Nigeria's Securities and Exchange Commission has made it clear that virtual asset service providers, or VASPs, must operate within a defined regulatory framework or face significant consequences. For young founders building Web3 and crypto startups, understanding these obligations is not optional.
The SEC's Rules on Issuance, Offering Platforms and Custody of Digital Assets established the foundational compliance architecture. Under these rules, any entity facilitating the exchange, transfer, or custody of digital assets that qualify as securities must register with the Commission. This includes cryptocurrency exchanges, token issuance platforms, and custodial wallet providers.
Registration is not a one-off exercise. Registered VASPs are required to maintain minimum capital thresholds, submit periodic reports, and adhere to ongoing disclosure obligations. The SEC also mandates that digital asset offerings obtain prior approval before being marketed to the Nigerian public.
For early-stage startups, the Accelerated Regulatory Incubation Program, or ARIP, provides a structured pathway. ARIP allows fintech and virtual asset firms to operate under regulatory supervision while working towards full registration. Founders accepted into the programme must demonstrate a viable business model, robust internal controls, and a clear compliance roadmap. Failure to progress through ARIP milestones can result in expulsion and prohibition from operating.
The penalties for non-compliance are substantial. Operating as an unregistered VASP can attract monetary fines reaching millions of naira, depending on the severity and duration of the violation. The SEC also holds the power to suspend or revoke registrations, issue cease-and-desist orders, and refer matters for criminal prosecution where warranted. In some instances, the Commission has publicly warned the public against dealing with unregistered entities, causing irreversible reputational damage.
Beyond SEC rules, VASPs must contend with anti-money laundering and counter-terrorist financing obligations under the Money Laundering (Prevention and Prohibition) Act. This means implementing know-your-customer protocols, reporting suspicious transactions to the Nigerian Financial Intelligence Unit, and maintaining transaction records for prescribed periods. Non-compliance under the AML framework carries separate penalties, including custodial sentences for responsible officers.
Tax compliance is another critical dimension. The Federal Inland Revenue Service expects VASPs to register for tax purposes, charge applicable value-added tax where required, and remit withholding tax on relevant transactions. Digital asset transactions that generate income or capital gains are taxable events under Nigerian law, and founders who fail to account for these liabilities risk back taxes, interest, and penalties.
Founders should also note that regulatory attitudes continue to evolve. The Central Bank of Nigeria, which previously restricted banks from facilitating cryptocurrency transactions, has since signalled a more accommodative posture, particularly as the SEC's oversight framework matures. However, the regulatory perimeter remains tightly drawn, and ambiguity in certain areas persists.
Legal and compliance counsel is essential from the earliest stages. Engaging with the SEC's dedicated fintech and innovation desk can help founders determine whether their activities fall within the regulatory perimeter and what steps are needed to achieve compliance. The cost of proactive compliance is invariably lower than the cost of enforcement action.
