions from servicing entities engaged in crypto transactions. That guidance has evolved, but the institutional caution it generated has not fully dissipated.
For an inbound operator, the banking question typically involves a multi-layer structure. The exchange entity – the regulated VASP – sits in Nigeria. The treasury function, which holds and moves fiat value at scale, may sit in a separate jurisdiction where banking access is more predictable: an ADGM-regulated entity, a Singapore MAS-regulated entity, or an EU-based payment institution with SEPA access, depending on the operator's corridor requirements. This structure must be designed with both the SEC Nigeria regime and the CBN's FX rules in mind; a structure that solves the banking problem by routing around the regulatory perimeter creates a different enforcement exposure.
On taxation, Nigerian exchanges are subject to corporate income tax on profits generated in Nigeria and, where applicable, value-added tax on certain services. The tax treatment of crypto-asset gains, staking income and token issuance proceeds is an area where Nigerian practice is still developing. The Federal Inland Revenue Service has issued guidance on the taxability of digital-asset income, but the application of those principles to specific product types – yield-bearing instruments, native token distributions, structured products – requires case-specific analysis. Operators we advise routinely map the tax exposure before product launch, not retrospectively.
The international tax dimension matters for group structures. Where the Nigerian entity is part of a multi-jurisdiction group – a common structure for operators combining a West African market presence with an EU or UAE licensed entity – the group must address transfer pricing, permanent establishment risk and the potential for double taxation on intra-group service charges. These are not peripheral concerns; regulators in multiple jurisdictions now review group structures as part of the VASP authorisation assessment, and a structure that produces obvious tax arbitrage without commercial substance can draw scrutiny in each hub.
What Should an Inbound Operator Decide Before Applying?
Three structural decisions determine whether a Nigeria entry is viable and how complex the compliance stack will be: the entity architecture, the product scope and the banking plan. Resolving these before the regulatory application begins saves significant time and reduces the risk of a mid-process pivot that restarts the clock.
On entity architecture, the choice is between a Nigerian-incorporated operating entity (the most direct path to full regulatory status), a representative office model with a foreign parent providing regulated services from outside Nigeria (which works only where the product scope genuinely stays offshore), or a branch structure (which imports the parent's regulatory status and may be easier or harder depending on where that parent is licensed). Most inbound exchange operators targeting Nigerian retail and institutional users need the fully incorporated operating entity; the offshore model often does not survive scrutiny when users are Nigerian-resident and payments flow through Nigerian infrastructure.
On product scope, the decision to list tokens that may constitute securities under Nigerian law has significant consequences. The securities characterisation triggers not only the VASP regime but the broader securities authorisation framework, which involves a different application process, different capital expectations and a different supervisory relationship. Operators launching with a limited, carefully curated spot-exchange product are better positioned to obtain registration quickly and expand the product set after the compliance infrastructure is in place.
On banking, operators should identify their correspondent banking partner – not just their local account provider – before submitting the regulatory application. SEC Nigeria and, where relevant, the CBN will want to understand how the exchange manages client money, how fiat settlements are processed and what AML controls apply to the payment layer. A credible banking plan, backed by a term sheet or relationship letter from a willing bank, strengthens the application significantly.
A Cross-Border Exchange Registration: Illustrative Matter
In a recent licensing engagement, a payments company with an existing EU regulatory footprint sought to extend its exchange operations into West Africa, including Nigeria. The entity had a MiCA-path authorisation in progress in an EU member state and assumed that an EU licence would reduce the Nigerian regulatory burden. Our analysis established that SEC Nigeria does not give formal reciprocal recognition to EU CASP authorisations; the Nigerian application had to stand on its own merits. We restructured the entity architecture to separate the Nigerian operating entity from the EU treasury function, mapped the CBN FX obligations relevant to the naira corridor, and coordinated the AML/KYC programme design across both regulatory regimes. The exchange reached substantive readiness for the Nigerian application within a single quarter – faster than the initial projection, because the structural decisions were resolved at the outset rather than during the application review.
How Do AML and the Travel Rule Apply to Nigerian Crypto Exchanges?
AML and Travel Rule compliance are baseline requirements for any registered exchange in Nigeria, not optional enhancements. FATF Recommendation 15 requires Nigeria – as an FATF member through its membership of the Inter-Governmental Action Group against Money Laundering in West Africa (GIABA) – to apply VASP-specific AML/CFT measures, including the Travel Rule obligation to transmit originator and beneficiary information with qualifying virtual-asset transfers.
For a crypto exchange, this means building or procuring a Travel Rule-compliant transfer infrastructure that can communicate with counterpart VASPs, including those outside Nigeria. The practical challenge is significant: many African-corridor transfers involve counterpart VASPs that are not yet Travel Rule-compliant, creating a "sunrise problem" where one side of the transaction meets the standard and the other does not. SEC Nigeria's guidance on how exchanges should handle non-compliant counterparts is an active area of regulatory development; exchanges should have a documented policy for these cases rather than leaving them to ad hoc judgment.
The AML programme itself must address the specific risk profile of the exchange: the geographic concentration of users, the prevalence of peer-to-peer trading, the use of non-custodial wallets on both sides of transactions, and the specific token types listed. An AML programme designed for a European retail exchange may not adequately address the Nigerian risk environment. Regulators we encounter increasingly expect AML programmes that are jurisdictionally calibrated, not copy-pasted from a generic template.
CTA #2
If a prior application stalled, an account was closed or a compliance query from the regulator has gone unanswered, the structural reason is usually identifiable. To identify the gap and map the route forward, write to OBOLUS at Map your options.
What Are the Most Common Mistakes in Nigerian Crypto Exchange Setups?
The most common structural mistake is entering the Nigerian market through a product that is already live rather than configuring the regulatory and compliance architecture before launch. An exchange serving Nigerian users without registration is not in a grey area under current SEC Nigeria policy – it is operating in breach of the applicable VASP provisions. The enforcement consequences range from a formal warning and remediation period to a direction to cease operations, with implications for the group's ability to obtain or maintain licences in other jurisdictions.
A second common mistake is treating the SEC Nigeria registration as a standalone deliverable rather than as part of an integrated regulatory, banking and tax stack. Operators that obtain registration but have not resolved their banking position find that the licence is operationally inert – they cannot move client money, cannot settle trades and cannot manage the FX exposure that a naira-denominated exchange generates. The banking plan must be concurrent with, not subsequent to, the regulatory application.
A third mistake – addressed directly in our objection-handler below – is the assumption that an offshore licence eliminates the need for a Nigerian authorisation.
A common assumption is that a single offshore licence – a BVI VASP registration, a Cayman Islands CIMA licence, or even a MiCA CASP authorisation – is sufficient to serve Nigerian users without local registration. This assumption is incorrect. SEC Nigeria applies an economic-substance test: if the exchange is actively marketing to Nigerian users, pricing in naira, and settling through Nigerian payment infrastructure, the regulator treats the business as operating in Nigeria regardless of where the legal entity sits. The offshore licence addresses the offshore regulator's requirements. It does not satisfy the Nigerian regulatory requirement. Operators acting on this assumption have faced enforcement directions requiring them to either register locally or cease Nigerian operations.
Which Operator Profile Should Apply for a Nigerian Crypto Licence?
Not every business needs a full Nigerian VASP registration at launch, and the right entry structure depends on the operator's profile, product set and risk tolerance.
Profile A – Inbound exchange targeting Nigerian retail users: A business incorporating a Nigerian operating entity, listing spot-trading pairs that include naira-denominated assets, and intending to onboard Nigerian-resident users at scale. This profile requires full VASP registration with SEC Nigeria, a Nigerian-incorporated entity, a resident compliance officer, an AML programme calibrated to the Nigerian risk environment, and a credible banking plan. The timeline is measured in months. The risk of proceeding without registration is enforcement exposure that can affect the group's global licence portfolio.
Profile B – Inbound exchange with institutional focus only: A business offering digital-asset exchange or OTC services exclusively to Nigerian institutional counterparties (banks, licensed financial institutions, large corporates) and with no retail user onboarding. This profile may have a lighter registration path, but it is not outside the regulatory perimeter. The VASP provisions apply based on the nature of the activity, not the counterparty type. Early engagement with SEC Nigeria to confirm the applicable registration category is essential before launch.
Profile C – Group with an existing offshore VASP licence seeking a Nigerian regulatory wrapper: A business that is already licensed in an EU member state (MiCA/CASP), the UAE (VARA), or Singapore (MAS/Payment Services Act) and seeks to extend its operations to Nigeria. This profile benefits from having an established compliance infrastructure but should not assume that the offshore licence reduces the Nigerian application burden significantly. The local authorisation requires a standalone application; the offshore licence provides credibility but not substitution.
In every profile, the decision to enter Nigeria is also a decision to engage with the CBN FX framework, the Federal Inland Revenue Service tax regime and the local AML supervisory infrastructure. These are not sequential decisions; they are simultaneous commitments that must be mapped before the first user is onboarded.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – how we structure VASP applications and licence stacks across jurisdictions
- Crypto Regulation and Licensing in Malta – the MiCA transition and MFSA regime for EU market access
- De-risking and Account Closure Defence in El Salvador – banking-access strategy for operators facing correspondent risk
FAQ
How long does a crypto licence take to obtain?
The timeline for a VASP registration or crypto-asset licence varies by jurisdiction and is not fixed to a single number. In Nigeria, the SEC Nigeria process is measured in months from a complete submission; the pre-application preparation phase adds time where structural questions are unresolved. In leading hubs such as the UAE, Singapore and the EU, timelines similarly vary by application complexity, regulatory workload and the completeness of the initial submission. Engaging counsel before – not during – the application reliably shortens the process.
Which jurisdiction is best for licensing my crypto business?
There is no single best jurisdiction. The right licence structure depends on your user geography, product scope, banking requirements and group structure. A business targeting African users may need a Nigerian authorisation and an offshore treasury hub. A business targeting EU users needs a MiCA CASP. A business serving institutional counterparties globally may prioritise ADGM, Singapore or the Cayman Islands. Most serious operators maintain licences in more than one jurisdiction. We map the full stack – operating, custody, payment and treasury – before recommending an entry structure.
Do I need a separate custody licence?
In most leading jurisdictions, custody of digital assets on behalf of third parties is a regulated activity that requires either a standalone custody authorisation or a combined exchange-and-custody licence. Under the SEC Nigeria regime, custodial exchanges attract additional requirements compared with non-custodial platforms. Under MiCA, custody is a separately defined CASP service. Under VARA in Dubai and under the MAS Payment Services Act in Singapore, custody carries its own authorisation category. Whether you need a separate custody licence – or a combined authorisation – depends on how your product actually holds and controls client assets. We conduct that analysis as part of the initial scope review.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the entirety of our practice – we act only for businesses, and we have no conflicts with retail interests. We map the licence, banking and tax stack across operating, custody and payment layers before you commit, so that the structure holds under regulatory scrutiny from day one. To discuss your Nigeria entry or a multi-jurisdiction licensing question, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in inbound VASP registration and cross-border licence structuring for exchange and custody operators across African and Gulf markets.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.