VASP Licensing in Nigeria: Requirements and Process for Crypto Businesses

If you are running a crypto business in Nigeria, the days of operating in a regulatory gray zone are officially over. The landscape has shifted dramatically with the passage of the Investments and Securities Act 2025. This legislation formally recognizes cryptocurrencies as securities, placing them squarely under the jurisdiction of the Securities and Exchange Commission (SEC) Nigeria. For any company offering services involving virtual assets-whether that’s an exchange, a wallet provider, or a mining operation-you now need a license. Specifically, you need to register as a Virtual Asset Service Provider (VASP).

This isn't just paperwork; it's a comprehensive compliance regime designed to bring order to the market. While this brings legal clarity and legitimacy, it also comes with strict financial and operational hurdles. Getting this wrong can mean heavy fines or being shut down entirely. Let’s break down exactly what you need to do to get licensed, the costs involved, and how to navigate the process efficiently.

Who Needs a VASP License?

First, let’s define who falls under this new rule. If your business interacts with digital assets in any capacity, you likely need a license. The SEC has cast a wide net. The following activities require formal registration:

• Cryptocurrency Exchanges: Platforms that facilitate trading between users or between fiat currency and crypto.
• Digital Wallet Custody Services: Any service holding private keys on behalf of customers.
• Token Issuance: Companies creating and selling utility tokens or security tokens.
• Mining Operations: Entities engaged in proof-of-work or other mining activities.
• Staking Services: Platforms allowing users to stake assets for rewards.
• Airdrop Distributions: Organized distribution of free tokens to promote projects.
• Crypto-Based Payment Processing: Using crypto for everyday transactions or merchant payments.

If you are doing peer-to-peer (P2P) lending or informal swaps without a platform, you might be flying under the radar, but scaling up means you will hit these regulatory walls immediately. The goal is to eliminate anonymous, unregulated transactions.

Financial and Corporate Requirements

The barrier to entry is significant. The SEC wants to ensure that only financially stable entities operate in this space. Here are the hard numbers and structural requirements you must meet before you even submit your application.

Minimum Capital Requirement: You must demonstrate a minimum paid-up capital of N500,000,000 (Five Hundred Million Naira). As of recent exchange rates, this is approximately $325,000 USD. This is not a suggestion; it is a mandatory threshold to prove solvency and ability to handle market volatility.

Corporate Structure: Your entity must be legally incorporated in Nigeria with the Corporate Affairs Commission (CAC). You cannot operate as a foreign entity without a local presence. You will need to provide:

• Certificate of Incorporation.
• Memorandum and Articles of Association (MEMART).
• A current Status Report from the CAC confirming your active standing.

Physical Presence: You must maintain a physical office in Nigeria. Furthermore, at least one director or the Chief Executive Officer/Managing Director must be a resident of Nigeria. This requirement ensures accountability and allows regulators to hold someone locally responsible if things go wrong.

Financial Statements: Existing companies must submit their latest audited financial statements. If you are a newly established entity, you must provide audited statements of affairs prepared by certified public accountants. This proves you have the resources to back your claims.

Operational Compliance: AML and KYC

Money laundering and terrorist financing are major concerns for regulators globally, and Nigeria is no exception. Your VASP license is contingent on robust Anti-Money Laundering (AML) and Know Your Customer (KYC) protocols. These aren't just checkboxes; they are ongoing operational mandates.

You must implement systems that prevent anonymous transactions. Every user on your platform must be identified and verified. This involves collecting government-issued IDs, biometric data where applicable, and verifying addresses. You need ongoing monitoring capabilities to detect suspicious patterns in real-time.

Record Retention: You are required to maintain comprehensive customer records for a minimum of seven years. This includes transaction histories, identity verification documents, and communication logs. When the SEC asks for data, you need to produce it instantly. Failure to keep these records is a direct violation of the law.

Tax Registration: You must register with Nigerian tax authorities. The government sees crypto as a taxable asset class. You will need to submit regular reports on suspicious transactions to relevant financial intelligence units and cooperate fully with tax audits.

Documentation and Risk Management

Beyond capital and structure, the SEC needs to see how you plan to run the business safely. Your application package must include detailed operational frameworks. Here is what you need to prepare:

1. Business Model: A clear description of your value proposition. Why does your service exist? How does it differ from competitors? The SEC wants to see a sustainable business, not a speculative gamble.
2. Risk Management Protocols: Detailed plans for managing market risk, credit risk, and operational risk. How do you protect funds during a hack? What happens if liquidity dries up?
3. Internal Rules: Policies covering investor protection, conflict of interest, customer protection, and dispute resolution. How do you handle a customer complaint? Who decides?
4. Technology Infrastructure: Evidence of sufficient technical resources. This includes cybersecurity protocols, data protection measures, and system resilience planning. You must comply with SEC Technology Risk Management standards.
5. Staffing Plans: Details on your team. Do you have qualified personnel to manage compliance, technology, and operations?

If you operate in other regulated sectors (like traditional banking or insurance), you must provide letters of no objection or approval from those respective regulators. This prevents regulatory arbitrage.

The Application Pathways: Standard vs. ARIP

There are two ways to get your VASP license. Choosing the right path depends on your current status and readiness.

The Standard Path: This is the traditional route. You submit all documents, undergo rigorous review, and receive your license. It is best for companies that already have their infrastructure, capital, and compliance teams in place.

The ARIP Path: Designed for innovation, this program allows you to obtain preliminary approval in principle. You can commence operations under SEC oversight while you complete the remaining registration requirements. To qualify, you must be legally incorporated, have a Nigerian office with a resident CEO/MD, and be actively engaged in securities business. The program lasts 12 months. You submit quarterly reports. At the 10-month mark, you receive specific regulatory guidance. By month 12, you either transition to full registration or cease operations if you haven’t met the criteria. This is a great option for startups that want to test the market but need more time to perfect their compliance framework.

Sworn Undertakings and Ongoing Oversight

Getting the license is only the beginning. You must provide sworn undertakings demonstrating your commitment to ongoing SEC oversight. A director or company secretary must sign a document pledging compliance with all applicable SEC Rules and Regulations and the Investment and Securities Act 2005 (as amended by the 2025 Act).

You commit to maintaining proper records and rendering regular returns to the SEC. The regulator reserves the right to impose additional requirements on a case-by-case basis. This flexibility means the rules can adapt as new technologies emerge. You need to stay agile and monitor regulatory updates closely.

Challenges and Strategic Considerations

Navigating this framework is complex. You are dealing with multiple agencies: the SEC for securities, the Central Bank of Nigeria (CBN) for financial services guidelines, the CAC for corporate registration, and tax authorities for fiscal compliance. Coordination between these bodies can be slow.

The requirement for resident directors may challenge international platforms. You might need to hire local executives or form partnerships with Nigerian entities to meet this criterion. Additionally, the technology infrastructure requirements demand significant investment in cybersecurity. Budget for high-end security solutions, data encryption, and regular penetration testing.

Compliance costs are rising. Industry experts predict these costs will be passed on to users through higher fees. However, the trade-off is legitimacy. Licensed operators benefit from consumer confidence and access to traditional banking services, which were previously restricted by the CBN. This creates a competitive advantage for compliant players over illicit actors.

Next Steps for Your Business

If you are serious about operating in Nigeria, start by auditing your current setup against the N500 million capital requirement. Engage with local legal counsel specializing in securities law. Prepare your KYC/AML infrastructure early, as this is often the most time-consuming part of the process. Decide whether the ARIP program suits your timeline. Finally, budget for ongoing compliance costs, including reporting, audits, and potential regulatory consultations. The era of wild west crypto is over; the era of professional, regulated finance has begun.