VASP Licensing Nigeria: How Crypto Businesses Meet Requirements & Get Approved

Key Takeaways

• Nigeria’s SEC now issues a formal VASP licensing Nigeria for any crypto‑related service.
• Applicants need at least N500million in paid‑up capital and a local office with a resident director.
• Two pathways exist: the traditional full registration and the Accelerated Regulatory Incubation Program (ARIP).
• Comprehensive AML/KYC controls, seven‑year record keeping, and regular SEC reports are mandatory.
• Understanding the step‑by‑step process saves months of back‑and‑forth with regulators.

Crypto firms eager to serve Nigeria’s 200million‑plus population now face a clear, but demanding, regulatory gate: the VASP license. The Securities and Exchange Commission (Securities and Exchange Commission Nigeria’s securities regulator that oversees virtual asset service providers) launched the regime after the Investments and Securities Act 2025 officially classified cryptocurrencies as securities. Below is a practical guide that walks a crypto startup from the moment it decides to enter the Nigerian market to the point where it can legally trade, custody, or issue digital assets.

What Exactly Is a VASP License?

A Virtual Asset Service Provider an entity authorized to offer services such as exchange, custody, token issuance, mining, staking, airdrops, and crypto‑based payments license authorizes companies to conduct any of the listed activities within Nigeria. Without it, firms operate in a legal grey area and are barred from accessing traditional banking services, which severely limits growth.

Who Needs a VASP License?

Any business that touches a virtual asset for its core offering must apply. Typical candidates include:

• Cryptocurrency exchanges - platforms that match buyers and sellers.
• Digital‑wallet providers - custodial services storing private keys for users.
• Token issuers - projects launching utility or security tokens.
• Mining farms and staking services - entities that validate transactions or lock assets for rewards.
• Payment processors - merchants accepting crypto in exchange for fiat.

Even a one‑off airdrop or a small‑scale mining hobby can trigger licensing if the activity is regular and revenue‑generating.

Financial & Corporate Foundations

The first hurdle is proving financial robustness. The SEC mandates a minimum paid‑up capital N500,000,000 (about $325,000) that must be fully paid before the license is granted. This capital acts as a safety net for customer funds and signals market seriousness.

Next, the business must be incorporated through the Corporate Affairs Commission Nigeria’s corporate registration authority that issues certificates of incorporation and monitors company status. Required documents include:

• Certificate of Incorporation.
• Memorandum and Articles of Association (MEMART).
• Latest audited financial statements or, for a brand‑new firm, a CPA‑prepared statement of affairs.
• Proof of a physical office and a resident director (a Nigerian citizen or legal resident).

Without a local office, the SEC will reject the application-remote‑only models common in some jurisdictions simply aren’t allowed here.

Operational Compliance: AML, KYC, and Record‑Keeping

Compliance is where most startups run into trouble. The SEC’s rules, reinforced by the Central Bank of Nigeria (Central Bank of Nigeria Nigeria’s monetary authority that issues guidelines for anti‑money‑laundering and financial stability), demand a dual‑layer approach:

• Anti‑Money Laundering procedures to detect and prevent the use of the financial system for illicit purposes controls that meet FATF standards.
• Know Your Customer processes to verify the identity of every user before allowing transactions protocols, including biometric or document verification.

All customer data-identity documents, transaction logs, and communication records-must be stored for at least seven years. Regular suspicious‑activity reports go to the Financial Intelligence Unit (FIU) and the SEC.

Two Licensing Pathways: Standard vs. ARIP

Recognizing that a full license can take 12‑18 months, the SEC created the Accelerated Regulatory Incubation Program (Accelerated Regulatory Incubation Program a fast‑track route that grants provisional approval while the applicant finalizes full compliance). Below is a side‑by‑side view.

Step‑By‑Step Application Process

1. Prepare corporate documents. Gather the CAC certificate, MEMART, audited accounts, and proof of office.
2. Set up AML/KYC infrastructure. Deploy a compliance software that can capture ID, run sanctions checks, and retain logs for seven years.
3. Capital verification. Open a dedicated Nigerian bank account, deposit the full N500M, and obtain a bank‑issued capital confirmation letter.
4. Draft risk‑management policies. Include investor protection, conflict‑of‑interest, and cyber‑security measures that align with SEC Technology Risk Management guidelines.
5. Submit the application. Fill the SEC online portal, upload all documents, and pay the non‑refundable filing fee (N5million).
6. SEC review. The regulator typically requests clarifications within 30 days; be ready to provide additional technical specs or staffing details.
7. Receive provisional approval. If you chose ARIP, you’ll get a “approval in principle” and can start limited operations while finalizing the full package.
8. Full license issuance. After satisfying all conditions (full capital proof, resident director sworn undertakings, final AML/KYC audit), the SEC issues the VASP license valid for five years, renewable upon compliance review.

Ongoing Obligations After You’re Licensed

Getting the license is only half the battle. Ongoing duties include:

• Quarterly compliance reports to the SEC detailing transaction volumes, AML alerts, and any regulatory breaches.
• Annual audited financial statements filed with both the SEC and the CAC.
• Sworn undertakings from the director or company secretary confirming adherence to the Investment and Securities Act 2025.
• Regular technology risk assessments-penetration testing, patch management, and data‑privacy impact assessments.
• Prompt reporting of any suspicious activity to the FIU and the SEC within 48 hours of detection.

Practical Tips & Common Pitfalls

Below are real‑world lessons from firms that have already walked the path:

• Local partnership wins. International teams that partnered with a Nigerian shareholder or hired a seasoned compliance officer avoided the resident‑director bottleneck.
• Don’t skimp on tech. The SEC’s cyber‑security checklist is strict; a basic firewall gets rejected. Budget at least 8% of your capital for security tools.
• Plan for eight‑year record storage. Cloud storage in a Nigerian data center satisfies both residency and retention rules.
• Keep a buffer. The SEC can demand additional capital or staff levels on a case‑by‑case basis. Having 10‑15% extra cash eases negotiations.
• Stay updated. The SEC releases supplemental guidance every quarter. Subscribe to their official mailing list to avoid surprise compliance changes.

Future Outlook

The VASP framework is still evolving. The SEC’s sandbox allows early adopters to test new services-like DeFi lending or NFT marketplaces-under supervised conditions. Expect clearer rules on cross‑border transfers and possibly a tiered capital requirement that differentiates simple wallet providers from high‑risk exchange operators. For crypto firms, staying agile and maintaining a strong compliance culture will turn regulatory rigor into a market advantage, signalling trust to Nigerian users and global partners alike.