Operating a virtual asset service in Nigeria without proper authorisation exposes a business to enforcement action, suspended payment rails and the near-immediate loss of banking relationships. The Securities and Exchange Commission of Nigeria – known as the SEC Nigeria – now requires any entity dealing in digital assets as a principal business activity to obtain a Virtual Asset Service Provider (VASP) licence or registration under the regulatory authorisation regime that took formal shape following the Investments and Securities Act framework and SEC Nigeria's 2022 and 2024 rule releases. This page sets out what the licence requires, how the process runs for an inbound business, where the cross-border complications arise and what a business should resolve before it files.
What is the regulated perimeter for VASPs in Nigeria?
SEC Nigeria regulates virtual asset service providers under its digital-asset rules, covering exchanges, brokers, custodians, token issuers and investment fund managers operating in or from Nigeria. Any business that buys or sells digital assets on behalf of clients, operates a trading platform, provides custody, facilitates transfers or manages a digital-asset fund falls within the perimeter. The Central Bank of Nigeria – the CBN – retains parallel authority over payment-system dimensions of crypto activity, including fiat on- and off-ramp processing through licensed payment service providers.
The SEC Nigeria framework distinguishes between several operator categories: a Digital Asset Exchange (DAE), a Digital Asset Custodian (DAC) and a Digital Asset Offering Platform (DAOP), among others. Each category carries distinct capital, governance and operational requirements. An exchange running its own custody arm must satisfy both the DAE and DAC standards simultaneously – a structural point that affects corporate design from day one.
The CBN's earlier blanket prohibition on crypto-related banking, issued in 2021, was substantially revised by mid-2023 as the CBN published guidance permitting banks to open accounts for SEC-registered VASPs operating within a defined compliance envelope. That shift restored the banking-crypto interface in principle, although in practice banking access for VASPs remains subject to individual bank risk appetite. The interaction between SEC Nigeria registration and CBN-regulated banking access is therefore a critical path dependency for any inbound operator.
Nigeria joined the FATF regional body – the Inter-Governmental Action Group against Money Laundering in West Africa (GIABA) – and its AML/CFT framework is aligned to FATF Recommendation 15 on virtual assets, including Travel Rule obligations for qualifying transfers.The mid-page checkpoint for new entrants: if your entity is incorporated outside Nigeria but intends to onboard Nigerian residents, SEC Nigeria's rules look to the location of the client, not just the entity. A purely offshore structure does not eliminate the Nigerian regulatory footprint if Nigerian users are served directly.
For a scoped assessment of your Nigerian regulatory exposure, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity structure, the user base, the fiat-ramp arrangements – change the analysis materially. Map your options
Which VASP licence category applies to my business?
The correct category determines your capital requirement, your compliance obligations and the feasibility of your banking and custody arrangements, so the classification decision is the first substantive step – not an administrative formality.
The core categories under the SEC Nigeria digital-asset rules are as follows. A Digital Asset Exchange runs a trading platform matching buy and sell orders in digital assets. A Digital Asset Custodian holds or controls digital assets on behalf of clients, whether in hot or cold storage. A Digital Asset Offering Platform facilitates the issuance and distribution of digital tokens to investors in Nigeria. A Digital Asset Fund Manager manages portfolios of digital assets on a discretionary basis. The rules also contemplate robo-adviser and broker-dealer variants.
Most inbound operators fall into the exchange or custodian category – or both. Where both apply, the business must meet the capital and governance standards for each category. Attempting to provide exchange services under a custodian authorisation alone is a common structural error we see in early-stage applications. The regulatory consequence is material: it brings the activity outside the licensed perimeter and triggers the same enforcement exposure as operating without any licence.
Token issuers intending to distribute to Nigerian retail or professional investors must also map their instrument against the definition of a digital asset (as opposed to a security token, which activates the full securities regime under the Investments and Securities Act). The label on a token is not determinative. SEC Nigeria applies a substance-over-form test looking at the rights conferred, the economic return expectation and the degree of reliance on a promoter's efforts – principles consistent with the broader FATF and international regulatory approach.
How does the VASP licence application process work in Nigeria?
The SEC Nigeria application process for VASP authorisation runs in distinct phases: pre-application assessment, formal submission, regulatory review, conditional approval and final registration. Each phase has practical dependencies that can add weeks to the overall timeline if not managed in advance.
The pre-application phase requires the operator to prepare its corporate structure, resolve beneficial ownership disclosures and satisfy itself that its key personnel meet the fit-and-proper requirements SEC Nigeria applies to directors, senior management and compliance officers. SEC Nigeria expects the compliance officer and the money-laundering reporting officer to be named individuals, resident or at minimum reachable in Nigeria, with documented AML/CFT training and experience.
The formal submission bundle covers the incorporation documents, the business plan, the AML/CFT programme, the technology architecture overview (including cybersecurity and wallet-control documentation), the capital evidence, the tariff schedule and the draft client-facing terms. SEC Nigeria's digital-asset team reviews the bundle and may issue queries; response time to queries is a pace-setter for the overall timeline. Operators that submit incomplete or inconsistently structured bundles routinely face multiple query rounds, extending the process considerably.
Following review, SEC Nigeria issues a conditional approval letter setting out remaining conditions – typically including a capital deposit confirmation, a site inspection or technology audit, and sign-off on the compliance manual. Only after conditions are cleared does the final VASP registration certificate issue. Total elapsed time from submission of a complete, well-structured bundle to final registration varies: SEC Nigeria has in recent cycles processed well-prepared applications within a matter of months, though complex or novel structures take longer. Applicants should plan for the process to run for several months and build that into their go-to-market timeline.
In our cross-border licensing practice, we prepare the complete submission bundle in parallel with the corporate structuring work, so that the filing-ready version reaches SEC Nigeria without the delays that come from sequential preparation. We regularly advise operators that the pre-submission phase – getting the AML programme, the governance documents and the technology disclosures right – is where the application is won or lost.
What AML and Travel Rule obligations apply to Nigerian VASPs?
Nigerian VASPs must implement a full AML/CFT programme aligned to FATF Recommendation 15, including customer due diligence, enhanced due diligence for high-risk counterparties, transaction monitoring and suspicious-transaction reporting to the Nigerian Financial Intelligence Unit (NFIU). The Travel Rule – the obligation to pass originator and beneficiary data with a qualifying virtual-asset transfer – applies to transfers meeting the applicable threshold under Nigerian regulations. The specific de-minimis threshold is subject to revision; applicants should confirm the current figure in the applicable SEC Nigeria and CBN issuances at the time of filing.
SEC Nigeria expects VASPs to implement a Travel Rule solution capable of exchanging IVMS 101-formatted data with counterpart VASPs. For an inbound operator whose counterpart pool is international, this raises an interoperability question: the Nigerian counterpart must use a Travel Rule protocol (TRP) or equivalent solution that your international correspondents also support. We have seen applications delayed because the operator had not resolved Travel Rule vendor selection before submission.
The NFIU requires VASPs to file suspicious-transaction reports independently of any SEC Nigeria obligation. The two reporting lines are concurrent, not alternative. VASPs must also maintain transaction records for a minimum period set by the applicable Nigerian law – operators should verify the current retention period in the relevant issuances rather than relying on a figure from any summary source.
GIABA periodically conducts mutual evaluation reviews of Nigeria's AML/CFT framework. A poor national AML rating can affect the international banking relationships of Nigerian-licensed VASPs, because correspondent banks apply jurisdiction-level risk overlays. Operators we advise factor GIABA review cycles into their banking-access strategy from the outset.
How do banking and tax interact for a Nigerian-licensed VASP?
Banking access is the single most consequential operational dependency for a Nigerian VASP – and the one that most inbound operators underestimate. Following the CBN's 2023 revised guidance, Nigerian commercial banks may open and maintain accounts for SEC-registered VASPs. However, individual banks apply their own risk-appetite policies. Some tier-one Nigerian banks remain cautious; others have developed dedicated VASP account frameworks. The practical result is that a business should begin banking conversations in parallel with, not after, the licence application.
The cross-border complication arises because most exchanges require international correspondent banking for USD, EUR or GBP settlement. A Nigerian entity's correspondent relationships depend on (a) the Nigerian bank's own correspondent agreements, (b) the foreign correspondent's VASP-sector policy and (c) the FATF risk rating attributed to Nigeria. Operators that run the Nigerian entity as a standalone structure without a complementary licensed entity in a higher-rated jurisdiction – such as an EU-passportable CASP or a MAS-licensed digital payment token service provider – often find the international fiat-rail options constrained.
On the tax side, Nigeria taxes business profits under its Companies Income Tax regime. The tax treatment of digital-asset transactions – whether gains are income or capital, how staking rewards are characterised, whether VAT applies to crypto-brokerage services – is an area where the applicable rules are still developing. The Federal Inland Revenue Service (FIRS) has signalled an intent to clarify the treatment of digital assets, but operators should not assume the current position is stable. We advise building a documented tax-position file from the outset, updated as guidance issues.
For operators considering a dual-jurisdiction structure – a Nigerian operating entity paired with an offshore holding or licensing entity – the transfer-pricing and permanent-establishment analysis is non-trivial. The pairing most commonly seen in our practice places the Nigerian entity (serving Nigerian users) alongside a VARA-licensed entity in Dubai or a CASP in a MiCA-compliant EU jurisdiction, capturing the international user base under the higher-rated licence while keeping the Nigerian market under SEC Nigeria authorisation.
If a prior application stalled or a bank account was closed, a fresh structural review can surface the root cause and the path forward. Write to info@oboluslaw.com or map your options here.
A recent VASP structuring matter
In a recent licensing matter, an exchange operator with an existing user base across West Africa sought to formalise its Nigerian position ahead of a Series A raise. The operator had been processing Nigerian users through an offshore entity for several years. We conducted a regulatory gap analysis across the Nigerian, Caymanian and EU dimensions of the structure, identified that the Nigerian user-facing activity fell squarely within SEC Nigeria's VASP perimeter, and rebuilt the corporate and compliance architecture to support a clean SEC Nigeria submission. The application was filed with a complete AML programme, fit-and-proper packages for all named officers and a Travel Rule vendor integration in place. The operator secured its provisional SEC Nigeria registration in the same funding cycle, removing the principal regulatory risk flag from the investor due-diligence process.
Which operator profile should file in Nigeria – and which should reconsider?
The decision to pursue a Nigerian VASP licence turns on three variables: the size and nature of the Nigerian user base, the operator's banking-access strategy and the overall multi-jurisdiction licence stack.
Profile A – Nigeria-first operator. A business whose primary market is Nigeria, with a product denominated in naira and a user base concentrated in Lagos or other Nigerian cities. This operator must file. The regulatory and reputational risk of serving the core market without SEC Nigeria authorisation is too high to manage commercially. The timeline and cost of authorisation are justified by the market access it secures. Indicative path: SEC Nigeria VASP registration, CBN-compatible payment-service arrangement, NFIU AML reporting. Key risk: banking access timeline may exceed the licence timeline.
Profile B – International operator adding Nigeria. A VARA-licensed Dubai exchange or a MAS-licensed payment service provider looking to add Nigerian users to an existing global user base. This operator should assess whether the Nigerian user volume justifies a standalone SEC Nigeria entity, or whether a referral or white-label arrangement with an existing SEC Nigeria registrant is the more efficient path. Operating cross-border into Nigeria from an offshore licence without SEC Nigeria registration is the structural risk most commonly identified in regulatory reviews. Key risk: the offshore-only structure fails the substance-over-form test.
Profile C – Early-stage token issuer. A startup planning a token distribution to Nigerian investors. This operator must determine whether the instrument is a digital asset, a security token or an e-money equivalent under Nigerian law before choosing the applicable authorisation track. Filing under the wrong category – typically as a DAOP when the instrument is actually a security – is a frequently observed mistake and one that can require a costly corporate restructure later. Key risk: misclassification of the token type.
Is a single offshore licence sufficient to serve Nigerian clients?
A common assumption among operators new to African markets is that a licence in a well-recognised jurisdiction – say, a VARA authorisation in Dubai or an MFSA-supervised entity in Malta – provides sufficient cover to serve clients globally, including in Nigeria. That assumption is incorrect as a matter of Nigerian law and SEC Nigeria policy.
SEC Nigeria applies the client-location principle: if the user is in Nigeria, the service is subject to Nigerian regulatory requirements regardless of where the service provider is incorporated or licensed. An offshore licence does not substitute for SEC Nigeria authorisation. It may, however, complement it: a dual-structure approach – offshore holding company with an international licence, Nigerian operating subsidiary with SEC Nigeria registration – is the configuration that satisfies both the international banking requirement and the Nigerian regulatory requirement simultaneously.
The practical consequence of relying solely on an offshore licence is enforcement exposure in Nigeria, including potential cease-and-desist action, financial penalties and reputational damage with Nigerian banking counterparties. For an operator preparing a fundraising round, undisclosed Nigerian regulatory exposure is a deal-critical risk. We map the full licence stack – operating layer, custody layer and payment layer – before a client commits to a structure, precisely to surface these dependencies early.
Related at OBOLUS
- Licensing and registration for digital-asset businesses – end-to-end VASP licence strategy across 70+ jurisdictions
- Crypto exchange setup under EU MiCA – CASP authorisation, passporting and the EU regulatory regime
- PSP and acquiring agreements for institutional clients – payment-service structuring alongside a VASP licence
FAQ
How long does a crypto licence take to obtain?
Timeline varies by jurisdiction and operator complexity. In Nigeria, a well-prepared SEC Nigeria VASP application – with a complete AML programme, fit-and-proper documentation and capital evidence in place at filing – has been processed in a matter of months in recent cycles. Complex structures, incomplete submissions or query-round delays can extend the process substantially. Operators should plan for several months and align their go-to-market and fundraising timelines accordingly.
Which jurisdiction is best for licensing my crypto business?
There is no single best jurisdiction; the right answer turns on your user base, your product, your banking requirements and your investor base. A Nigeria-first operator must hold SEC Nigeria authorisation. An operator serving multiple markets typically needs a primary licence in a flagship hub – Dubai, Singapore, an EU member state – plus local registrations where client concentration creates a regulatory footprint. We map that stack as a first-step analysis, before any filing decision is made.
Do I need a separate custody licence?
Under the SEC Nigeria digital-asset rules, custody is a separately defined regulated activity. An exchange that also holds client assets in its own wallets must satisfy both the Digital Asset Exchange and Digital Asset Custodian requirements. Operating custody under the exchange authorisation alone is not compliant. Operators building a vertically integrated platform should structure for both categories from the outset, as retrofitting the compliance and capital framework after initial registration is operationally disruptive.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance obligations that sit around them. We map the licence stack across operating, custody and payment layers before a client commits to a structure. Digital assets are the whole of our practice. To discuss your Nigerian licensing position or your multi-jurisdiction stack, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in VASP authorisation processes and inbound licensing strategy for exchanges and custodians across African and Middle Eastern markets.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.