Summary
The Investments and Securities Act 2025 gives SEC direct power over virtual and digital asset exchanges, virtual asset service providers, custodians and digital asset operators. An operator carrying on Nigerian capital-market business without registration faces criminal and administrative exposure. (Investments and Securities Act 2025, ss 3(3)(b), 3(3)(i), 61, 355(1)(n), 357.)
SEC’s 2 July 2026 notice clears Bitbarter, Luno, GetEquity, Koinkoin, Wrapped CBDC, Trovotech and Blockvault for ARIP admission. The notice says each would receive conditional Approval-in-Principle and states that AIP is not a final licence. (SEC, “SEC Clears Seven New Fintech Firms for Admission into the Accelerated Regulatory Incubation Programme,” 2 July 2026.)
The Presidency’s published account of the Presidential Executive Order on Virtual Assets Coordination, 2026 creates a Virtual Asset Council and Virtual Asset Office. It allocates securities-like activity to SEC and non-security payment, settlement, custody and related services to CBN, while preserving each agency’s statutory powers. (State House, “President Tinubu Signs Executive Order on Virtual Assets, Establishes Council to Harmonise Regulation of Digital Economy,” 17 July 2026.)
CBN Cohort 2 provides a live testing route for fiat-backed stablecoin payments, issuance models, wallets, custody, on-ramps, off-ramps and payment-token exchanges. Sandbox admission permits supervised testing within stated limits and gives no permanent operating authority. (CBN Regulatory Sandbox, Cohort 2, 2026.)
A stablecoin business may require concurrent SEC and CBN engagement. The answer turns on issuance terms, investment features, payment use, custody, fiat conversion, settlement, redemption and the entity serving Nigerian users.
Virtual asset service providers are financial institutions under the Money Laundering (Prevention and Prohibition) Act 2022. They also face transaction-level tax returns, customer-data duties and tax registration under the Nigeria Tax Administration Act 2025. (Money Laundering (Prevention and Prohibition) Act 2022, ss 3–11, 30; Nigeria Tax Administration Act 2025, s 25 and Fifth Schedule.)
SEC’s revised capital schedule requires ₦2 billion for a Digital Assets Exchange and ₦2 billion for a Digital Assets Custodian by 30 June 2027. Incubation precedes the capitalised production route; later registration remains necessary. (SEC, Revised Minimum Capital for Regulated Capital Market Entities, 16 January 2026.)
Statutory route for virtual and digital assets
Nigeria’s central securities statute now names virtual-asset activity directly. Section 3(3)(b) of the Investments and Securities Act 2025 authorises SEC to register and regulate virtual and digital asset exchanges. Section 3(3)(i) covers virtual asset service providers, custodians and digital asset operators. Section 357 includes virtual and digital assets within the Act’s definition of securities. Section 355(1)(n) permits rules concerning digital and virtual asset services. (Investments and Securities Act 2025, ss 3(3)(b), 3(3)(i), 355(1)(n), 357.)
Section 61 supplies the production threshold. A person may not operate in the Nigerian capital market or carry on investment and securities business without registration. A breach carries a fine of at least ₦5 million, imprisonment for at least five years, or both. SEC may also consider registration after an appropriate penalty and satisfaction of its conditions. (Investments and Securities Act 2025, s 61.)
The SEC Rules on Issuance, Offering Platforms and Custody of Digital Assets remain material. Their scope includes trading, exchange, transfer, custody and other virtual-asset services. It also reaches foreign issuers and foreign operators that actively target Nigerian investors. A VASP must maintain a Nigerian office, meet conduct and control duties, and obtain another sector regulator’s no-objection where applicable. A Digital Asset Exchange needs SEC clearance before admitting a token for trading. (SEC Rules on Issuance, Offering Platforms and Custody of Digital Assets, 11 May 2022, Part D rr 1–5; Part E r 23.)
Those Rules cite the repealed Investments and Securities Act 2007. Section 356 of the 2025 Act preserves prior regulations, orders, notices, circulars and authorisations to the extent they remain consistent with the new Act. The 2022 Rules therefore continue to supply the operating detail, subject to later SEC instruments and any inconsistency with the 2025 Act. (Investments and Securities Act 2025, s 356.)
Nigeria’s route is consequently layered. The Act establishes SEC jurisdiction, the 2022 Rules identify regulated functions, ARIP allows controlled entry, and later registration is required for production. A firm must classify each function before treating one approval as covering the full product.
ARIP status and transition to full registration
SEC’s July 2026 notice places seven named firms inside the accelerated incubation route. The notice says each firm would receive AIP, allowing operation within ARIP’s defined scope and SEC conditions. It also states that AIP is not a final licence. The legal consequence is conditional supervised activity, with production authority dependent on continued compliance and later registration. (SEC, “SEC Clears Seven New Fintech Firms for Admission into the Accelerated Regulatory Incubation Programme,” 2 July 2026.)
The ARIP checklist applies to services offered in or to Nigeria by local or foreign firms. It calls for Nigerian incorporation, a resident chief executive or managing director, an initial assessment, a formal application and eventual full registration. The applicant must provide any required sector-regulator no-objection, evidence of NFIU registration, AML/CFT/CPF controls, travel-rule capability, risk controls, reporting arrangements and an exit plan. SEC may restrict activities, customer growth and communications during incubation. (SEC, Accelerated Regulatory Incubation Programme Checklist for VASP Onboarding, 25 May 2025.)
The checklist states a ₦2 million processing fee. It also states sanctions for default and unauthorised operation. Those administrative terms must be read with the 2025 Act because the checklist still cites section 38 of the repealed 2007 Act. Section 356 supports continuity only where the earlier instrument is consistent with the current Act.
The SEC directory lists Busha and Quidax as ARIP participants performing Digital Asset Exchange functions. That official description should control over a company’s use of “licensed.” ARIP participation proves supervised admission without proving unrestricted production authority, approval of every product or completion of full registration. (SEC, Registered FinTech Operators, accessed 13 August 2026.)
SEC also imposes material capital requirements. SEC’s January 2026 schedule sets ₦2 billion for a Digital Assets Exchange and ₦2 billion for a Digital Assets Custodian. A Digital Assets Offering Platform and Real-world Assets Tokenization and Offering Platform face ₦1 billion floors. A Digital Assets Intermediary and Digital Assets Platform Operator face ₦500 million floors, while an Ancillary VASP faces ₦300 million. Compliance is due by 30 June 2027. Failure may lead to suspension or withdrawal of registration. (SEC, Revised Minimum Capital for Regulated Capital Market Entities, 16 January 2026.)
Executive coordination and the regulator boundary
The Presidency announced the Presidential Executive Order on Virtual Assets Coordination, 2026 on 17 July 2026. The published account says the President signed the Order under section 5 of the Constitution and that it takes immediate effect. It creates a Virtual Asset Council chaired by CBN, with NRS and SEC as vice-chairs, plus NFIU and ONSA membership. It also creates a Virtual Asset Office at CBN for information sharing, applications and reporting. (State House, “President Tinubu Signs Executive Order on Virtual Assets, Establishes Council to Harmonise Regulation of Digital Economy,” 17 July 2026.)
The same account states that the Order creates no new regulator and transfers no statutory power. It assigns securities-like activity to SEC. CBN receives payment, settlement, custody and related services involving non-security virtual assets. The Council resolves unclear allocations. The allocation creates a coordination procedure while retaining the Acts that define each agency’s powers.
A material classification tension remains. Section 357 of the Investments and Securities Act 2025 includes virtual and digital assets within “securities.” The Presidency’s account separately recognises non-security virtual assets for CBN registration. The accessible instruments do not state a complete test for separating those categories. The Council’s allocation process must therefore reconcile token form, contractual rights, economic use and each regulated service with the Act.
The Presidency directed the Council to produce a Harmonised Implementation Framework within 30 days. That period had not expired on 13 August 2026. No authenticated signed or gazetted copy of the full Order, final implementation instrument or Virtual Assets White Paper was located in the available official record. The published State House account establishes the stated coordination points. The missing texts prevent reliance on unstated procedures, deadlines or exemptions.
Payment, settlement and custody route
CBN’s official reform register confirms that it issued Guidelines on Operations of Bank Accounts for Virtual Asset Service Providers on 22 December 2023. The official record confirms a CBN instrument governing the bank-account interface for VASPs. The authenticated full text was unavailable from the official host during this review. A production plan must retrieve the current document before relying on account-opening, settlement, withdrawal or bank-conduct terms. (CBN, Reforms and Initiatives, entry dated 22 December 2023.)
CBN Cohort 2 now gives payment-focused products a specific testing entry point. The VASP Track covers fiat-backed stablecoin payments, stablecoin issuance models, virtual-asset payments, wallet infrastructure, custody, token products, fiat on-ramps, off-ramps and stablecoin or payment-token exchanges. Applicants must show live-test readiness, AML/CFT/CPF controls, consumer safeguards, cyber controls and incident-reporting capability. Stablecoin applications may require reserve, disclosure, liquidity, redemption and risk documentation. (CBN Regulatory Sandbox, Cohort 2, 2026.)
Sandbox admission remains confined to approved users, volumes, exposure and duration. CBN states that admission is not a permanent licence and does not replace another regulator’s approval. A firm with an SEC-facing exchange or investment function and a CBN-facing payment or custody function should plan for parallel engagement, coordinated conditions and separate exit decisions.
Stablecoin classification and regulatory overlap
A stablecoin label does not determine the Nigerian route. Regulators must examine the holder’s rights and the operator’s acts. Issuance against reserves, a redemption promise, investment or yield rights, exchange listing, custody, wallet control, fiat conversion and settlement can engage different statutory mandates.
SEC jurisdiction is strongest where a token, platform or arrangement falls within securities business, an investment contract, a digital asset exchange, a custody function or another capital-market service. The 2025 Act’s definition and direct VASP powers make an assumption of SEC irrelevance unsafe. SEC’s no-objection requirement also anticipates concurrent sector supervision. (Investments and Securities Act 2025, ss 3, 61, 357; SEC Digital Asset Rules 2022, Part D.)
CBN jurisdiction is strongest where the product performs payment, settlement or store-of-value functions, or where the operator controls a fiat rail, wallet, custody arrangement, redemption flow or on-ramp. The July 2026 executive announcement and Cohort 2 portal expressly place those functions within CBN’s current work. Sandbox admission identifies the responsible testing channel, with permanent authorisation still reserved.
A firm that only integrates third-party stablecoins still requires a function map. The relevant questions include who receives fiat, who exchanges it, who holds private keys, who owes redemption, who bears reserve loss, who settles the merchant and which entity contracts with the user. A white-label API cannot remove the regulated act performed by the underlying entity or the distributor.
A Nigerian application package should present one product map to SEC and CBN. It should classify the token, cash flow, custody chain, reserve and redemption terms, customer groups, geographic reach and outsourcing model. Written allocation or no-objection decisions reduce the risk that each regulator assumes an undisclosed function sits elsewhere.
AML, tax and national-security obligations
The Money Laundering (Prevention and Prohibition) Act 2022 defines VASPs as financial institutions. That classification brings customer due diligence, beneficial-ownership checks, suspicious-transaction reporting, recordkeeping, internal controls and other statutory duties. A suspicious transaction must be reported immediately, followed by the prescribed written report within 24 hours. International transfers above the statutory US$10,000 equivalent threshold also trigger reporting. (Money Laundering (Prevention and Prohibition) Act 2022, ss 3–11, 30.)
The Nigeria Tax Administration Act 2025 adds transaction-level reporting for a VASP engaged in exchange, custody or management. Section 25 requires service, date, asset type and value, sales value, customer identity and tax data, plus counterparty information. The Fifth Schedule requires tax registration, customer records, periodic reports, a SCUML certificate and at least seven years of transaction and identification records. (Nigeria Tax Administration Act 2025, s 25 and Fifth Schedule.)
The Fifth Schedule states a 48-hour suspicious-activity deadline, while section 7 of the 2022 money-laundering statute requires the report immediately and the written report within 24 hours. An operator should use the shorter 24-hour process unless NFIU and NRS issue a binding reconciliation. That process can satisfy the longer tax deadline without delaying the AML report.
The Nigeria Tax Act 2025 taxes profits or gains from digital-asset transactions. It treats digital or virtual assets as chargeable assets and ring-fences related losses against digital-asset profits. It also places incorporeal property, including digital assets, in Nigeria where the holder of direct or indirect beneficial ownership, control or interest is Nigerian-resident or connected to a Nigerian permanent establishment. (Nigeria Tax Act 2025, ss 4(1)(j), 27(7), 28(3)(b)(iv), 34(1)(a), 46(n).)
Section 109 of the Nigeria Tax Administration Act sets a ₦10 million penalty for the first month of VASP default and ₦1 million for each later month. SEC suspension or licence revocation is an alternative statutory consequence. The tax statute therefore links data compliance to operating status. (Nigeria Tax Administration Act 2025, s 109.)
The Nigeria Revenue Service published Information Circular No. 2026/21, Guidelines on the Taxation of Virtual Assets, on 31 July 2026, and has notified taxpayers and virtual asset service providers by public notice that it is available for download on the Service's official website. Its detailed computation and filing directions were not retrieved for this review and are not treated as controlling here. The statutes remain the basis for the tax analysis.
NFIU and ONSA membership in the Virtual Asset Council places financial intelligence and national-security review inside the coordination process. The published executive account gives them no replacement licensing mandate. Their participation places transaction traceability, sanctions screening, source-of-funds controls, incident escalation and shared supervisory data within the coordinated review.
Cross-border infrastructure and territorial limits
Quidax states that its infrastructure supports more than 21 countries and at least 14 currencies. Its described products include local-currency ramps, wallets, trading, collections, settlement and stablecoin APIs. Those are company statements dated July 2026. They support an inference that Nigerian-origin infrastructure is being offered for multi-country payment use, subject to confirmation of actual volumes, counterparties and legal entities. (Quidax, “What Is Quidax Digital Assets Infrastructure and What It Means for Your Business,” 22 July 2026.)
The company statements do not establish a licence in each named country. They also do not establish the identity of each fiat partner, reserve custodian, stablecoin issuer, contracting entity or redemption obligor. Nigerian SEC status cannot substitute for local payment, foreign-exchange, remittance, custody, consumer, AML, tax or data approvals.
None of the Nigerian instruments reviewed creates an African regulatory passport. A multi-country service must classify the local act in each market: issuance, exchange, custody, wallet provision, payment acceptance, merchant settlement, remittance, liquidity or technology supply. The result may depend on whether a locally licensed partner performs the regulated act and whether the customer contracts with that partner.
Nigeria retains a territorial claim over foreign operators that actively target Nigerian investors under the SEC Digital Asset Rules. A foreign entity therefore cannot treat offshore incorporation as an answer where promotions, direct communications or services reach Nigeria. The Nigerian entity and the foreign service chain should be assessed together. (SEC Digital Asset Rules 2022, Part D r 1.)
Practical market-entry sequence
A market-entry project should start with a legal-entity and function map. The map should identify the issuer, exchange, custodian, wallet operator, liquidity provider, fiat collector, settlement entity, redemption obligor and customer-facing distributor. It should also show each cash and token movement.
The applicant should then submit the SEC initial assessment and identify the proposed operator class. The likely classes include DAX, Digital Assets Custodian, DAOP, DAPO, Digital Assets Intermediary or Ancillary VASP. The application should request any required no-objection and state which functions will enter CBN Cohort 2.
Corporate and control work follows. The business needs Nigerian incorporation, resident management, fit-and-proper personnel, ownership disclosure, adequate capital, NFIU or SCUML onboarding, travel-rule capability, sanctions screening, transaction monitoring, cyber controls, complaints handling and an orderly exit plan. Reserve-backed products also need documented asset segregation, valuation, reconciliation, attestation, liquidity and redemption procedures.
Tax implementation must operate at transaction level. Systems should capture the data required by section 25 of the Nigeria Tax Administration Act, preserve records for seven years and apply the Nigeria Tax Act’s income, gain, loss and situs rules. The reporting process should use the 24-hour AML deadline for suspicious transactions.
A production launch should remain conditional until each function has a named regulator, an application or authorisation basis, a compliant bank-settlement arrangement, tested reserve and redemption controls, and an approved deployment plan for every country served.
