A Nigerian company operates the main interface to a protocol that lends cryptoassets against cryptoasset collateral. In this hypothetical composite, the company selects assets, controls fees, holds an emergency multisignature key, can pause markets and receives protocol revenue. Smart contracts calculate loan-to-value limits and liquidate collateral. The proposed expansion raises a specific question: which activities can reach EU borrowers, which need an authorised provider, and which must await a Member State decision on lending and enforcement? The answer distinguishes direct use of immutable contracts, the controlled interface and a managed pool. It treats retail borrowers separately from professional participants.
Executive Summary
- The controlled interface should not launch transactions across the EU in its present form. Management powers, marketing and revenue participation undermine reliance on MiCA's recital concerning fully decentralised services without an intermediary. A regulated service must still be identified; operational control alone does not create a new lending authorisation category. (Regulation (EU) 2023/1114, recital 22 and Article 3(1)(15)–(26).)
- Crypto lending and borrowing are not themselves defined MiCA services. Custody, transfers, exchange, execution and other listed services performed around a loan can require authorisation. Credit, deposit-taking and contract questions remain under other applicable law. A MiCA passport covers the authorised cryptoasset services, rather than every activity within the product. (MiCA, recital 94 and Articles 59–65.)
- A genuinely informational interface can remain available without performing a MiCA service. It must not handle assets, transmit relevant orders, personalise recommendations or operate transactions under an informational label. Direct interaction with immutable contracts gives no assurance that a user's claim is enforceable against an identifiable person. (MiCA, recital 22 and Article 3(1)(16)–(26).)
- The preferred live pilot replaces the revenue-sharing interface model with a bank-operated service for professional legal persons. One EU credit institution lends its own pre-acquired euro e-money tokens against segregated native ETH collateral. The bank performs the relevant custody, transfer, payment and liquidation steps under its actual permissions. The Nigerian company supplies software without EU operational keys or transaction-linked remuneration. (MiCA, Articles 60(1), 70, 73 and 75.)
- Each launch country needs a separate legal release decision before access opens. The decision must cover the lender's permissions, the precise token obligation, collateral rights, marketing and enforcement. Germany and France provide separate screening dossiers, not approved launch destinations or an arbitrary choice of lead country. (Kreditwesengesetz, §§ 1(1), 32(1); Code monétaire et financier, Articles L. 313-1 and L. 511-5.)
- Retail access should remain closed during the pilot. Automated liquidation does not replace creditworthiness duties where consumer-credit law applies. The November 2026 consumer-credit transition requires a separate implementation check. Professional status also leaves MiCA and national credit restrictions in place. (Directive 2008/48/EC, Articles 2, 3 and 8; Directive (EU) 2023/2225, Articles 47–48; MiCA, Articles 59 and 66.)
- Nigerian operations require their own classification and permissions. The SEC's statutory reach includes virtual-asset operators, custodians and securities business. A software exemption cannot be assumed while the company controls assets or operates the service. Incubation admission, a group affiliate's registration and an EU permission each have different legal effects. (Investments and Securities Act 2025, sections 3(3), 61 and 357.)
- The 2026 MiCA review is not an enacted DeFi lending licence. Existing duties, supervisory interpretations and proposals must remain separate in product decisions. ESMA's June 2026 lending answer already addresses client consent and lending revenues under existing MiCA obligations. Its September proposals address possible future changes. (ESMA_QA_2883, 18 June 2026; ESMA75-113276571-1721, sections 3 and 7.2.)
Control and the decentralisation recital
The Nigerian company is an identifiable operational intermediary on the stated facts. It chooses the assets users can access, benefits from activity and can intervene in market operation. Its emergency key and pause power contradict a claim that the service operates entirely without an intermediary. Publishing the contracts as open source does not remove those powers. (MiCA, recital 22.)
Recital 22 concerns services provided in a fully decentralised manner without an intermediary. It also addresses activities that are only partly decentralised. That interpretive distinction requires a functional inquiry into the person supplying each service. The regulator must then connect that person's conduct to a defined activity under Article 3. Neither the word "DeFi" nor the existence of a management key determines the entire classification. (MiCA, recital 22 and Article 3(1)(15)–(26).)
A pause-only key does not necessarily permit its holder to move assets or obtain their means of access. It is therefore evidence of management without being conclusive evidence of custody. A key that can upgrade withdrawal logic, replace a recipient or authorise collateral release presents a stronger custody case. Signer thresholds, replacement rights and collusion arrangements matter more than the label attached to the wallet. (MiCA, Article 3(1)(17).)
The direct-use variant is narrower. Assume the contracts are immutable, no person can change or halt their operation, and users submit transactions independently. Assume also that no operator supplies a listed service around that interaction. Recital 22 then supports exclusion of the fully decentralised service from MiCA. Issuer obligations, participants' own regulated businesses and applicable lending or contract law require separate analysis. (MiCA, recitals 22 and 94; Article 2.)
The defined services around the loan
Lending one token against another is not automatically exchange. MiCA defines exchange by reference to purchase and sale contracts using the provider's proprietary capital. A loan's repayment obligation differs from an outright sale. Automated collateral liquidation can nevertheless produce a separate sale or exchange requiring its own classification. (MiCA, Article 3(1)(19)–(21); recital 94.)
Custody arises where a provider safeguards or controls clients' cryptoassets or their means of access. Transfers arise where it moves cryptoassets on a client's behalf between addresses or accounts. An affiliated wallet that receives collateral, or a company-controlled process that releases it, must be tested against those definitions. A brief holding period and common ownership with the interface operator provide no express exemption. (MiCA, Article 3(1)(17), (26); Articles 59 and 75(9).)
Execution and reception and transmission of orders concern agreements or orders to purchase, sell or subscribe for cryptoassets. A borrowing button therefore needs a transaction-level analysis. Preparing a loan transaction is not automatically reception and transmission of a purchase order. Routing a collateral sale, buying the borrowed token or subscribing for a pool token can supply the missing element. (MiCA, Article 3(1)(21), (23).)
Operating a trading platform requires a multilateral system bringing together third-party purchasing and selling interests under its rules. A lending pool does not meet that definition merely because several lenders and borrowers use it. An integrated exchange can do so. Placing requires marketing cryptoassets to purchasers on behalf of an offeror or a related party; listing collateral alone does not establish placing. (MiCA, Article 3(1)(18), (22).)
Personalised recommendations about cryptoasset transactions or the use of cryptoasset services can constitute advice. Generic asset descriptions differ from a recommendation calibrated to a borrower's circumstances. Portfolio management requires discretionary management under an individual client mandate. A pooled investment vehicle requires a separate collective-investment analysis, even where a manager describes its decisions as algorithmic. (MiCA, Article 3(1)(24)–(25); Directive 2011/61/EU, Article 4(1)(a).)
The actor assessment must include the front-end operator, wallet affiliate, on-ramp, lender, custodian and any pool manager. An issuer has a separate role where the structure creates a receipt or investment token. Oracle operators and liquidation keepers are not automatically CASPs; their instructions, authority and activity determine the result. A borrower acting for itself does not become a service provider merely by posting collateral. A professional participant providing services to others requires its own assessment. (MiCA, Articles 2–3 and 59.)
Claims and losses in the three variants
A smart-contract balance records a technical position. The customer agreement must identify the legal creditor, debtor and collateral holder. Where a named lender advances tokens directly, the borrower owes that lender the agreed repayment. Where users lend tokens to the company and it on-lends them, those users instead have repayment claims against the company. The company's separate claims against borrowers do not automatically belong to its funding customers. These contractual differences determine insolvency exposure and cannot be resolved by displaying a wallet balance. (MiCA, recital 94; ESMA_QA_2883, answer and footnote 1.)
In the immutable direct-use variant, no administrator can halt or rewrite the agreed contract logic. A borrower can lose collateral through the programmed liquidation process. Liquidity suppliers bear any shortfall allocated to their positions by that logic and the binding contractual arrangement. An issuer remains a separate obligor where the borrowed token carries an issuer redemption right. Without an identified contractual counterparty or other legal basis for a claim, a user cannot assume that the software developer guarantees repayment. (MiCA, recital 22; Article 49; ESMA_QA_2883.)
The controlled front end adds an operator capable of affecting performance. A pause can delay collateral return; changed listings or fees can alter the service users receive. Liability then depends on the company's contractual promises, actual regulated role and applicable national law. Where it provides custody, Article 75 imposes duties and liability for attributable custody losses. Those protections do not insure a loan's performance or every blockchain failure. (MiCA, Articles 70 and 75(1), (6)–(8).)
For a managed pool, the documents must identify whether the pool vehicle or its investors own the loan claims. If the vehicle lends as principal, borrowers owe it repayment; investors hold the rights created by their investment instruments. Losses reduce pool assets unless a legally effective guarantee reallocates them. Custody contracts protect the assets still held in custody, while assets transferred under a genuine loan create a different credit exposure. Pooling and managerial discretion can also bring the arrangement within investment-fund legislation. (Directive 2011/61/EU, Article 4(1)(a); MiCA, Article 75; ESMA_QA_2883.)
An informational interface
The company can publish neutral technical information without performing a MiCA service through that publication. The recommended informational version has no wallet connection, transaction construction, order routing, personalised loan selection or integrated on-ramp. It accepts no collateral and receives no compensation tied to EU transactions. These restrictions define the proposed service; "non-custodial" alone would be insufficient. (MiCA, Article 3(1)(16)–(26).)
Users who independently interact with immutable contracts remain responsible for submitting their own transactions. The publisher holds no administrative or liquidation keys for that deployment and makes no undertaking to operate the loan. Its website terms address publication and support, rather than pretending to identify the software as a creditor. A support contact handles publication complaints without representing that it can reverse an immutable transaction.
This option is unsuitable as a disguised distribution channel for the controlled global interface. A paid link, personalised referral or integrated affiliate route requires reassessment of the actual service and marketing. EU-targeted promotions also defeat reliance on reverse solicitation for services subsequently supplied by the third-country firm. Article 61 requires the client's own exclusive initiative and expressly addresses solicitation through closely linked entities or agents. (MiCA, Articles 3(1)(24), 61 and 66(2).)
An EU-authorised partner
An authorised partner works only when it performs the regulated step in substance. A custody partner must control the custody arrangements and contract with the relevant client. An execution provider must perform the collateral sale under the applicable mandate. A payment provider must carry out the payment service. Passing assets momentarily through a partner before the Nigerian company resumes control leaves the latter's role to be assessed separately. (MiCA, Articles 59, 70(4), 73 and 75.)
The preferred partner profile is an EU credit institution that supplies the lending and payment functions and completes the relevant MiCA Article 60 notification. The notified cryptoasset services must include the proposed custody, transfers and agency execution of liquidation sales. The bank must notify at least 40 working days before first providing the services and cannot begin while its notification is incomplete. Cross-border cryptoasset services also require the Article 65 procedure. The bank's banking and payment permissions must cover its actual cross-border activity. Article 60 is a route for eligible financial entities, rather than permission for an unrelated technology company to operate under the bank's name. (MiCA, Article 60(1), (8), (10) and Article 65; Directive 2013/36/EU, Articles 33 and 39 and Annex I; Directive (EU) 2015/2366, Article 1(1)(a).)
Customers contract with the bank for the loan, collateral arrangements, custody and relevant transaction services. The bank controls production keys, risk parameters, approved assets, front-end communications and complaints. The Nigerian supplier receives a fixed software fee and has no authority to approve borrowers, route assets or alter live contracts. The outsourcing agreement preserves the bank's access, supervision, continuity and exit rights. (MiCA, Articles 60, 71, 73 and 75; Regulation (EU) 2022/2554, Articles 28–30.)
A separately authorised CASP can instead perform specified custody or execution steps. Its exact services and host-state notifications must match the product. The creditor still requires its own valid lending route, and any payment service needs a competent payment provider. The group's contractual allocation cannot transfer a statutory duty away from the person who actually performs the regulated activity. Licentium's MiCA CASP authorisation guide explains the application and service-scope distinction. (MiCA, Articles 59–60, 65, 70(4) and 73.)
A new entrant in October 2026 cannot rely on MiCA's expired maximum transitional period. Article 143(3) permitted qualifying earlier providers to continue only until 1 July 2026 at the latest, with shorter national periods possible. The proposed launch therefore requires the applicable authorisation or completed notification route before business starts. (MiCA, Articles 59–60 and 143(3).)
A group-controlled service and managed pool
Retaining EU-facing control requires a different business plan. An EU group entity performing MiCA services must obtain the relevant authorisation or qualify under Article 60. It needs the establishment, management and operational arrangements required by MiCA. A nominal EU subsidiary that leaves the Nigerian parent in control of clients' assets and regulated decisions does not implement that separation. (MiCA, Articles 59(2), 62–63 and 73.)
The EU operator would sign the relevant service agreements, hold or lawfully delegate keys and administer liquidation mandates. Customer assets would move through its approved custody and transfer arrangements. A separately licensed provider would perform any payment step outside its permissions. Complaints would reach the responsible EU provider, with contractual recourse against the Nigerian technology supplier handled separately. Outsourced custody must comply with Article 75(9). (MiCA, Articles 70–71, 73 and 75.)
A managed pool adds a manager, funding contracts and investment decisions. Raising capital from several investors under a defined investment policy for their benefit can constitute an alternative investment fund. Individual discretionary cryptoasset mandates can instead engage MiCA portfolio management where the assets remain within MiCA. Neither route follows merely from calling the product a lending pool. (Directive 2011/61/EU, Article 4(1)(a); MiCA, Articles 2(4)(a), 3(1)(25) and 81.)
The pool route should therefore wait for separate fund, asset and lending classification. AIFMD's professional-investor marketing routes do not provide a general retail distribution right. The loan-origination amendments in Directive (EU) 2024/927 also require an implementation and transition check. A public promise to repay investors at par can introduce deposit-taking questions beyond fund classification. (Directive 2011/61/EU, Articles 6, 32 and 42, as amended; Directive (EU) 2024/927, Articles 1 and 3; Directive 2013/36/EU, Article 9.)
Tokens, payments and liquidation
The pilot should use native ETH as collateral and one euro e-money token issued by an eligible EU bank or electronic money institution. The issuer and token must satisfy MiCA's applicable requirements. A holder's redemption claim against the EMT issuer is distinct from the lender's claim against the borrower. Neither claim guarantees the market value of ETH collateral. (MiCA, Articles 3(1)(7), 48 and 49.)
Stablecoin selection now requires particular care. ESMA's 8 October 2026 Opinion sets a supervisory expectation against CASP services involving non-MiCA-compliant ARTs and EMTs, subject to limited legacy wind-down arrangements. It applies its interpretation of Article 66 beyond whether each service itself constitutes a public offer. The Opinion is supervisory guidance, rather than a legislative amendment or a new lending service. A new pilot should exclude those tokens instead of relying on a risk warning. (ESMA75-113276571-1742, paragraphs 12–14, 19 and 23–27.)
Removing a fiat on-ramp does not remove payment-law analysis. EMTs are electronic money; executing their transfers can constitute payment services. MiCA expressly requires an appropriately authorised provider for payment services related to cryptoasset services. The bank-led version allocates the EMT payment function to the bank rather than leaving it with an unlicensed affiliate. (MiCA, Articles 48(2) and 70(4); Directive (EU) 2015/2366, Article 4(25) and Annex I.)
The EBA's earlier general transition for the MiCA and PSD2 overlap ended on 2 March 2026. Its February opinion addresses specific supervisory treatment after that date, rather than granting every CASP a payment permission. The pilot should rely on the bank's actual payment capacity, without assuming a blanket extension. (EBA, Opinion on the end of the No-Action Letter transition period, 12 February 2026; MiCA, Article 70(4).)
Article 50 prohibits issuers and CASPs from granting interest related to EMT holdings. Interest paid by a borrower for an actual loan requires analysis of the agreement and the allocation of risk. It must not disguise a benefit paid merely for holding the EMT. The proposed pilot has no customer yield account, balance reward or supplier-funded lending programme. (MiCA, Article 50; ESMA_QA_2883.)
For liquidation, the bank acts under an express collateral-enforcement and sale mandate. It must identify the execution venue, price source, fees, slippage controls and treatment of surplus proceeds. A sale against the bank's own inventory requires exchange-service classification; an agency sale requires execution analysis. Contractual authority to liquidate must also be effective under the applicable national security and insolvency law. (MiCA, Article 3(1)(19)–(21), Articles 77–78 and recital 94.)
Financial instruments and funding promises
Each token requires classification by its legal rights. A transferable debt claim, fund unit or derivative can be a financial instrument excluded from MiCA. An asset's blockchain form does not override its rights to repayment, pooled returns or investment performance. MiFID II, fund legislation and securities-offering rules then replace or supplement the assumed MiCA route. (MiCA, Article 2(4)(a); Directive 2014/65/EU, Article 4(1)(15) and Annex I, Section C.)
The recommended design therefore creates no transferable loan receipt, pooled investment token or governance token with revenue rights. It accepts no funding from public liquidity suppliers and makes no promise to return their capital. Lending from the bank's own balance sheet avoids that additional funding leg. The bank still needs permission for its lending business and must assess the credit exposure. (Directive 2013/36/EU, Article 9 and Annex I, point 2; MiCA, recital 94.)
Posting collateral is not automatically taking a bank deposit. The analysis must identify whether the recipient takes funds from the public under a repayment obligation and whether an exception applies. A pledge, a title-transfer loan and a redeemable funding account create different rights. Calling each action a "deposit" on the interface does not establish the statutory elements. (Directive 2013/36/EU, Article 9; Kreditwesengesetz, § 1(1), sentence 2, point 1.)
AML, Travel Rule and operational controls
An EU CASP or bank cannot treat a blockchain address as sufficient customer identification. Applicable national AML duties require customer and beneficial-owner checks, risk assessment, monitoring and suspicious-transaction reporting. The operating model must assign responsibility for the borrower, source of collateral, recipient address and liquidation proceeds. Outsourcing checks does not turn an unidentified customer into an acceptable one. (Directive (EU) 2015/849, Articles 13, 18 and 33, as amended by Regulation (EU) 2023/1113.)
The EU Travel Rule applies to covered cryptoasset transfers involving an EU provider. Originator and beneficiary information must accompany the transfer through the required process. Transfers involving self-hosted addresses also require assessment; the additional ownership or control check applies above EUR 1,000 in the specified cases. That threshold is not a general exemption from the Travel Rule or customer due diligence. The person-to-person exclusion concerns transfers without a CASP's involvement. (Regulation (EU) 2023/1113, Articles 2, 14 and 16.)
The bank must map loan disbursement, collateral deposits, repayments, sales and returns separately. Identity information should travel through secure off-chain channels. Public-chain storage of customer documents would create unnecessary data exposure. The EU-to-Nigeria support arrangement requires defined controller and processor roles, restricted access and a lawful international-transfer mechanism where personal data are transferred. EU targeting can also engage the GDPR directly for the Nigerian company. (Regulation (EU) 2016/679, Articles 3, 5, 28 and 44–49.)
DORA applies to the covered financial providers and affects the Nigerian software relationship through ICT-risk and contract requirements. The bank must retain incident response, testing, access to records and an executable exit plan. The principal AML Regulation adopted in 2024 generally applies from 10 July 2027; its future application does not replace the duties already operating in October 2026. (Regulation (EU) 2022/2554, Articles 2, 28–30 and 64; Regulation (EU) 2024/1624, Article 90.)
Retail borrowers and consumer contracts
Retail borrowing requires a separate release decision. Where the agreement falls within applicable consumer-credit law, collateral sufficiency does not replace creditworthiness assessment, prescribed information or borrower remedies. The legal definition of credit, the token obligation and applicable exclusions must be tested. A non-recourse crypto pledge should not be assumed to qualify for an exclusion drafted around a pledged item and limited liability. (Directive 2008/48/EC, Articles 2(2)(k), 3(c), 5, 8 and 14.)
Directive (EU) 2023/2225 changes the consumer-credit regime through national implementation, with application from 20 November 2026. The separate distance-financial-services amendments apply through national measures from 19 June 2026. A launch around these dates must identify the version governing each agreement, including rules for existing and open-ended credit. The earlier regime cannot be copied into a new retail product without that check. (Directive (EU) 2023/2225, Articles 47–48; Directive (EU) 2023/2673, Articles 2–3.)
Consumer terms must explain liquidation, all charges, emergency powers and complaint routes. A Nigerian governing-law clause does not necessarily deprive a targeted EU consumer of mandatory home-state protection. Consumer jurisdiction rules can permit proceedings in the consumer's Member State. Contract terms that allow the company to rewrite economic terms or deny all responsibility require review under unfair-terms legislation. (Regulation (EC) No 593/2008, Article 6; Regulation (EU) No 1215/2012, Articles 17–19; Directive 93/13/EEC, Articles 3 and 6.)
The professional pilot admits legal persons borrowing for their own business purposes, with documented authority and experience. It excludes natural persons, personal-purpose borrowing and arrangements that conceal retail clients behind a nominee. This business-customer restriction does not classify every admitted company as a MiFID professional client. It reduces consumer-law exposure without creating an exemption from MiCA, national lending restrictions, AML or enforceability requirements. (MiCA, Articles 59 and 66; Directive 2008/48/EC, Article 3(a); Directive 2014/65/EU, Annex II.)
Member State lending and enforcement gates
A common EU design is possible; a common lending clearance cannot be presumed. The country review must classify what the lender advances and what the borrower must return. A euro repayment promise, an EMT repayment obligation and an obligation to return units of another cryptoasset can produce different results. The review must also distinguish a genuine pledge from title transfer, reuse rights and unsecured exposure. (MiCA, recital 94; Directive 2013/36/EU, Article 9.)
Germany supplies a concrete credit-perimeter test. The Kreditwesengesetz includes granting money loans within banking business and requires permission for relevant business conducted domestically. The euro-EMT terms therefore need a German determination of whether they constitute a money loan and which cross-border permission applies to the lender. Using proprietary capital does not, by itself, remove the statutory money-lending test. Public funding would add the separate deposit-business question. (Kreditwesengesetz, § 1(1), sentence 2, points 1–2; § 32(1).)
France requires its own analysis. The Code monétaire et financier defines an operation of credit through an onerous provision or promise of funds and restricts habitual credit operations, subject to statutory exceptions. Counsel must decide how those provisions apply to the particular EMT obligation and the proposed lender. An EU CASP permission cannot be substituted for that determination. (Code monétaire et financier, Articles L. 313-1 and L. 511-5.)
Neither country should open merely because a provider appears on a MiCA register. The release record must establish the lender's lawful route, the relevant cross-border notifications and effective collateral enforcement. It must also address insolvency treatment, local-language communications, complaints and any national credit-intermediation rules. The same record is required before adding another Member State. (MiCA, Articles 60 and 65; recital 94.)
The first market should follow documented customer demand and a legally workable provider arrangement. Selection criteria should include the bank's existing permissions, the national treatment of the loan, enforceable collateral rights and local servicing capacity. A low authorisation fee or a favourable reputation for crypto businesses is not a substitute for those conditions. Germany and France are screening candidates here; neither receives launch approval.
Nigerian SEC jurisdiction and the company's powers
The Nigerian company requires a domestic analysis even when EU users submit transactions on-chain. The Investments and Securities Act 2025 gives the SEC powers over virtual-asset service providers, digital-asset operators and relevant market infrastructure. Section 61 requires registration for the capital-market and investment or securities business within its scope. The Act's definition of securities includes virtual and digital assets. (Investments and Securities Act 2025, sections 3(3)(b), (f), (g), (i), 61 and 357.)
The SEC's 2022 Digital Asset Rules distinguished virtual-asset services from mere technology provision. Part D addressed identified dealing, transfer, advice and custody activities, with exemptions for specified technology, communications and content-only services. A developer that retains market control, transaction revenues and asset-access powers cannot assume it supplies only software. The proposed pilot does not rely on those historical technology exclusions. The company's actual function must support its present registration or exemption position under the 2025 Act. (SEC, Rules on Issuance, Offering Platforms and Custody of Digital Assets 2022, Part D, rules 1.1–1.3, 3–4; Investments and Securities Act 2025, sections 61 and 356.)
Governance powers and fees are therefore relevant evidence of the business being conducted. A fee alone does not establish every regulated function. A fee combined with borrower selection, collateral control or market operation can connect the company to investment or virtual-asset services. Removing those powers from the EU deployment narrows its role there, but does not change the classification of a separately retained Nigerian or global operation. (Investments and Securities Act 2025, sections 3(3), 61 and 357.)
The 2025 Act repeals the 2007 Act and contains a savings provision for existing instruments. Later consultation papers and proposed replacement rules must be distinguished from operative requirements. The SEC's March 2026 capital guidelines are a separate current instrument: new applicants must satisfy the revised capital requirements, while specified existing operators have a transition to 30 June 2027. Applications pending on 16 January 2026 require separate treatment under paragraphs 1.4(c)–(d). A start-up cannot claim that existing-operator deadline as its own general exemption. (Investments and Securities Act 2025, section 356; SEC, Guidelines on Revised Minimum Capital for Regulated Entities, 18 March 2026, paragraphs 1.3–1.4 and 9.)
The operating entity must hold permissions for its actual functions and satisfy their conditions. The SEC's incubation and accelerated-incubation arrangements require attention to the precise admission granted. A group affiliate's approval cannot establish the Nigerian company's own authority, and Nigerian registration provides no MiCA passport. The State House statement dated 17 July 2026 announced coordinated SEC and CBN supervision while preserving each agency's statutory mandate. The proposed software-only arrangement therefore remains conditional on classification of the retained business with both regulators where their functions are engaged. (Investments and Securities Act 2025, section 61; MiCA, Article 59; State House, President Tinubu Signs Executive Order on Virtual Assets, Establishes Council to Harmonise Regulation of Digital Economy, statement dated 17 July 2026, published 18 July 2026.)
Nigerian AML, cross-border flows and consumer-facing operations
Nigeria's Money Laundering (Prevention and Prohibition) Act 2022 includes VASPs within financial institutions. Applicable duties include identification, suspicious-transaction reporting, records, internal controls and pre-launch assessment of new technologies. The SEC's AML/CFT/CPF Regulations add specific customer and virtual-asset transfer requirements for operators within their scope. A wallet address and smart-contract audit do not discharge those obligations. (Money Laundering (Prevention and Prohibition) Act 2022, sections 4, 7–8, 10, 13 and 30; SEC AML/CFT/CPF Regulations 2022, regulations 9 and 15.)
The Nigerian Travel Rule treats virtual-asset transfers as cross-border transfers for its stated requirements. Its information rules and thresholds must be mapped separately from the EU Travel Rule. Section 3 of the 2022 Act also requires reporting of qualifying international transfers of funds or securities above US$10,000 or equivalent within one day. That reporting obligation is different from permission to offer foreign exchange, banking or payment services. (SEC AML/CFT/CPF Regulations 2022, regulation 15; Money Laundering (Prevention and Prohibition) Act 2022, section 3(1).)
The proposed pilot excludes Nigerian custody and fiat routing. Software fees travel through the company's documented banking arrangements, separately from customer collateral and loan proceeds. Any later Nigerian wallet or on-ramp requires its own SEC and CBN classification, banking arrangements and cross-border reporting process. CBN's published virtual-asset sandbox also covers stablecoin, wallet and custody propositions. Admission does not authorise operation beyond approved testing parameters. The CBN identifies its 22 December 2023 VASP bank-account guidelines as a distinct measure governing that banking relationship. (CBN, Reforms and Initiatives, entry concerning VASP bank accounts; CBN Regulatory Sandbox, Cohort 2, VASP Track and FAQs.)
Consumer-facing Nigerian operations need an additional review of fee-sharing and digital-lending rules. The FCCPC's published DEON Regulations address unsecured consumer lending and extend specified obligations to participating service providers and revenue recipients. The regulator announced resumed implementation on 20 July 2026 after the earlier suspension. Their application to crypto collateral, the particular customer base and the Nigerian commercial activity must be resolved before adding that business. They cannot be treated as an automatic exemption or an automatic authorisation for a secured crypto loan. (Digital, Electronic, Online, or Non-Traditional Consumer Lending Regulations 2025, regulations 3–4 and 10–12; FCCPC, "FCCPC Resumes Digital Lending Regulation", 20 July 2026.)
For services within those Regulations, consumer communications, contract fairness, credit assessment, data protection and complaints attract express duties. Regulation 21 expressly requires compliance with the Nigeria Data Protection Act 2023 and applicable subsidiary requirements. The Nigerian data review must address onboarding records, cloud processing, international access and the legal basis for marketing. EU customer data sent to Nigeria also require the separate GDPR assessment described above. (DEON Regulations 2025, regulations 17–22; Regulation (EU) 2016/679, Articles 3 and 44–49.)
The defined professional pilot
The recommended transactional product is a bank-operated, bilateral, professional-only lending service on one blockchain. It accepts native ETH collateral and lends one selected, compliant euro EMT from the bank's own holdings. Loans have a fixed 90-day term without automatic renewal. The rate, collateral ratio, liquidation trigger and charges are fixed for each loan before acceptance. No numerical collateral ratio is treated as a legal safe harbour.
The bank is the named creditor. Borrowers undertake to repay the agreed token principal and interest, with ordinary recovery limited to the specified collateral. Separate fraud and misconduct provisions must satisfy applicable law. The bank bears an ordinary liquidation shortfall; the borrower bears loss of collateral applied to the debt. Surplus collateral or sale proceeds return to the borrower. The EMT issuer remains responsible for the token's redemption obligation under MiCA. (MiCA, Article 49 and recital 94.)
The asset path starts with verified collateral from the borrower's wallet into a segregated, bank-controlled contract position. The bank transfers its pre-acquired EMT to the borrower's verified destination through its payment and cryptoasset-transfer processes. Repayment releases collateral under the loan terms. If the trigger occurs, the bank's authorised execution process sells the required collateral and applies the proceeds. Borrowed assets are not described as safeguarded collateral after disbursement. (MiCA, Articles 60(1), 70 and 75; ESMA_QA_2883.)
The product accepts no public lender deposits, pooled liquidity, rehypothecation or transferable loan receipts. It offers no staking, cross-chain bridges, integrated fiat conversion, discretionary investment service or recursive borrowing within the deployment. Removing these features narrows the permissions and loss-allocation questions without dispensing with the lender's banking or national-law requirements. (MiCA, Articles 2–3 and recital 94; Directive 2011/61/EU, Article 4(1)(a).)
The bank holds production keys and determines approved parameters. Emergency powers are documented and limited to specified incidents. They cannot change accrued economic terms through an undisclosed upgrade. The Nigerian company holds no signer, recovery, veto, oracle-selection or deployment-administration power for the EU service. It receives a fixed development and support fee, with no EU loan-volume, liquidation or protocol-revenue share. These are substantive product changes, rather than changes to the website's description. (MiCA, Articles 66, 73 and 75.)
Customers receive named contracting parties, a custody agreement, loan and security terms, payment conditions and a single bank complaints entry point. Those documents distinguish credit loss, collateral loss, issuer failure and custody incidents. Article 75 liability remains limited to its statutory conditions; the bank must not present it as universal insurance. (MiCA, Articles 71 and 75(1), (7)–(8).)
Country release, documents and access controls
Each country opens only after the bank and local counsel approve a product-specific record. It must identify the eligible customer class, loan characterisation, permissions, cross-border notices, collateral rights and enforcement process. The record must cover marketing channels, language, complaints, AML responsibilities and data flows. A legal answer for one Member State does not authorise another country's customer journey. (MiCA, Articles 60, 65 and 71; recital 94.)
Before approval, the team needs the bank's permission and notification records, the token issuer's status and white paper, and the Nigerian entity's registration documents. The technical pack must include deployed code, contract addresses, all key permissions, signer replacement rules, oracle dependencies and audit findings. The contract pack must contain the customer agreements, outsourcing terms, liquidation mandate, incident plan and allocation of losses. These records allow the regulators and counsel to assess the actual transaction rather than a decentralisation claim. (MiCA, Articles 60, 62, 70, 73 and 75.)
The EU regulator should receive a service-by-service explanation of custody, transfers, payments and liquidation execution. National credit counsel should resolve the EMT loan and the collateral arrangement before the first customer signs. The Nigerian SEC should receive the retained control and remuneration model, with a request for the relevant registration or exemption position. The CBN inquiry must include the retained virtual-asset functions, beyond any fiat leg. Data-protection questions must be addressed for the chosen information flows. (MiCA, Articles 59–60 and 70(4); Investments and Securities Act 2025, section 61; CBN Regulatory Sandbox, Cohort 2, VASP Track and FAQs.)
The access policy should combine verified establishment and business purpose with wallet allowlisting and server-side country controls. Marketing, affiliates, APIs and mobile distribution must use the same permitted-country list. Contract-level controls should reject new positions outside the approved deployment. Geoblocking a company website cannot prevent independent use of already-public immutable contracts, so the company must not claim that it can exclude every EU blockchain transaction.
The bank should preserve lawful repayment and collateral-return routes when it suspends new business. A change in token eligibility, key control, lender permissions or national law must trigger a new release decision. Horizon regulatory-change monitoring can support source monitoring; the responsible legal team must determine the consequence for the product. Existing customers need a documented wind-down process rather than an unexplained access block. (MiCA, Articles 70, 73 and 75(6); ESMA75-113276571-1742, paragraphs 23–27.)
Existing interpretations and the 2026 review
ESMA's June 2026 lending answer applies existing MiCA duties to CASPs offering lending alongside regulated services. It requires express, specific prior consent for lending clients' assets. ESMA considers that lending revenues should accrue to the clients bearing the risk, apart from a proportionate fee reflecting operational costs. Additional revenue retention conflicts with that interpretation of the client-interest duty. It should not be applied mechanically to ordinary interest earned by a principal lending its own capital. The answer is supervisory interpretation, rather than a newly enacted lending authorisation. (ESMA_QA_2883, answer and footnote 1; MiCA, Articles 66 and 70.)
The EBA's September 2026 review statement identifies lending and DeFi as policy priorities. ESMA's September response proposes a regulated gateway service and targeted lending and borrowing duties. Its lending discussion expressly distinguishes those proposals from creating a new standalone authorisation service. Neither consultation response changes Article 3's present list of services. (EBA, "EBA identifies priorities for the review of MiCA", 24 September 2026; ESMA75-113276571-1721, sections 3 and 7.2; MiCA, Article 3.)
The adverse case and facts that change the recommendation
The strongest adverse case is that the Nigerian company remains the functional intermediary throughout. Its commercial control, key rights, affiliate routing and revenue share would connect the interface to the financial service despite outsourced branding. A regulator would then test custody, transfers, execution, advice and other activities against Article 3, alongside national credit and Nigerian securities rules. The lack of a standalone MiCA lending category would not answer those separate allegations. (MiCA, recitals 22 and 94, Articles 3, 59 and 73; Investments and Securities Act 2025, section 61.)
The bank-led recommendation depends on an actual transfer of EU operational authority and a willing, properly permitted bank. It fails if the Nigerian company retains hidden recovery keys, directs regulated decisions or receives customer assets through an unauthorised affiliate. It also fails if the selected country's law does not support the proposed loan or effective collateral rights. In those circumstances, transactional access stays closed while the group obtains the required permissions or changes the product.
Permanent removal of every intermediary from an immutable deployment would strengthen the direct-use MiCA analysis. Retail admission, customer-funded pools, guaranteed redemption, discretionary lending, tokenised investment rights or collateral reuse would require a broader permission and protection analysis. Each change must be assessed before deployment. Until the operating roles and country gates are satisfied, the company should limit EU availability to the defined informational service. (MiCA, recitals 22 and 94, Articles 2–3 and 59; Directive 2011/61/EU, Article 4(1)(a).)