Operating a payments business in Nigeria without the correct regulatory authorisation is not a grey area. The Central Bank of Nigeria actively enforces its licensing regime for payment service providers, and a single misstep – an unsigned acquiring agreement, a mismatch between your licence category and the services you actually deliver – can result in suspended settlement rails, frozen merchant accounts and a formal enforcement notice. For a digital-asset or fintech business scaling into West Africa, the stakes are concrete and immediate.
A payment service provider (PSP) in Nigeria is any entity that facilitates the initiation, processing or settlement of electronic payment transactions on behalf of merchants or end-users. The Central Bank of Nigeria (CBN) is the primary regulator for payment services, operating under the Nigeria Payment System Management Act and its associated frameworks. An acquiring agreement is the contract under which an acquirer – a licensed settlement institution – agrees to process card and electronic payment transactions for a merchant, taking on the liability and settlement obligations that flow from those transactions. For any business entering Nigeria from outside, the question is not whether these rules apply to you; it is which layer of the licensing stack you sit on.
This page maps the CBN licensing regime for PSPs and acquiring arrangements, the specific obligations that attach to cross-border digital-asset businesses operating in Nigeria, the practical process for establishing compliant fiat rails, and the decision points that determine whether an inbound business needs a direct licence, a local partnership or a hybrid structure.
What does the CBN licensing regime require from a PSP?
The CBN's licensing regime for payment service providers is activity-based: the licence category you hold determines the services you may lawfully provide, and holding one category does not automatically permit adjacent activities. The principal licence categories under the CBN payments framework include the Payment Solution Service Provider (PSSP), the Payment Terminal Service Provider (PTSP), the Super-Agent, the Mobile Money Operator (MMO) and the Switching and Processing licence. Each category has distinct minimum capital requirements, operational rules and reporting obligations – and under the applicable CBN provisions, operating a licensable service without authorisation attracts both civil and criminal exposure.
For a business primarily interested in acquiring – that is, in settling electronic transactions for merchants – the relevant path runs through an institution that holds either a Switching and Processing licence or a dedicated acquiring authorisation. An inbound PSP that wishes to process Nigerian naira transactions for its merchants must either obtain its own CBN authorisation or structure its service through a locally licensed acquiring partner under a formally documented acquiring agreement.
The acquiring agreement itself is not merely a commercial contract. Under CBN expectations, it must address settlement timelines, chargeback liability allocation, merchant due-diligence obligations, data localisation requirements and the pass-through of AML/KYC obligations to the merchant. A poorly drafted agreement can render the arrangement non-compliant even where the principal licence is in good standing.
How does Nigeria treat crypto and digital-asset payments?
Nigeria's position on cryptocurrency has shifted materially in recent years. The CBN's earlier blanket restriction on banks facilitating crypto-related transactions was substantially revised, and the Securities and Exchange Commission of Nigeria (SEC Nigeria) has moved to assert jurisdiction over digital assets as securities or investment instruments under the applicable Investments and Securities Act provisions. SEC Nigeria introduced a framework for Digital Assets Offering Platforms (DAOPs) and Virtual Asset Service Providers (VASPs), bringing exchanges, custodians and token issuers within a formal registration and compliance perimeter.
For a business that combines digital-asset services with fiat payment processing – for example, an exchange that needs to accept naira deposits and disburse naira withdrawals – the regulatory picture involves both the CBN payment framework and SEC Nigeria's VASP provisions. These are not the same regulator, and their requirements do not entirely overlap. A business that registers only with SEC Nigeria as a VASP but does not address its acquiring and settlement obligations under the CBN regime is exposed on the payments side. The reverse is equally true.
Nigeria's FATF status and its domestic anti-money-laundering framework also bear directly on this. The Travel Rule – the obligation to pass originator and beneficiary data with a virtual-asset transfer – applies under the relevant FATF Recommendation 15 provisions that Nigeria has incorporated. Any VASP onboarding with a Nigerian PSP or acquiring institution will face AML/CFT due-diligence requirements calibrated to those FATF standards, and the acquiring institution will apply enhanced scrutiny to any merchant whose business model involves crypto-to-fiat conversion.
To scope your Nigerian licensing and acquiring obligations across both the CBN and SEC Nigeria frameworks, contact OBOLUS at Map your options. The process above describes the standard path. Your facts – the entity structure, the user base, the transaction flows – change the analysis materially, and an early assessment prevents costly re-work later.
What is the process for an inbound business entering the Nigerian payment market?
An inbound business seeking to offer payment services in Nigeria should approach the market in distinct sequential steps, each of which has legal and operational consequences for the next. The first step is a structured analysis of the services actually being delivered: what constitutes the payment initiation, what constitutes the settlement, and who bears the liability at each stage. That analysis determines which CBN licence category is required and whether a direct application or a licensed-partner model is appropriate.
Where a direct licence application is pursued, the CBN process involves pre-application engagement, submission of a detailed business plan and compliance framework, evidence of minimum capital, fit-and-proper assessments of key personnel and an in-principle approval before operational authorisation is granted. The timeline from a complete submission to operational authorisation typically spans several months; the CBN publishes indicative processing windows, but in practice the process depends heavily on the completeness of the initial submission and the responsiveness of the applicant to queries. Businesses that submit incomplete documentation or that cannot demonstrate a credible Nigerian operational presence consistently experience delays.
Where the business model relies on a licensed local acquirer rather than a direct CBN licence, the negotiation and execution of the acquiring agreement becomes the critical legal instrument. That agreement must be structured to pass the CBN's settlement and AML obligations downstream to the merchant or upstream to the foreign principal, must address chargeback and fraud liability clearly, and must include the data localisation provisions that the CBN increasingly expects. In our practice, the acquiring agreement is often the document that receives the least attention in the early stages of market entry and the most attention after an enforcement query is received.
A practical note on timing: Nigeria's foreign-exchange regime and the CBN's ongoing management of naira liquidity mean that settlement timelines for cross-border businesses can be materially longer than domestic-only transactions. The acquiring agreement should address FX conversion triggers, settlement currency, and the treatment of disputed transactions in an environment where exchange rate movements between transaction date and settlement date can be significant.
How do tax and banking interact for cross-border PSP structures in Nigeria?
Cross-border payment businesses operating in Nigeria face a layered interaction between the CBN payment regime, the Federal Inland Revenue Service (FIRS) tax framework and the practical constraints of correspondent banking. Getting one layer right and ignoring the others is a reliable path to disruption.
On the tax side, a foreign PSP that has a sufficient nexus to Nigeria – through a local subsidiary, a permanent establishment or a significant economic presence – may be subject to Nigerian corporate income tax and value-added tax on its Nigerian-source revenues. The FIRS has moved in recent years to assert wider jurisdiction over digital-services businesses, and a payment business that processes material Nigerian transaction volumes without a Nigerian entity may still face tax exposure under the applicable deemed-PE provisions. The interaction between Nigerian tax obligations and the home-jurisdiction tax position of the foreign parent requires specific structuring attention before operations commence.
On the banking side, the challenge for digital-asset and crypto-adjacent businesses is acute. Nigerian commercial banks remain cautious about onboarding businesses whose primary activity involves virtual assets, even where both the CBN and SEC Nigeria have moved to provide regulatory clarity. De-risking – the process by which a bank exits or declines a client relationship on risk grounds without a formal enforcement finding – is a live issue in Nigeria as it is in most major financial centres. A VASP seeking to establish naira settlement rails will face enhanced due diligence, including requests for granular transaction-monitoring data, beneficial-ownership documentation and evidence of the regulatory status of any overseas counterparties.
In a recent cross-border matter, a digital payments company expanding into West Africa had structured its Nigerian operation through a foreign holding entity without a local acquiring agreement. Following a CBN query, settlement was suspended for a period of several weeks. We assisted the business in restructuring its acquiring arrangement through a locally licensed institution, addressing the CBN's data and AML concerns and establishing a clear contractual chain between the foreign principal and the Nigerian acquirer. The rails were restored, and the business subsequently obtained in-principle confirmation of its compliance posture from the relevant CBN division.
Which businesses in Nigeria need a CBN licence, and which can rely on a licensed partner?
Whether an inbound business needs its own CBN authorisation or can operate through a locally licensed acquirer or PSSP depends on the substance of what it does in Nigeria – not on how it describes its business model internally. The CBN applies a substance-over-form approach, and the test is whether the activity being performed falls within a licensable category under the payment system framework.
A business that holds itself out to Nigerian merchants as a payment processor, that directly contracts with those merchants, and that controls the settlement flow is likely performing a licensed activity regardless of where its servers are located or where its holding company is incorporated. By contrast, a foreign business that acts purely as a technology layer – passing transactions to a locally licensed processor that holds the merchant contracts and settlement obligations – may not itself require a CBN licence, provided the structure is genuinely documented and operationally consistent.
The decision matrix for an inbound operator breaks down along the following lines:
Profile A – Full-service PSP seeking direct Nigerian market presence: Direct CBN licence application is the appropriate path. The business will need a Nigerian incorporated entity, demonstrated minimum capital, a locally based compliance officer and a full AML/CFT framework. The timeline to operational authorisation is typically measured in months, and the compliance infrastructure cost is material. The risk of not licensing directly is enforcement exposure and merchant loss.
Profile B – Foreign digital-asset exchange adding naira fiat rails: A partnership with a CBN-licensed acquiring institution is usually the faster path. The business needs a formally documented acquiring agreement, SEC Nigeria VASP registration for its crypto-facing activities, and a banking relationship that tolerates the crypto-to-fiat conversion flow. The timeline to operational rails is shorter than a direct CBN application, but the business remains dependent on its Nigerian partner's continued licence standing.
Profile C – E-money or EMI institution seeking Nigerian correspondent access: The business should address both the CBN correspondent requirements and its home-jurisdiction regulatory posture. An EMI (electronic money institution) authorised under, say, a European MiCA or an FCA regime does not automatically have permission to issue electronic money to Nigerian users or to settle in naira. A local-partner structure combined with a clear contractual allocation of regulatory responsibility is the standard solution in our cross-border practice.
What AML and Travel Rule obligations apply to Nigerian PSPs handling virtual assets?
Nigeria has incorporated FATF Recommendation 15 into its domestic AML/CFT framework, meaning that VASPs and financial institutions handling virtual-asset transfers are subject to the Travel Rule – the obligation to collect, verify and transmit originator and beneficiary data with each qualifying transfer. The applicable Nigerian provisions are administered through the Special Control Unit Against Money Laundering (SCUML) and the Nigerian Financial Intelligence Unit (NFIU), with oversight responsibilities that extend to both PSPs and VASPs operating in the jurisdiction.
For a business that is both a VASP and a payment processor – an exchange that also processes naira transactions for merchants, for example – the AML obligations attach at both layers. The VASP layer requires Travel Rule compliance for virtual-asset transfers above the relevant threshold. The PSP layer requires transaction monitoring, suspicious-transaction reporting and merchant due-diligence consistent with the CBN's AML framework. A business that has addressed only one layer is non-compliant at the other.
The data threshold at which Travel Rule obligations apply to virtual-asset transfers in Nigeria has been subject to regulatory development. Businesses should consult current NFIU and CBN guidance for the operative figure rather than relying on a static published number, as the applicable threshold has tracked FATF's iterative updates. What is constant is the obligation itself: cross-border virtual-asset transfers require the originator's name, account identifier and address, and the beneficiary's name and account identifier, to travel with the transaction.
Practically, the Travel Rule creates a direct operational requirement for any Nigerian PSP handling crypto-to-fiat conversion. The acquiring agreement must address how Travel Rule data is passed between the VASP and the acquiring institution, and the acquiring institution's own AML framework must be capable of processing and storing that data in a format consistent with CBN and NFIU expectations.
If your Nigerian operation spans VASP activity and payment processing, a dual-compliance gap analysis is the right starting point. Reach OBOLUS at Map your options. If a prior application stalled or a banking relationship was declined, a second read of your structure often surfaces the specific gap driving the outcome.
What are the most common mistakes businesses make when entering Nigeria's payment market?
The most consequential mistake is treating the acquiring agreement as a standard commercial contract rather than a regulatory instrument. A poorly drafted acquiring agreement that fails to address CBN settlement expectations, chargeback liability in naira, data localisation and AML pass-through obligations can leave the foreign principal exposed to CBN enforcement even where the Nigerian acquirer holds a valid licence.
A common structural error is establishing the Nigerian operation through a foreign holding entity that does not itself hold a CBN authorisation, on the assumption that the locally licensed acquirer's authorisation covers the entire arrangement. The CBN has been clear that where a foreign entity is performing licensable activities – holding itself out to merchants, controlling settlement flows, setting pricing – that entity may itself require authorisation regardless of its contractual relationship with a locally licensed partner.
A persistent commercial myth is that a single offshore payment or EMI licence is sufficient to serve Nigerian users and merchants without additional local authorisation. That assumption is incorrect. The CBN asserts jurisdiction over the activity, not merely over the entity, and a foreign PSP processing Nigerian naira transactions for Nigerian merchants is within the CBN's supervisory reach regardless of where the PSP is licensed. OBOLUS regularly advises businesses that have built their Nigerian revenue line on this assumption and are subsequently managing the compliance consequences.
On the banking side, the mistake is attempting to open Nigerian naira settlement accounts before the legal structure is in place. Nigerian banks conduct their own due diligence on prospective PSP clients, and a foreign business approaching a Nigerian bank without documented CBN authorisation or a signed acquiring agreement with a licensed local partner will find the onboarding process either refused or indefinitely delayed. The legal structure must precede the banking conversation, not follow it.
A common assumption is that Nigeria's crypto rules make PSP onboarding impossible
A common assumption among inbound businesses is that Nigeria's historically restrictive stance on cryptocurrency makes it impossible for a crypto-adjacent PSP to obtain compliant fiat rails. That assumption is no longer accurate, and acting on it causes businesses to exit or delay entry into a significant market unnecessarily.
The CBN's revised position and SEC Nigeria's published VASP framework together create a defined – if demanding – pathway for compliant operation. The pathway requires a VASP registration with SEC Nigeria, a CBN-compliant acquiring arrangement or direct licence, a documented AML/CFT framework that satisfies both regulators, and a banking relationship with an institution that has the risk appetite and the compliance infrastructure to service a crypto-to-fiat conversion business. None of these elements is impossible to obtain. All of them require advance legal structuring rather than reactive compliance.
The businesses that successfully establish Nigerian fiat rails for digital-asset operations are not those with the simplest business models – they are those that addressed the regulatory structure before they committed commercial resources to the market. In our cross-border practice, the businesses that encounter the most disruption are those that launched operationally and then sought to regularise their position after the fact.
Related at OBOLUS
- Banking, Payments and EMI Onboarding for Digital-Asset Businesses – how OBOLUS structures the full banking and payment layer for crypto operators
- De-risking and Account Closure Defence – managing the compliance burden when a bank exits or declines your business
- Redemption and Liquidity Terms in Switzerland – FINMA's expectations for stablecoin and token redemption obligations
FAQ
Why do banks close crypto company accounts?
Banks close crypto company accounts primarily through de-risking – a risk-management decision to exit a client relationship rather than manage the perceived compliance exposure it presents. The most common triggers are insufficient AML documentation, an inability to explain the source of funds at a transaction level, regulatory uncertainty about the client's licence status in the relevant jurisdiction, and pressure from the bank's own correspondent banking relationships. Addressing these issues requires proactive compliance documentation before the banking relationship is opened, not after a closure notice is received.
How can a VASP onboard with an EMI?
A VASP seeking to onboard with an EMI (electronic money institution) must typically demonstrate a valid regulatory authorisation or registration in its home jurisdiction, a documented AML/CFT framework that meets the EMI's compliance standards, clear beneficial-ownership disclosure, and a business model that the EMI's risk function can map to a defined transaction profile. In practice, the VASP's Travel Rule compliance posture – including its ability to pass originator and beneficiary data on transfers – is often the deciding factor, alongside evidence of adequate transaction monitoring. Early legal structuring of the compliance package significantly improves onboarding success rates.
What does client-money safeguarding require?
Client-money safeguarding requires a regulated payment or e-money business to hold client funds in a segregated account at an authorised credit institution, separate from the firm's own operational funds, so that client balances are protected in an insolvency event. The specific requirements – the eligible institution types, the frequency of reconciliation, and whether pooling or individual segregation is required – vary by jurisdiction and licence category. Under most leading payment regimes, including those applicable to EMIs operating within the MiCA environment, safeguarding compliance is a condition of continued authorisation rather than a best-practice expectation.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before you commit, and we structure licensing, banking and tax as one mandate rather than three disconnected workstreams. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Victor Olsen, Regulatory & Compliance Analyst – specialising in CBN and cross-border PSP licensing frameworks for digital-asset and fintech businesses entering African and emerging-market jurisdictions.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.