Young founders building in Nigeria's Web3 and cryptocurrency space are facing a regulatory landscape that demands careful attention to compliance, with the Securities and Exchange Commission (SEC) now actively supervising Virtual Asset Service Providers (VASPs) under its expanded digital asset rules.
The SEC formally brought digital assets within its regulatory perimeter through the Rules on Issuance, Offering Platforms and Custody of Digital Assets, first published in May 2022 and subsequently amended. These rules classify virtual asset services — including exchange operations, custody, and offering platforms — as activities requiring registration or approval from the Commission.
For startup founders, the immediate takeaway is that operating a VASP without proper authorisation carries real consequences. Under the Investments and Securities Act (ISA) 2007, the SEC possesses broad enforcement powers, including the ability to impose administrative fines, suspend or revoke licences, and refer matters for criminal prosecution. Penalties can run into millions of naira, and in serious cases, custodial sentences may apply.
The Commission introduced the Accelerated Regulatory Incubation Programme (ARIP) to provide a structured pathway for fintech and crypto firms to operate under supervision while working toward full registration. Founders are expected to apply for ARIP admission, meet capital adequacy requirements, implement anti-money laundering and counter-terrorism financing (AML/CFT) controls, and submit to ongoing reporting obligations.
Beyond SEC requirements, VASPs must also contend with the Nigeria Data Protection Act, tax registration with the Federal Inland Revenue Service (FIRS), and corporate filings with the Corporate Affairs Commission (CAC). The Central Bank of Nigeria, which previously restricted banks from servicing crypto businesses, lifted that prohibition in December 2023, opening the door for compliant VASPs to access the formal banking system.
Industry observers note that many early-stage Web3 founders underestimate the cost and complexity of compliance. Registration fees, legal costs, audit requirements, and ongoing compliance staffing can place significant strain on bootstrapped startups. Yet the cost of non-compliance — including reputational damage, frozen bank accounts, regulatory shutdown orders, and personal liability for directors — is substantially higher.
The SEC has signalled through recent enforcement guidance that ignorance of the rules will not be accepted as a defence. Founders who launched projects during the period of regulatory uncertainty are particularly advised to seek legal counsel and engage proactively with the Commission to regularise their operations.
