VASP Licensing in Nigeria: Requirements and Process for Crypto Businesses
David Wallace 22 January 2026 12

Before 2025, running a crypto business in Nigeria was like driving without a license - everyone did it, but no one was officially allowed to. The Central Bank had blocked banks from serving crypto firms, and the SEC stayed quiet. That changed with the Investments and Securities Act 2025. Now, if you’re operating any virtual asset service in Nigeria - whether it’s exchange, wallet custody, staking, or even airdrops - you need a VASP license from the Securities and Exchange Commission. No exceptions. No gray areas. This isn’t a suggestion. It’s the law.

What Exactly Is a VASP?

A Virtual Asset Service Provider (VASP) is any company that handles digital assets on behalf of others. That includes:

  • Cryptocurrency exchanges (buying, selling, trading BTC, ETH, etc.)
  • Digital wallet providers (custodial wallets where users store crypto)
  • Token issuance platforms (launching new coins or tokens)
  • Staking services (helping users earn rewards by locking crypto)
  • Airdrop distributors (managing token giveaways)
  • Crypto payment processors (enabling merchants to accept digital assets)

Even if you’re just running a simple peer-to-peer trading platform, if Nigerian users are involved, you’re a VASP. And under the new law, you must be licensed. The SEC doesn’t care if you’re based in Lagos, London, or Singapore. If your service touches Nigerian customers, you play by Nigerian rules.

Minimum Capital Requirement: N500 Million

This is the biggest hurdle for most startups. To apply for a VASP license, you need a minimum paid-up capital of N500,000,000 (about $325,000 USD). That’s not a deposit. That’s real, verified cash in your company’s bank account, fully paid in. No loans. No promises. No creative accounting.

This requirement isn’t arbitrary. The SEC wants to make sure only serious players with deep pockets enter the market. It’s meant to filter out fly-by-night operators who might disappear with user funds. For comparison, some countries like Singapore or Switzerland have similar capital thresholds, but Nigeria’s is among the highest in Africa. Smaller firms or bootstrapped startups often can’t meet this. Many have had to seek investors, merge with larger entities, or pivot to non-regulated services like non-custodial tools.

Corporate Registration and Physical Presence

You can’t register as a VASP unless you’re a legally incorporated Nigerian company. That means:

  • Registration with the Corporate Affairs Commission (CAC)
  • Submission of Memorandum and Articles of Association (MEMART)
  • Current status report from CAC (no outstanding penalties or filings)

But here’s the twist: your company must have a physical office in Nigeria. Not a PO box. Not a co-working space you rent for a day. A real office with a fixed address, staff, and operational infrastructure. And the CEO or Managing Director must be a resident director - someone physically living and working in Nigeria. This isn’t just a formality. It’s about accountability. If something goes wrong, regulators need to be able to knock on your door.

Financial and Operational Documentation

Applying for a VASP license isn’t a quick form-fill. You’re submitting a full dossier. Here’s what you need:

  • Latest audited financial statements (or audited statements of affairs for new companies)
  • Detailed business model explaining how your service works and why it’s unique
  • Comprehensive KYC and AML procedures - including how you verify identities, monitor transactions, and flag suspicious activity
  • Customer protection policies - how you handle disputes, refunds, and complaints
  • Conflict of interest policies - especially if you’re running both exchange and wallet services
  • Technical infrastructure specs - server locations, encryption standards, backup systems
  • Cybersecurity plan - aligned with SEC’s Technology Risk Management guidelines
  • Staffing plan - names, roles, and qualifications of key personnel
  • Financial projections for the next 3 years

Every document must be signed, stamped, and certified. Missing one item? Your application gets returned. No second chances. No extensions. You start over.

A Nigerian director signs a legal undertaking surrounded by compliance documents under the watchful eye of an SEC inspector.

Anti-Money Laundering and Record Keeping

The SEC doesn’t just want your paperwork. They want proof you’re actually doing the work. That means:

  • Every customer must be verified with government-issued ID, proof of address, and biometric checks where possible
  • Transaction monitoring systems must flag unusual patterns - large transfers, rapid deposits/withdrawals, multiple accounts linked to one IP
  • All records - KYC documents, transaction logs, chat histories, email correspondence - must be kept for seven years
  • You must report suspicious activity to the Nigerian Financial Intelligence Unit (NFIU) within 24 hours
  • You must register with the Federal Inland Revenue Service (FIRS) and file regular tax returns

These aren’t optional. The SEC works closely with the Central Bank of Nigeria (CBN) and NFIU. If you fail an audit, you could face fines, suspension, or outright license revocation. In 2025, three unlicensed platforms were shut down after their customers reported missing funds. Their records? Incomplete. Their compliance? Nonexistent.

The Accelerated Regulatory Incubation Program (ARIP)

Not everyone can meet the full requirements right away. That’s where ARIP comes in. It’s a 12-month pilot program designed for startups that are serious but not yet ready for full licensing.

To join ARIP, you need:

  • Legal incorporation with CAC
  • A Nigerian office with a resident director
  • Clear intent to operate in the virtual asset space
  • Submission of preliminary documentation

Once accepted, you can start operating under SEC supervision - but you’re not fully licensed yet. You must submit quarterly progress reports. At the 10-month mark, the SEC reviews your performance and gives you feedback. At 12 months, you either:

  • Apply for full VASP license (if you’ve met all requirements)
  • Shut down operations (if you haven’t)

ARIP isn’t a loophole. It’s a training ground. Many companies use it to build systems, hire compliance staff, and get their finances in order. But if you’re using it to delay compliance, the SEC will catch you.

Sworn Undertakings and Legal Liability

Before your license is issued, a company director or secretary must sign a sworn undertaking. This isn’t just a signature. It’s a legal promise under Nigerian law that you will:

  • Comply with the Investments and Securities Act 2005
  • Follow all SEC rules and regulations
  • Submit all required returns on time
  • Not engage in fraudulent or misleading practices

Break this promise? You’re not just risking your license. You’re risking criminal prosecution. The SEC can refer cases to the Nigerian Police Force and the Economic and Financial Crimes Commission (EFCC). There have already been arrests for operating unlicensed exchanges.

A startup team celebrates ARIP approval with holographic milestones as an unlicensed exchange is erased by digital enforcement.

What Happens If You Don’t Apply?

Some crypto firms thought they could keep operating quietly. They were wrong.

Since January 2025, Nigerian banks have been instructed to freeze accounts linked to unlicensed VASPs. Payment gateways like Flutterwave and Paystack now block transactions to unregistered platforms. Google and Apple removed unlicensed crypto apps from their stores. Even social media ads for crypto services are now monitored - and taken down if they don’t show a valid license number.

The result? Over 70 unlicensed platforms have shut down. Many founders left Nigeria. Others pivoted to non-custodial services - like decentralized wallets or peer-to-peer tools where users control their own keys. But if you’re holding user funds, you’re regulated. No way around it.

Who Benefits From This System?

At first glance, this looks like a heavy burden. And it is. Compliance costs have doubled or tripled for many firms. Fees for users have gone up. But the long-term effects are positive.

Legitimate businesses now have access to bank accounts, legal contracts, and investor funding. Customers feel safer knowing their platform is regulated. The government is collecting more tax revenue - targeting an 18% tax-to-GDP ratio by 2027. And Nigeria is becoming a model for other African countries. Ghana, Kenya, and South Africa are watching closely, preparing their own frameworks.

The VASP license isn’t just a permit. It’s a stamp of credibility. In a market that once had dozens of shady crypto schemes, it’s now separating the serious players from the scammers.

What’s Next?

The SEC is still refining the rules. In 2026, they’re expected to release:

  • Guidance on cross-border transactions (how to handle users outside Nigeria)
  • Clarification on DeFi protocols and whether they count as VASPs
  • Updates to cybersecurity standards as hacking threats evolve
  • Potential adjustments to capital requirements based on feedback

If you’re serious about operating in Nigeria, don’t wait. Start building your compliance stack now. Hire a local legal advisor. Get your financials in order. Set up your Nigerian office. Train your team. The window for informal operation is closed. The new era is here - and it’s licensed.

Do I need a VASP license if I only trade crypto for myself?

No. Personal trading - buying, selling, or holding crypto for your own account - doesn’t require a VASP license. The law only applies to businesses that provide services to others. If you’re not holding funds for clients, running an exchange, or offering custody, you’re not a VASP.

Can a foreign company apply for a VASP license in Nigeria?

Yes, but only if it establishes a local subsidiary registered with the Corporate Affairs Commission (CAC). Foreign entities cannot apply directly. You must incorporate a Nigerian company with a resident director and physical office. Many international firms set up wholly-owned Nigerian subsidiaries to meet this requirement.

How long does the VASP licensing process take?

If you have all documents ready, the SEC typically takes 4 to 6 months to process a complete application. Incomplete submissions can delay this significantly. The ARIP program can get you operational in 4-8 weeks, but full licensing still requires the full 12-month incubation period and final review.

What happens if my VASP license is revoked?

If your license is revoked, you must immediately cease all VASP activities. You’re required to return all user funds, notify customers, and submit a final report to the SEC. Failure to comply can result in asset freezes, criminal charges, and bans from operating in Nigeria. The SEC may also publish your name on its website as a non-compliant entity.

Are NFTs and DeFi protocols covered under VASP rules?

NFTs are covered if they’re sold or traded as investment contracts - meaning they promise returns or profits based on others’ efforts. DeFi protocols are still under review. If a platform acts as an intermediary - like a lending pool that holds user funds and auto-executes trades - it may be classified as a VASP. The SEC is expected to issue formal guidance on this in 2026.