Dual-regulated fintech: CBN oversees payments; SEC regulates VASPs via ARIP
Nigeria's fintech and payments sector operates under a dual-regulatory framework. The Central Bank of Nigeria (CBN) supervises payment service providers, banks, and remittance operators under the Banks and Other Financial Institutions Act (BOFIA), 2020, enforcing strict operational, security, and data localisation standards. The Securities and Exchange Commission (SEC) regulates Virtual Asset Service Providers (VASPs) and capital market operators, utilizing the Accelerated Regulatory Incubation Programme (ARIP) for conditional licensing and market entry.
Recent regulatory direction emphasizes systemic stability, consumer protection, and transparency. The CBN has mandated Ultimate Beneficial Ownership disclosure, data localisation, and integration with the Nigeria Revenue Service Transaction Monitoring System. Simultaneously, the SEC has increased minimum capital requirements for capital market operators and actively enforces against unregistered entities, while the CBN implements rigorous cybersecurity and fraud prevention measures, including guidelines for Authorised Push Payment fraud.
Central Bank of Nigeria (CBN)
Primary supervisor for banks, payment service providers, remittance operators, and financial holding companies.
[1][2][3]Securities and Exchange Commission (SEC)
Regulator for capital market operators, VASPs, and investment service providers; administers the ARIP sandbox.
[4][5][6]Banks and Other Financial Institutions Act (BOFIA) (2020)
The primary legislation governing the licensing, operation, and supervision of banks and other financial institutions, including provisions for suspension of payment obligations and regulatory oversight.
[1]Investments and Securities Act (ISA) (2007)
Establishes the SEC's mandate to regulate capital market operators and protect investors; unregistered entities operating under this act are subject to enforcement actions.
[7]Payment Service Provider (PSP) / Bank
Requires CBN licensing; operators must comply with market structure requirements, data localisation, and UBO disclosure. Integration with NRS TMS is mandatory.
[2][8]Virtual Asset Service Provider (VASP)
VASPs must obtain Approval-in-Principle (AIP) for admission into the SEC's Accelerated Regulatory Incubation Programme (ARIP) to operate in a controlled sandbox.
[4][5]Capital Market Operator (CMO)
Requires SEC registration and pre-registration training/examination. Revised minimum capital requirements are in effect with a compliance deadline of June 30, 2027. Capital: Revised thresholds apply (specific amounts not listed in source) Timeline: Compliance by June 30, 2027
[6][9]Mandatory data localisation and Ultimate Beneficial Ownership disclosure for all licensed payment operators. Cross-border transaction caps may apply under market structure requirements.
[2]Strict enforcement against unregistered entities; the SEC and CBN regularly issue alerts against fraudulent or unregistered platforms (e.g., CBEX, AfriquantumX).
[10][11]International Money Transfer Operators (IMTOs) must use designated Naira settlement accounts with Authorized Dealer Banks and align pricing with real-time Bloomberg rates.
[12][13]Regulators are deepening oversight through mandatory integration with tax monitoring systems (NRS TMS) and enhanced cybersecurity frameworks, including specific guidelines for Authorised Push Payment fraud.
[8]The SEC is actively expanding the ARIP sandbox to onboard more fintechs and VASPs, indicating a structured path to formal regulation for digital asset firms.
[4][5]Email alerts for Nigeria updates
New circulars, rules and guidance — a digest in your inbox, same day.