VASP Licensing in Nigeria: A Complete Guide for Crypto Businesses (2026)

Remember when you could just launch a crypto exchange in Nigeria and hope the banks didn’t freeze your accounts? Those days are gone. Since the passage of the Investments and Securities Act 2025, which formally recognized cryptocurrencies as securities under the jurisdiction of the Securities and Exchange Commission (SEC) of Nigeria, the landscape has shifted dramatically. If you are running or planning to run a crypto business in Africa’s largest economy, you need a Virtual Asset Service Provider (VASP) license. Without it, you aren’t just operating in a gray area; you are likely breaking the law.

This isn’t just about getting a stamp on a piece of paper. It is about surviving in a market that now demands institutional-grade compliance. The regulatory framework positions Nigeria as one of the few African nations with explicit, structured licensing requirements for digital assets. This guide breaks down exactly what you need to know to navigate this new reality, from the hefty capital requirements to the fast-track options available for startups.

Who Needs a VASP License?

The definition of who needs a license has expanded significantly. Under the previous unregulated peer-to-peer environment, many operators flew under the radar. Now, the SEC’s net is wide. If your business involves any of the following activities, you fall under the VASP umbrella:

• Cryptocurrency Exchange Operations: Platforms facilitating the trading of digital assets for fiat currency or other cryptocurrencies.
• Digital Wallet Custody Services: Providing secure storage solutions for users’ private keys and assets.
• Token Issuance: Creating and distributing security tokens or utility tokens.
• Mining Activities: Operating mining rigs or providing mining-as-a-service.
• Staking Operations: Offering staking services where users lock up assets to support network operations.
• Airdrop Distributions: Managing large-scale distribution events of tokens.
• Crypto-Based Payment Processing: Enabling merchants to accept cryptocurrency for goods and services.

If your company touches any of these areas, the SEC expects oversight. The goal is to bring the entire virtual asset ecosystem-from the miner to the trader-under formal regulatory scrutiny to prevent fraud and money laundering.

The Financial Barrier: Capital Requirements

Let’s talk numbers because this is where many small players get filtered out. The SEC wants financially stable entities, not fly-by-night operations. To apply for a standard VASP license, you must demonstrate a minimum paid-up capital of N500,000,000 (Five Hundred Million Naira). As of mid-2024, this equated to roughly $325,000 USD, but you should always check current exchange rates as the Naira fluctuates.

This requirement serves two purposes. First, it ensures you have enough buffer to handle operational shocks or customer withdrawals without collapsing. Second, it signals serious intent. Beyond this cash injection, you need to prove your financial health through audited statements. If you are an existing company, submit your latest audited financial reports. If you are a newly established entity, you will need audited statements of affairs prepared by certified public accountants.

Corporate Structure and Documentation

You cannot be a sole proprietorship or an informal partnership. You must be a legally incorporated company registered with the Corporate Affairs Commission (CAC), the body responsible for company registration in Nigeria. Your documentation package needs to be pristine. Here is the checklist:

1. Certificate of Incorporation: Proof that your company exists legally.
2. Memorandum and Articles of Association (MEMART): The rulebook for how your company operates internally.
3. Current Status Report: Issued by the CAC, confirming your company is active and compliant.
4. Audited Financials: As mentioned above, proving your capital adequacy.
5. Organizational Chart: A clear hierarchy showing who reports to whom.
6. Physical Office Evidence: Lease agreements or ownership documents for a physical office in Nigeria.

Note the physical office requirement. The SEC insists on local presence. You need a director who is resident in Nigeria managing this office. This rule effectively blocks international companies from remotely serving the Nigerian market without establishing a tangible local footprint.

Operational Compliance: AML and KYC

Having the money and the papers is only half the battle. The SEC, in tandem with the Central Bank of Nigeria (CBN), which oversees monetary policy and banking regulations, demands rigorous Anti-Money Laundering (AML) and Know Your Customer (KYC) protocols. These aren’t optional suggestions; they are mandatory safeguards.

Your systems must identify and verify every customer. No anonymous transactions allowed. You need ongoing monitoring capabilities to flag suspicious activities, such as rapid movement of funds or transactions linked to high-risk jurisdictions. Furthermore, you must maintain comprehensive customer records for a minimum of seven years. This includes transaction histories, identity verification documents, and even communication records. Why seven years? Because that aligns with international standards set by the Financial Action Task Force (FATF), the global money laundering and terrorist financing watchdog.

You also need to register with Nigerian tax authorities. The government is keen on capturing revenue from the crypto sector, aiming to grow tax collection from under 10% of GDP toward an 18% target by 2027. Your VASP license is essentially a ticket to participate in this formalized economy, but it comes with the responsibility of reporting suspicious transactions to financial intelligence units regularly.

The Fast Track: Accelerated Regulatory Incubation Program (ARIP)

If the N500 million requirement feels daunting before you’ve even launched, there is a lifeline: the Accelerated Regulatory Incubation Program (ARIP), designed by the SEC to help emerging virtual asset entities. This program allows qualified entities to obtain preliminary approval in principle, letting them commence operations under SEC oversight while they work toward full registration.

To qualify for ARIP, you must meet specific criteria:

• Be legally incorporated with a clear corporate structure.
• Maintain a Nigerian office with a Chief Executive Officer or Managing Director resident in the country.
• Be actively engaged in securities and investment business.
• Have pending virtual asset-related applications with the SEC or be seeking registration.

The ARIP process is structured over 12 months. You file an initial application, commit to program conditions, and begin incubation. You submit quarterly progress reports. At the 10-month mark, you receive regulatory guidance. By month 12, you either exit the program with instructions for full registration or cease operations if you haven’t met the benchmarks. It’s a sandbox approach that allows regulators to learn alongside you, reducing the risk of immediate failure.

Risk Management and Technology Standards

The SEC doesn’t just care about your books; they care about your tech stack. You must present a comprehensive business model with a unique value proposition. But more importantly, you need detailed risk management protocols tailored to virtual assets. This includes internal rules covering investor protection, conflict of interest policies, and dispute resolution frameworks.

Your technology infrastructure must comply with SEC Technology Risk Management requirements. This means robust cybersecurity protocols, data protection measures, and system resilience planning. Think about this: if your platform gets hacked, do you have the technical resources to recover? Do you have insurance? You need to demonstrate sufficient human and technological resources through staffing plans and technical specifications. If you operate in other regulated sectors, you’ll also need letters of no objection from those relevant regulators.

Why This Matters for Your Business

Before 2025, the Central Bank of Nigeria had restricted bank services to crypto businesses, creating a hostile environment. The new VASP regime flips this script. Licensed firms can access traditional banking services. They gain legitimacy and consumer confidence. However, this clarity comes at a cost. Compliance expenses are high. Industry observers predict these costs will be passed on to users through higher fees, potentially squeezing margins for smaller platforms.

For international platforms, the choice is binary: get licensed or leave. The requirement for resident directors and physical offices means you can’t just serve Nigeria from London or Dubai. You need local hiring, local partnerships, and local accountability. This reshapes the competitive landscape, favoring well-capitalized players who can afford the overhead.

Next Steps for Applicants

If you are ready to pursue a VASP license, start by auditing your current corporate structure against the CAC requirements. Ensure your paid-up capital meets the threshold. Then, build your compliance team. You need experts in AML/KYC, cybersecurity, and Nigerian securities law. Engage with the SEC early, especially if you are considering the ARIP route. Document everything meticulously. In this new era, transparency is your most valuable asset.