VASP Licensing in Nigeria: Complete Guide to Requirements and Process for Crypto Businesses

The landscape for cryptocurrency businesses in Nigeria has shifted dramatically. If you are running a crypto exchange, wallet service, or token issuance platform, the days of operating in a regulatory gray area are over. The Securities and Exchange Commission (SEC) is now the primary regulator, enforcing strict rules under the Investments and Securities Act 2025. To operate legally, your company must obtain a Virtual Asset Service Provider (VASP) license. This isn't just paperwork; it’s a comprehensive framework designed to bring crypto operations into the formal financial system.

Failing to comply doesn’t just mean fines. It means being shut down. Conversely, getting licensed gives you access to banking services that were previously restricted by the Central Bank of Nigeria (CBN). Here is exactly what you need to know about the requirements, costs, and process to get your VASP license in Nigeria.

What Activities Require a VASP License?

You might think only exchanges need licenses. That is no longer true. The SEC’s definition of a Virtual Asset Service Provider is broad. Under the current regulations, any entity engaging in the following activities must be licensed:

• Cryptocurrency exchange operations (trading pairs)
• Digital wallet custody services (holding user funds)
• Token issuance and initial coin offerings (ICOs)
• Mining operations and staking services
• Airdrop distributions
• Crypto-based payment processing

If your business touches any of these areas, you fall under the SEC’s jurisdiction. The law treats cryptocurrencies as securities. This classification changes everything from how you market your tokens to how you handle customer disputes.

Financial and Corporate Requirements

The barrier to entry is high, intentionally so. The SEC wants to ensure that only financially stable entities can operate in this space. Before you even think about submitting an application, you need to meet specific corporate and financial thresholds.

The N500 million capital requirement is non-negotiable. You must prove this money is paid-up and available. For new companies, you will need audited statements of affairs. Existing companies must provide their latest audited financial statements. This ensures you have the buffer to absorb potential losses or security breaches without collapsing.

You also need a solid corporate structure. The SEC requires a clear hierarchy. You cannot run this operation from a laptop in another country. You must have a physical office in Nigeria, and at least one director or the Chief Executive Officer must be a resident of the country. This local presence is crucial for accountability.

The Accelerated Regulatory Incubation Program (ARIP)

Gathering all the documentation and meeting every single requirement before you start operating can take months. To speed things up, the SEC introduced the Accelerated Regulatory Incubation Program (ARIP). This is a pathway for startups and smaller entities to begin operations under supervision while they complete full registration.

Here is how ARIP works:

1. Initial Application: You file for ARIP status instead of full registration.
2. Preliminary Approval: You receive approval in principle to start limited operations.
3. Incubation Period: You operate under strict SEC oversight for 12 months.
4. Quarterly Reports: You submit progress reports every three months.
5. Final Decision: At month 10, you get guidance on your final status. By month 12, you either get full registration or must cease operations.

To qualify for ARIP, you still need to be incorporated with CAC, have a Nigerian office, and have a resident CEO. It is not a free pass, but it allows you to generate revenue and build your team while you finalize compliance.

Operational Compliance: AML, KYC, and Security

Getting the license is step one. Keeping it is step two. The operational requirements are rigorous because the SEC is worried about money laundering and terrorist financing. Your systems must be bulletproof.

Know Your Customer (KYC): You cannot allow anonymous transactions. You must implement robust identity verification systems. Every user must be verified before they can trade or hold assets. You need to collect and store identity documents, proof of address, and other relevant data.

Record Retention: You must keep detailed records of every transaction, every customer interaction, and every internal communication related to virtual assets for a minimum of seven years. This aligns with international standards set by the Financial Action Task Force (FATF).

Suspicious Activity Reporting: Your system must monitor for unusual patterns. If something looks off-like rapid transfers of large amounts or transactions linked to sanctioned entities-you must report it immediately to the relevant financial intelligence units.

Cybersecurity: The SEC has specific Technology Risk Management requirements. You need to demonstrate that your infrastructure is secure. This includes firewalls, encryption, multi-factor authentication, and regular penetration testing. You must show that you have a plan for data breaches and system failures.

Documentation Checklist for Your Application

When you are ready to apply, whether through the standard route or ARIP, you need to submit a thick packet of documents. Missing even one minor form can delay your application by weeks. Here is what you need to prepare:

• Certificate of Incorporation from the Corporate Affairs Commission (CAC).
• Memorandum and Articles of Association (MEMART) showing your company’s legal structure.
• Current Status Report from CAC confirming your active status.
• Audited Financial Statements or statements of affairs.
• Business Plan detailing your value proposition, target market, and revenue model.
• Risk Management Protocol specifically tailored to virtual assets.
• KYC Procedures document explaining how you verify users.
• Internal Rules covering investor protection, conflict of interest, and dispute resolution.
• Staffing Plan showing you have enough qualified personnel.
• Technical Infrastructure Specifications proving your tech stack meets security standards.
• Sworn Undertakings from directors promising to comply with SEC rules.

If you already operate in other regulated sectors (like traditional finance), you may need letters of no objection from those regulators. The SEC wants to know you are clean everywhere else first.

Why This Matters for Your Business

Before 2025, many crypto businesses in Nigeria struggled to open bank accounts. The Central Bank of Nigeria had issued directives restricting banks from servicing crypto firms. This forced companies to operate in the shadows, using peer-to-peer networks or offshore accounts.

The VASP licensing regime changes this dynamic. Once you are licensed by the SEC, you have legal clarity. Banks are more likely to work with you because you are compliant. You can advertise openly. You can offer better services because you aren’t afraid of sudden shutdowns.

However, there is a cost. Compliance is expensive. You need lawyers, accountants, cybersecurity experts, and dedicated compliance officers. These costs will likely be passed on to your users in the form of higher fees. But in exchange, you get legitimacy. In a market where trust is scarce, being a licensed VASP is a massive competitive advantage.

The government also sees this as a way to boost tax revenues. With proper oversight, they can track transactions and ensure taxes are paid. This supports broader fiscal goals, including increasing tax collection as a percentage of GDP. For businesses, this means a more stable long-term environment, provided you stay on the right side of the law.

Next Steps for International Companies

If you are an international crypto platform looking to enter Nigeria, you cannot just set up a website and start accepting users. You must incorporate locally. You must hire local staff. You must establish a physical presence. This might seem like a hurdle, but it signals commitment to the market.

Consider partnering with local legal experts who specialize in securities law. The regulations are complex and evolving. What works today might change tomorrow. Having a local advisor helps you navigate the nuances of CAC registration, SEC filing, and tax authority requirements.

Also, evaluate your technology stack. Does it meet the SEC’s risk management standards? If not, budget for upgrades. Don’t wait until you are under scrutiny to fix security gaps. Start building your compliance culture from day one.