How do you get a VASP licence in Nigeria?

You register with the Securities and Exchange Commission, and the route open today is the Accelerated Regulatory Incubation Programme. It costs ₦200,000 to be assessed and ₦2,000,000 to process your application, both non-refundable. What you get is an approval-in-principle. It isn't a full licence. Fourteen firms hold one, and none has completed full registration.

Do you actually need a VASP licence in Nigeria?

If you run an exchange, a wallet, an on-ramp or an off-ramp for Nigerians, yes. The Investments and Securities Act 2025 names virtual asset service providers and digital asset operators as businesses the SEC registers, and section 61 makes operating in the capital market without registration an offence carrying a fine of not less than ₦5,000,000 or five years.

The rule reaches further than a Nigerian company. The SEC's own ARIP framework applies to foreign operators that actively target Nigerian investors, so blocking sign-ups after the fact isn't a strategy. It also applies to you whether or not you hold the customer's money: what matters is the activity, not the custody.

What it means for you: if your product converts naira into crypto or crypto into naira for someone else, you are in scope, and the question is which registration you need rather than whether you need one. For the wider legal picture, start with what the rules say about crypto in Nigeria, and for the two routes side by side, our guide to building a crypto on-ramp in Nigeria walks through both.

Which regulator do you go to, the SEC or the CBN?

Both, for different things, and a Presidential Executive Order of 17 July 2026 drew the line. Securities activity goes to the SEC. Payment, settlement and custody services for virtual assets that aren't securities go to the Central Bank of Nigeria. The order creates a coordinating council chaired by the CBN rather than a new regulator, and it doesn't move powers between agencies.

That line matters most if you are building a naira on-ramp or off-ramp rather than an exchange. The CBN's regulatory sandbox runs a dedicated virtual asset track, and its published list of eligible activities names fiat on and off-ramp services, stablecoin issuance, digital wallet infrastructure and custody. It also admits startups and technology companies that hold no financial licence at all, which no other route does.

Two things to hold on to. The CBN says sandbox participation isn't a licence and doesn't authorise you to operate outside the agreed test. And the sandbox portal still advertises its second cohort as open, while reporting at the time put the application window as 12 to 31 August 2026, so check the current position before you plan around it.

What does ARIP cost, and what do you have to file?

Two fees, both non-refundable: ₦200,000 for the initial assessment and ₦2,000,000 to process the application. On top of that the SEC wants evidence of your required shareholder funds and a current fidelity bond covering at least 25% of them, and it can impose further financial requirements case by case.

The filing itself has to go through a registered solicitor or adviser, and then through the SEC's own portal. What the framework asks for:

1. Forms SEC 2 and 2D for a minimum of four sponsored individuals, who must include your managing director and your compliance officer
2. Certified corporate documents from the Corporate Affairs Commission
3. A tax identification number and a tax clearance certificate
4. The national identity number and bank verification number of every sponsored individual
5. Your operational plan and business model, plus your rules on investor protection, conflicts of interest and appeals
6. Sworn undertakings on the accuracy of what you have filed, your solvency, the fitness and propriety of your officers, and running an orderly and transparent market
7. A no-objection letter from any other regulator that covers you
8. Evidence of registration with the Nigerian Financial Intelligence Unit

You also need to be incorporated in Nigeria with an office here. Getting it wrong is expensive: the framework sets a penalty of not less than ₦5,000,000 plus ₦200,000 for every day of default, and ₦20,000,000 for running a commercialised virtual asset service with no authorisation at all.

How long does it take, and has anyone finished?

The SEC's own programme page says an approval-in-principle arrives in weeks rather than months. The record says otherwise. ARIP opened in June 2024, the first two approvals went to Busha and Quidax in August 2024, and in the twenty-six months since, no firm has moved from approval-in-principle to full registration.

The programme itself has grown. Seven firms were admitted on 2 July 2026, two more days later, and three more on 12 August 2026, which takes the roster to fourteen. Every one of them holds the same conditional status. The SEC puts it plainly in its own circulars: an approval-in-principle confirms that an entity has met the admission requirements for the programme, and it isn't a final licence.

Senator Ihenyen, executive chair of the Stakeholders in Blockchain Technology Association of Nigeria, described the position to TechCabal as moving at a snail's pace. Busha told the same reporter it had been engaging with the SEC as part of the transition toward full licensing. Plan your runway against twenty-six months and counting, not against weeks.

What can you not do while you are in ARIP?

You cannot grow much. Paragraph 29(d) of the ARIP framework caps your customer base at 10% above where it stood when you entered the programme. Paragraph 29(a) stops you doing any securities or investment business beyond what you presented in your application, and paragraph 39 says the programme cannot be used to get around a regulatory requirement.

What it means for you: a 10% ceiling on customers is the single hardest fact to plan around in the whole process, and it is the one almost nobody writes about. If your model needs to multiply users to work, ARIP won't let you prove it while you are in there. Read those three paragraphs before you spend ₦2.2m on the application.

Will a bank open an account for you before you are registered?

This is the part that catches people, and the public record leaves it unsettled. The CBN's guidelines on bank accounts for virtual asset service providers, dated 22 December 2023, require evidence of a valid licence issued by the SEC before a bank can open you a designated account. Nobody holds a full SEC licence yet, which leaves whether a bank accepts an approval-in-principle as a question to put to the bank in writing.

The same guidelines supersede the February 2021 circular that told banks to stop serving crypto businesses, so that restriction is no longer the position. Banks still cannot hold or trade virtual currencies on their own account. And the operating constraints on your designated account are tighter than most founders expect:

• Transactions on your platform have to be in naira
• You cannot be given a NUBAN account
• A customer can move naira from their position on your platform into their own bank account no more than twice a quarter
• You have to post collateral equal to 150% of your highest net debit position over the past ten days
• No cash withdrawals, and no third-party cheque clearing

That twice-a-quarter limit shapes product design more than any fee does, so read it before you promise a customer instant withdrawals.

Can you build on a licensed provider's rails instead of registering?

The SEC hasn't answered this, and that's the honest state of it. The ARIP framework says nothing about agents, white-label arrangements or operating under someone else's registration, and the provisions nearest to the question are restrictive rather than permissive. The leading practitioner guide for Nigeria contradicts itself inside one document, describing white-labelling without independent registration as unauthorised in one section and as available in another.

So this is a question for a Nigerian capital markets lawyer before you build, not a gap you can fill with an assumption either way. What you can do in the meantime is separate the two decisions: the registration question is about what you are allowed to offer, and the integration question is about what you would have to build if you were allowed.

Where does the Daya API fit?

The Daya API is the money movement half of that split. It documents naira collection, stablecoin on-ramps and off-ramps, USD virtual accounts and payouts across four separate API sets at docs.daya.co, with a full sandbox on simulated money, so a team can build and test the whole flow while a ₦2.2m SEC application is still being assessed.

Two things to be clear about. The four API sets are separate integrations rather than one, so building on the money movement doesn't hand you the trading or equities side as well. And nothing about an integration answers the registration question above, which belongs to your own counsel and your own regulator conversations.

Where the Daya API isn't the answer: it has no hosted checkout widget, no multi-country African rails and no mobile money, so if your product needs those, look at providers that have them. We put the field side by side in naira on-ramp and off-ramp APIs, compared. What it's good for is the specific job of turning naira into dollars on chain and back, documented and priced before you commit.

Do you have to register with SCUML?

Probably not, and this is where most guides get it wrong. The Money Laundering (Prevention and Prohibition) Act 2022 defines a virtual asset service provider inside its definition of a financial institution, and SCUML's statutory job is to register designated non-financial businesses and professions. On the face of the Act, a VASP isn't one of those.

The SEC's own checklist agrees. It asks for evidence of registration with the Nigerian Financial Intelligence Unit and never mentions SCUML. What the Act does require of you, as a financial institution:

• Report any single transaction above ₦5,000,000 for an individual or ₦10,000,000 for a company within seven days
• Report a suspicious transaction in writing within 24 hours
• Report any transfer to or from another country above 10,000 dollars to the NFIU, the CBN and the SEC within one day
• Appoint compliance officers at management level at your head office and at every branch

Take advice on the SCUML question rather than taking it from a blog, including this one. The point worth carrying into that conversation is that the requirement the SEC actually imposes on the record is NFIU registration.

What would the new SEC rules change?

A lot, and they are the reason not to plan a filing on today's figures alone. The SEC exposed a new rulebook on 20 August 2026 covering digital and virtual asset operations, custody and markets, with comments due two weeks later. It has not been finalised. Reported figures put minimum capital for an exchange or a custodian at ₦2bn against the ₦500m in force, and a virtual asset service provider at ₦200m.

Two independent readings of the draft disagree on the retail trading platform category, one putting it at ₦500m and the other at ₦1bn, so treat the per-category numbers as a direction of travel rather than a figure to budget against. The registration fee is reported at ₦30m across the categories, unchanged in substance from the rules in force.

Other proposals worth knowing about: custodians holding at least 80% of client assets in cold storage, foreign stablecoins needing SEC recognition and a local representative, a chief executive resident in Nigeria, and cybersecurity incidents reportable to the SEC within 24 hours.

What should you do first?

Four steps, in this order, and the first one is free:

1. Work out which regulator covers what you are building. If it is a naira on-ramp or off-ramp rather than an exchange, read the CBN sandbox's virtual asset track before you read anything from the SEC
2. Read paragraph 29 of the ARIP framework, the 10% customer cap, and decide whether your model survives it
3. Ask your bank in writing whether it will open a designated account on an approval-in-principle. The answer changes your timeline more than any fee does
4. Take advice on the SCUML question and on whether you can operate under another firm's registration. Both are unsettled on the public record

None of this is quick, and the twenty-six-month record says the slow part isn't your paperwork. Budget for it, and build the integration in a sandbox while you wait. Our hub on on-ramps and off-ramps for developers in Africa covers what you would be building.