Executive Summary
- Nigeria: Retain Nigerian exchange customers with Nigeria OpCo only within its effective SEC permission. Registration, regulatory incubation and approval-in-principle have different legal effects. An application or group affiliation supplies no operating permission. (Investments and Securities Act 2025, s.61; SEC ARIP admission notice, 13 August 2026.)
- Dubai: Establish Dubai ExchangeCo outside the DIFC and obtain an operational VASP Licence covering Exchange Services. Approval to Incorporate permits establishment work, without authorising virtual-asset business. Classify the hosted-wallet service separately before selecting custody arrangements. (Dubai Law No.4 of 2022, arts.3, 15–17; VARA Licence Applications; VARA Regulations 2023, Schedule 1.)
- Nigeria and Dubai: Do not use Dubai contracting, an affiliate or a foreign-law clause to bypass Nigerian requirements. Active targeting of Nigerian investors falls within SEC rules. Dubai entities marketing abroad must comply with destination-country law. (SEC Digital Asset Rules 2022, Part D, rule 1.1(d); VARA Marketing Regulations 2024, rule I.G.1.)
- UAE: Map fiat and payment-token services separately from exchange permission. Federal capital-market coordination and Central Bank payment supervision remain relevant. A VARA licence does not approve every settlement product. (Federal Decree-Law No.33 of 2025, art.39; CBUAE Thematic Review, May 2026, section 1.2.)
- Group implementation: Launch Dubai for approved new markets first, without migrating Nigerian users or pooling their assets. If Nigeria OpCo lacks sufficient permission, restrict the affected Nigerian service and arrange an orderly exit with the SEC. Redirecting customers to Dubai is not the corrective action. (SEC Digital Asset Rules 2022, Part E, rules 16 and 24; ARIP Framework, paras.36–39.)
Nigerian permission and the limits of incubation
The group must decide Nigerian service eligibility before reallocating its business. The Investments and Securities Act 2025 expressly brings digital-asset exchanges and virtual-asset service providers within SEC supervision. Section 61 requires registration for the relevant Nigerian capital-market business. Section 356 preserves existing regulatory instruments on its stated terms after repealing the 2007 Act. The 2022 digital-asset rules remain published in the SEC’s official rules collection. (Investments and Securities Act 2025, ss.3(3)(b), 3(3)(i), 61 and 356; SEC Rules on Issuance, Offering Platforms and Custody of Digital Assets, 2022.)
The search phrases “Nigeria crypto license” and “Nigeria SEC crypto license” require an entity-specific answer. The relevant status may be registration for a Digital Assets Exchange, permission for custody, or a restricted programme admission. Directors should record the legal entity, authorised functions, conditions and effective period before describing it publicly as licensed. Those particulars determine whether the proposed spot exchange and wallet fit the permission. DAX registration alone does not approve the token list: the SEC requires a no-objection before a DAX trades any digital asset. (SEC Digital Asset Rules 2022, Part E, rule 23.1.)
ARIP means the Accelerated Regulatory Incubation Program. Its published restrictions limit activities and customer growth and prohibit public or private promotional activity. The customer-growth ceiling is 10% of the entry figure. Admission does not create an unrestricted commercial launch window. SEC’s August 2026 notice expressly distinguishes approval-in-principle, within specified conditions, from final registration. A programme participant must follow its admission terms and any valid subsequent directions. (ARIP Framework, paras.29 and 37–39; SEC ARIP admission notice, 13 August 2026.)
The SEC’s separate Regulatory Incubation programme describes a one-year testing period. That description should not be imported into every ARIP admission. Nor should a directory heading establish a firm’s current permission: an entry may identify a testing programme and historical dates. The group should reconcile the official register with the permission letter and later SEC decisions before continuing the Nigerian path. (SEC, FinPort Programs: RI and ARIP; SEC, Registered FinTech Operators.)
SEC’s document published as Proposed Rules on Digital and Virtual Asset Operations, Custody and Markets is a proposal. Its prospective replacement provisions do not themselves authorise business or displace an operator’s conditions. The group should not use proposed custody architecture, exemptions or transition periods as launch permissions. (SEC, Proposed Rules on Digital and Virtual Asset Operations, Custody and Markets, concluding justification.)
Nigerian capital and management must survive the expansion
Dubai funding must leave Nigeria OpCo able to meet its own obligations. SEC Circular 26-1 sets revised minimum capital of NGN2 billion for a Digital Assets Exchange and NGN2 billion for a Digital Asset Custodian. The March 2026 implementation guidelines distinguish existing operators from new registrations. New registrations from 16 January 2026 require the revised capital upfront; qualifying existing operators have until 30 June 2027. Pending applications have separate conditions. Qualifying applications pending on 16 January 2026 require written, board-approved plans for compliance by 30 June 2027. Applications already pending for at least 12 months on 16 January 2026 require fresh applications and compliance with the revised capital. An operator performing multiple regulated functions must meet the capital requirement for each function. The group cannot assume that every applicant receives the existing-operator transition. (SEC Circular 26-1, 16 January 2026, digital-asset operator entries; Guidelines on Revised Minimum Capital for Regulated Entities, 18 March 2026, paras.1.3–1.4.)
An ARIP structure also requires Nigerian incorporation, a Nigerian office and a resident chief executive or equivalent. Moving that person to Dubai without a compliant replacement would undermine the Nigerian arrangement. The proposed hub should employ its own managers, with Nigerian appointments and responsibilities preserved or changed through the required procedures. A capital market operator also needs prior written SEC approval to change its registered name, shareholding or directors. (ARIP Framework, para.6; Investments and Securities Act 2025, ss.62 and 349(1)–(2).)
The Dubai entity and its permitted activities
Dubai ExchangeCo should be a separately established operating entity, with actual management and staff in Dubai. VARA’s jurisdiction includes Dubai’s commercial free zones but excludes the DIFC. Incorporation in a commercial free zone does not remove the requirement for a VARA permit. The permit belongs to its holder; Dubai Law No.4 requires VARA approval for an assignment. (Dubai Law No.4 of 2022, arts.3, 15 and 17.)
For this proposed spot venue, Exchange Services is the starting category. VARA’s definition covers virtual-asset/fiat exchange, virtual-asset exchange, order matching and order-book operation. Order routing, brokerage, transfers or other affiliate functions require their own classification against the actual conduct. A commercial description of a “technology hub” cannot settle that classification. (VARA Virtual Assets and Related Activities Regulations 2023, Part IV.A.1 and Schedule 1.)
“VARA license Dubai” is a search phrase, not an approval stage. New applicants first seek Approval to Incorporate, then a VASP Licence. The first stage supports incorporation, premises and staffing. Customer activity must wait for the relevant licence and fulfilment of its operational conditions. Before release, check the public register’s status and activities against the issued document. (VARA, Licence Applications; VARA, Public Register.)
The proposed operator must apply the Company, Compliance and Risk Management, Technology and Information, and Market Conduct Rulebooks. Activity-specific rules apply in addition. VARA’s current Exchange Services Rulebook took effect on 31 March 2026 and requires at least one independent director. The Company Rulebook requires two approved, full-time Responsible Individuals meeting its residency or UAE-passport condition. A Dubai lease without the required decision-makers is inadequate. (VARA Exchange Services Rulebook, introduction and rule I.A.1; Company Rulebook, rules I.C.1–2.)
Dubai ExchangeCo should demonstrate functioning controls before customer release. VARA requires a Money Laundering Reporting Officer, customer due diligence and transaction monitoring. It also requires a Compliance Officer and a Chief Information Security Officer, who must be different individuals. Client-asset rules require segregation and daily reconciliations. The implementation plan should also assign cybersecurity, key management, market controls and record retention to named officers. These duties continue after onboarding. (VARA Compliance and Risk Management Rulebook, rule I.C.1 and Parts III–V; Technology and Information Rulebook, Part I, including rule I.I.1; Exchange Services Rulebook, Parts II–III.)
Hosted wallets and custody separation
The first Dubai phase should use a VARA-licensed custodian under an arrangement accepted for Dubai ExchangeCo’s business. That recommendation reduces the initial group’s custody-licensing work; it does not remove the exchange’s client-asset duties. VARA distinguishes general client-asset safeguarding from the separately defined Custody Services activity. The exact wallet mandate, key control and client instructions must determine the classification. (VARA Regulations 2023, Schedule 1, Custody Services definition and accompanying note; Compliance and Risk Management Rulebook, Part V.)
If the group later offers regulated Custody Services itself, establish Dubai CustodyCo separately from the group’s other virtual-asset businesses. The Custody Services Rulebook requires separate legal and operational arrangements, including separate client wallets. Its limited provision for an additional Transfer and Settlement Services licence needs VARA approval. It is not a general permission to combine exchange and custody in one company. (VARA Custody Services Rulebook, rules III.B.3 and III.B.5–7.)
Capital depends on the approved model. For Exchange Services using a VARA-licensed custodian, or another arrangement approved during licensing, the minimum is the higher of AED800,000 and 15% of annual fixed overheads. Otherwise, it is the higher of AED1.5 million and 25%. Custody Services requires the higher of AED600,000 and 25%. These are capital tests, separate from operating expenditure and other financial requirements. A VASP licensed for multiple activities must hold the required capital for each activity, with overheads allocated under rule VI.B.2. (VARA Company Rulebook, rules VI.B.1–2.)
Functions that may move and duties that stay with Nigeria OpCo
The group may place development staff, investor relations and management of the new overseas business in Dubai, subject to the relevant permissions. A written intercompany agreement should allocate software, intellectual property, support and costs. This proposed allocation must leave Nigeria OpCo capable of performing its retained customer obligations. SEC’s technology-only exclusions do not extend to every affiliate that receives orders or controls customer assets. (SEC Digital Asset Rules 2022, Part D, rules 1.1 and 1.3.)
Nigeria OpCo should remain the named contracting provider for retained Nigerian accounts. It must retain responsibility for those accounts, complaints, reconciliations, regulatory reporting and protection of customer entitlements. Approved outsourcing can allocate performance, but the Nigerian exchange’s board remains accountable. SEC access to outsourced records must remain effective. The relevant duty is retained control and regulatory access; it does not establish a universal requirement that every server remain in Nigeria. (SEC Digital Asset Rules 2022, Part E, rules 13, 15 and 24.)
Keep Nigerian customer balances attributable to Nigeria OpCo’s service and approved custody arrangements. Do not transfer them to Dubai’s treasury or treat them as capital for the new venture. Shared technology should preserve separate ledgers, access controls and complaint ownership. The proposed separation gives each operator a traceable customer obligation instead of an undifferentiated group balance. (SEC capital guidelines, para.3.2(d); Digital Asset Rules 2022, Part E, rule 24.)
A Dubai affiliate that executes orders, holds keys or provides settlement to Nigeria OpCo needs its own activity analysis. Calling the arrangement business-to-business does not change those functions. Conversely, a genuine software supplier that performs only excluded technical functions should not automatically be classified as the customer’s exchange. These alternatives turn on conduct and control. (SEC Digital Asset Rules 2022, Part D, rules 1.1 and 1.3; VARA Regulations 2023, Part IV.A.1 and Schedule 1.)
For services outsourced by Dubai ExchangeCo across borders, VARA requires prior notification and continuing access for supervision. The agreement should allocate audit rights, service continuity, incident reporting, data handling and exit assistance. Nigeria OpCo cannot become an unexamined execution or custody subcontractor merely because it shares ownership. (VARA Company Rulebook, rules IV.D, IV.F.6 and IV.G.)
Nigerian residents and the strongest territorial objections
Dubai ExchangeCo should not solicit Nigerian residents at launch. SEC’s 2022 rules expressly reach foreign operators actively targeting Nigerian investors, directly or through agents and promotional channels. A Nigerian customer migration campaign, local affiliate referrals or Nigeria-specific onboarding would create a strong application of that rule. A Nigerian frontend attached to an offshore contract would leave the underlying targeting intact. (SEC Digital Asset Rules 2022, Part D, rule 1.1(d).)
The strongest contrary argument concerns genuinely unsolicited access to an offshore provider. The active-targeting language requires attention to actual facts, and passive website availability is different from a directed campaign. ARIP’s applicability provisions for providers seeking SEC registration also include services offered to Nigerian consumers and services to Nigerians irrespective of the operator’s location. That programme instrument does not settle every offshore jurisdiction question, but absence of advertising is not an established safe harbour. (ARIP Framework, paras.5(a), 5(d) and 5(h).) It does not follow that an established Nigerian customer base can be transferred under a reverse-solicitation label. Group-generated emails, migration prompts and continuing local services would undermine that account. The recommended launch policy blocks the Nigerian route until the group has an accepted Nigerian permission basis.
The objection also operates from Dubai. VARA requires Dubai entities marketing abroad to comply with the destination jurisdiction’s laws. Its requirements continue to govern activities outside Dubai, with the higher applicable standard controlling where requirements differ. Nigerian consumer legislation separately reaches specified offshore conduct involving services supplied into Nigeria. Choosing foreign law for a customer agreement does not confer a regulatory permission. (VARA Marketing Regulations 2024, rule I.G.1; VARA Regulations 2023, Part IV.A.4; Federal Competition and Consumer Protection Act 2018, s.2(3)(c).)
Residence and service location should drive routing controls, rather than passport nationality alone. A Nigerian national living abroad may fall within an approved overseas market; a non-Nigerian living in Nigeria may enter the Nigerian route. The overseas route for a Nigerian national also needs a Nigerian-perimeter assessment before onboarding; offshore residence alone does not resolve ARIP’s reference to services to Nigerians. (ARIP Framework, para.5(d).) The proposed controls should check residence evidence and investigate contradictory device or payment information. They should reject nominee accounts and deliberate location circumvention rather than rely on a checkbox.
Fiat settlement and payment tokens need a separate decision
Dubai ExchangeCo should initially use approved bank and payment-provider arrangements for its authorised spot business. A fiat balance, money transfer service and payment-token product can engage different requirements. CBUAE’s May 2026 supervisory review identifies separate regimes for Stored Value Facilities, Retail Payment Services and Card Schemes, and Payment Token Services. Payment-token issuance, conversion, custody and transfer require specific analysis. Selecting a stablecoin does not avoid that analysis. (CBUAE, Thematic Review of Providers of Stored Value Facilities, Retail Payment Services and Card Schemes, and Payment Token Services, May 2026, section 1.2.)
Federal capital-market requirements also continue alongside VARA. The Capital Market Authority replaced the Securities and Commodities Authority on 1 January 2026. Article 39 of Federal Decree-Law No.33 of 2025 regulates virtual assets without displacing Central Bank law. Article 39(2) prohibits trading a virtual asset within the UAE unless it is CMA-registered and admitted to the official list of a CMA-licensed platform operator. VARA’s register now includes CMA registration references. The group should obtain the applicable federal registration confirmation and approved asset scope with its Dubai permissions, rather than infer an unrestricted UAE passport. (Federal Decree-Law No.32 of 2025, arts.2 and 30; Federal Decree-Law No.33 of 2025, arts.39, 82 and 85; VARA Public Register.)
For the first release, exclude merchant token payments, remittances, customer lending and yield products from the proposed service. Permit only settlement flows documented in the approved operating model. The board should identify the account holder, payment provider, currency, customer-money treatment and receiving custodian for each flow. No Nigerian naira account should silently become a collection account for Dubai ExchangeCo.
Nigeria’s Presidency announced a Virtual Asset Council in July 2026 and expressly stated that existing regulators retain their mandates. The same statement assigns securities activities to SEC registration and payment, settlement, custody and related non-security virtual-asset services to CBN registration. The group must address that asset-and-activity distinction when seeking permissions for its retained Nigerian service. The group should not interpret that coordination announcement as removal of SEC requirements or permission to add a payment service. Any Nigerian payment, settlement or custody function needs a separate regulator-specific decision; an SEC exchange permission should not be treated as approval of every wallet function. (Presidency, statement on the Presidential Executive Order on Virtual Assets Coordination 2026, dated 17 July 2026, published 18 July 2026.)
Customer contracts and a later Nigerian migration
New eligible overseas customers should accept Dubai ExchangeCo’s agreement before receiving its service. That agreement should identify the operator, licensed activities, custody provider, fees, governing law and complaint route. VARA requires clear client agreements and disclosure of third-party involvement and responsibilities. Customer records should identify which entity owes each obligation at each stage. (VARA Market Conduct Rulebook, rules II.A and II.B.)
Existing Nigerian customers should retain their Nigeria OpCo agreements during the first phase. The proposed structure does not treat a corporate relocation, updated logo or group announcement as substitution of the contractual provider. Any later substitution should use an express, affirmative customer agreement after legal review of the existing terms. A notice clause should not be assumed to authorise the transfer of every duty or asset.
A Nigerian migration should proceed only after the receiving service has a valid Nigerian permission basis, alongside its Dubai permissions. This may require a locally authorised structure or a specific SEC-approved variation within the Commission’s powers. It cannot rest on customer consent alone. The group should also complete any required change-of-business, outsourcing, custody and payment approvals before sending migration invitations. (Investments and Securities Act 2025, s.61; SEC Digital Asset Rules 2022, Part D, rules 2.1 and 4.2; VARA Regulations 2023, Part IV.A.)
The proposed migration agreement should preserve accrued claims and identify who handles historical disputes. Before transfer, reconcile each customer’s fiat and virtual assets, confirm receiving custody and complete onboarding checks. Offer a practical refusal and withdrawal route consistent with applicable restrictions. Obtain a separate data-transfer assessment before sharing Nigerian identity files with Dubai. VARA’s cross-border outsourcing rules expressly require compliance with applicable data-transfer law. (VARA Company Rulebook, rule IV.F.3; Market Conduct Rulebook, rules II.B and III.A.)
The three structures and the order of implementation
A two-operator structure is defensible when each operator holds the permission for its own customers and functions. Nigeria OpCo contracts with the Nigerian cohort; Dubai ExchangeCo contracts with approved overseas customers. Each maintains separate customer-asset records, finances and accountable officers. Any shared execution, liquidity, custody or referral service needs separate permission analysis and documented controls. This is the longer-term operating structure, not authority to pool customers immediately. (SEC Digital Asset Rules 2022, Parts D and E; VARA Regulations 2023, Part IV and Schedule 1.)
The recommended first phase is narrower: open Dubai only for approved new markets while retaining the existing Nigerian service within its effective conditions. Obtain Approval to Incorporate, establish Dubai ExchangeCo, secure its local staff and premises, then complete activity classification, custody selection and licensing. Leave Nigerian contracts and customer assets untouched. Exclude Nigerian residents from Dubai onboarding and targeted marketing. Destination-country clearance must precede opening each additional market. (VARA Licence Applications; Marketing Regulations 2024, rule I.G.1.)
Before implementation, directors should obtain the Nigerian permission instrument and all later conditions, asset-specific SEC no-objections, the current customer agreements, custody mandates and bank contracts. They should map order routing, key control, affiliate services and customer-facing marketing. These records determine which activities require retention, permission changes or cessation. Only then should the boards approve the proposed entity and customer allocation.
The launch sequence should make funding and customer release separate decisions. First establish the Nigerian status and preserve required capital and management. Next obtain Approval to Incorporate, then complete Dubai incorporation and regulatory preparation without customer activity. Then secure operational permissions, bank and custody arrangements, country eligibility rules and separate client agreements. Finally test reconciliations, withdrawals, complaints and location controls before admitting the approved overseas cohort. Any subsequent Nigerian migration returns to the separate permission and consent process. (SEC capital guidelines, para.1.4; ARIP Framework, para.6; VARA Licence Applications; Market Conduct Rulebook, Part II.)
A Nigerian pause is the appropriate alternative when the operator has no effective permission for the proposed service or exceeds its conditions. Stop affected onboarding, promotion, deposits and trading rather than move that activity offshore. Preserve assets, records and complaint handling while seeking SEC directions on orderly cessation and permitted withdrawals. Withdrawal-only operation should not be assumed exempt, and legal freezing obligations still require observance. SEC rules require prior notification of cessation and permit conditions for an orderly exit. (SEC Digital Asset Rules 2022, Part E, rules 16–17; ARIP Framework, paras.36–37.)
A replacement Nigerian provider may take over through a properly authorised handover and valid customer arrangements. The proposed exit must preserve historical claims and allocate records and complaints expressly; opening Dubai does not perform that handover. Revocation of an exchange registration under section 26 does not extinguish the rights and obligations specified in section 37(6) of the Investments and Securities Act 2025.
The board should approve a named launch decision for each customer path. A missing Nigerian permission blocks Nigerian expansion and migration. An unmet Dubai operational condition blocks Dubai customer activity. An unresolved payment or custody classification blocks that feature and any service dependent on it, without necessarily preventing a separately authorised service. (VARA Regulations 2023, Part IV.A.1; Investments and Securities Act 2025, s.61.) Each release should identify the approving entity, permitted customers and activities, evidence relied upon, and the person authorised to stop the path when a condition fails.