What Crypto Operators Must Know to Stay Legal in Nigeria

Nigeria’s Crypto Landscape Has Changed With New Regulations to Govern Virtual Asset Service Providers — Are You Ready?

Between 2023 and 2025, Nigeria’s regulatory landscape for cryptocurrency shifted dramatically. The Central Bank of Nigeria lifted its crypto ban. The SEC rolled out virtual asset service provider (VASP) rules. ISA 2025 redefined digital assets and defined “commodities” to include digital assets. In other words, Nigeria’s SEC is serious about regulating the cryptocurrency space in Nigeria in order to provide more clarity on their operations. These reforms brought long-awaited clarity—but also new risks for operators in the crypto space in Nigeria.

If you’re running a crypto platform in Nigeria—whether it’s an OTC desk, a WhatsApp-based exchange, or a DeFi-style interface—compliance is no longer optional. It’s mandatory, as your platform is now under the SEC’s regulatory purview.

This article unpacks the current legal environment and maps out what your crypto business must do to stay legal and sustainable in Nigeria.

The Legal Backbone — Understanding ISA 2025’s Position on Digital Assets

Digital Assets Now Defined as “Securities” and “Commodities”

The Investment and Securities Act, 2025 (ISA 2025) defines digital assets as both securities and commodities. This dual classification expands regulatory coverage of the SEC. If you’re facilitating trades, issuing tokens, or hosting a custodial wallet, you are no longer in a legal grey zone. You are now fully regulated by the SEC, with laws backing their regulation. This is regulation with teeth.

What Is a Securities Exchange Under ISA 2025?

Section 26 of ISA 2025 bar anyone from establishing or operating a securities exchange in Nigeria without SEC registration and stipulates penalties the SEC can impose for non-compliance, which includes halting the operations of the Exchange, monetary sanctions, and prosecution of the directors of the company operating such Exchange. Section 27 of ISA 2025 Act defines a securities exchange broadly as any platform—physical or digital—that matches buyers and sellers of securities, commodities, or digital assets qualifies. That includes WhatsApp-based OTC desks and other OTC desks on other social media platforms like Telegram and Instagram that facilitate such transactions.

Thus, if your platform settles crypto-to-naira trades, whether via a physical location or through the Internet, you may already be in violation of ISA 2025—without knowing it.

SEC Oversight — The Rise of the VASP Licensing Framework

SEC’s 2022–2025 Rulemaking on Virtual Assets

The SEC introduced its digital assets rulebook in 2022 titled: New Rules on Issuance, Offering Platforms and Custody of Digital Assets and began onboarding VASPs through a Regulatory Incubation Program (ARIP). These rules cover:

Exchanges
Wallet providers
Custodial platforms
Token issuers

These Rules were now solidified through the ISA 2025, giving the SEC statutory backing to regulate cryptocurrency [which is encompassed under the definition of Digital Assets under the Act] and regulate the operators that offer such trades. As such, Crypto businesses must now register with the SEC or risk enforcement, as the SEC now has statutory power to regulate the operations of VASPs in Nigeria.

Who Needs a VASP License? (And Who Doesn’t)

If your platform matches orders, converts crypto to fiat, or holds assets for users—you need a VASP license. This includes even those operating under tech or fintech labels and those operating OTC desks virtually through social media platforms like WhatsApp, Telegram and Instagram. Given the unbordered spread of the Internet, it is nearly impossible for such platforms to stay under the radar, as the SEC can track, find and penalize them for failure to comply with regulations in the cypto space…which is now being more tightly regulated than before.

The Central Bank of Nigeria’s Role — The Return of Banked Crypto, With Conditions

The CBN 2023 Circular That Changed Everything

In December 2023, the CBN lifted its ban on crypto-related transactions through its circular dated December 22, 2023, with number FPR/DIR/PUB/CIR/002/003, directed to Banks and other Financial Institutions in Nigeria. The import of that circular is that Banks can now service crypto firms—but only if they are licensed by the SEC. Banks must create designated accounts for VASPs, must conduct extensive KYC specifically specified for such accounts and monitor all flows in/through such accounts. Furthermore, such accounts can only be opened through the approval of senior management in the Banks. Crypto firms must be transparent.

Risks of Operating Outside CBN Protocol

Using personal or unrelated business bank accounts for crypto payments is risky as Banks can freeze such accounts given that they are not designated accounts specifically opened in line with applicable CBN orders. Additionally, your account activities can flagged to the Nigeria Financial Intelligence Unit [NFIU]. Once flagged, you may be blacklisted across the financial system. Many operators try to operate around CBN protocols by insisting that customer transactions must NOT, under any circumstances have description quotes that include the term “crypto” or related terminology that ]might be flagged. While this provides a measure of safeguard, it is still risky, as some transactions may fall through chinks in operations, get flagged, and the operator penalized.

AML/CFT & Data Compliance — The Twin Pillars You Can’t Ignore

NFIU Registration and SAR Obligations

Crypto operators are Reporting Entities under (section 30 – under Financial Institutions – of) Nigeria’s 2022 Money Laundering Act. As a crypto operator, you are required to:

Register with the NFIU
File Suspicious Activity Reports (SARs)
Monitor transactions
Classify clients by risk

Failing to file SARs or maintain transaction logs can attract fines or trigger enforcement.

Real-Life Pitfalls — Insights from a Crypto Compliance Audit

We recently audited a Nigerian crypto business operating via WhatsApp. The business had no licence, used personal bank accounts and unrelated business names for payments, collected KYC information from customers without a privacy policy framework, had no SAR log, no compliance officer, among other acts that would be considered serious violations under the CBN Protocol and ISA 2025. After auditing the company’s trail, we advised:

Filing a proper object clause with CAC
Registering with SEC as a VASP
Regularizing all payment channels
Implementing AML, NDPR, and digital risk controls

What’s interesting is that this particular situation is not an isolated case. It’s the norm with many cryptocurrency operators in Nigeria, given the previous lack of regulation in Nigeria, contradictory regulatory signals from both the CBN and SEC, and a general lack of encoded legislation governing their operations. The situation has changed, as even the CBN admits it is vital that crypto activities in Nigeria are regulated; the Money Laundering Act defines crypto operators as Financial Institutions for money laundering and transaction activities reporting purposes, and the SEC now has firm regulatory control over the activities of crypto operators in Nigeria.

What Crypto Operators Should Do Now — A Compliance Roadmap

Update CAC Objects to Reflect Virtual Asset Services

Onboard with the NFIU

Draft AML Manual and Integrate AML Reporting

Publish NDPR-Compliant Privacy Policy & Consent Flow and also monitor the volume of personal data of individuals collected so as to register with the NDPC if threshold is met

Transition to Verified Designated Bank Accounts

Secure Your Web Presence — SSL, Domain, Terms, Privacy

Each of these steps is legally anchored. None are optional.

Conclusion: Navigating Nigeria’s Regulatory Curve Is a Strategy — It is not a Shortcut or an Optional Requirement

Crypto businesses in Nigeria no longer operate in ambiguity. The law is catching up fast—and regulators are watching. Compliance is not a bureaucratic formality and there are no contradictory notes from CBN and SEC anymore – they are harmonizing regulatory compliance structures fast. It is your operational insurance against future sanctions.

At Kabbiz Legal & Advisory, we help virtual asset businesses build compliant structures, secure licenses, and future-proof their operations.

Need help with your compliance audit? Kabbiz Legal & Advisory is a leading commercial law firm in Nigeria with a thriving Cryptocurrency & Blockchain practice. Please reach out to us via contact@kabbizlegal.com for assistance.