Before 2025, running a crypto business in Nigeria was like driving without a license - technically illegal, but nobody was stopping you. Now, if you’re operating a cryptocurrency exchange, wallet service, staking platform, or even doing airdrops in Nigeria, you must have a VASP license from the Securities and Exchange Commission (SEC). There’s no gray area anymore. The Investments and Securities Act 2025 made it clear: virtual assets are securities, and anyone handling them is now a regulated financial institution.
What Exactly Is a VASP?
A Virtual Asset Service Provider (VASP) is any company that offers services involving digital assets. That includes buying, selling, or trading cryptocurrencies like Bitcoin and Ethereum. But it’s more than just exchanges. VASPs also cover:
- Digital wallet providers (custodial and non-custodial)
- Staking services where users earn rewards by locking up crypto
- Token issuance platforms (like ICOs or STOs)
- Crypto payment processors for merchants
- Mining operations with commercial scale
- Airdrop distribution platforms
If your business touches any of these, you’re a VASP under Nigerian law. And if you’re operating without a license? You’re breaking the law. The SEC has been actively shutting down unregistered platforms since late 2025.
Minimum Capital Requirement: N500 Million
This is the biggest hurdle for most startups. To even apply for a VASP license, you need N500,000,000 (about $325,000 USD) in paid-up capital. This isn’t a loan or a line of credit - it must be actual cash or assets fully owned by the company, verified by an auditor.
Why so high? The SEC wants to filter out fly-by-night operators. They’ve seen too many crypto firms disappear overnight after collecting user funds. This capital buffer ensures that even if things go wrong, the company can cover losses, refunds, or regulatory fines. For context, this requirement is higher than what’s needed in many EU countries and matches the financial stability standards of major financial hubs.
Small businesses or solo operators? Forget it. This rule alone eliminates 90% of informal crypto ventures. It’s not meant for hobbyists. It’s for institutions.
Corporate Structure and Physical Presence
You can’t register a VASP from a garage in Lagos or a co-working space in Abuja. The SEC requires:
- Legal incorporation with the Corporate Affairs Commission (CAC)
- A physical office in Nigeria - not a PO box, not a virtual address
- A director or managing officer who is a Nigerian resident
This means international crypto firms can’t just set up a website and serve Nigerian users. They must establish a local legal entity, hire a local director, and open a physical office. The SEC wants someone they can hold accountable - face to face.
Many foreign companies are partnering with Nigerian fintech firms or hiring local executives to meet this requirement. It’s not just a formality - it’s a strategic shift. Nigeria is building a domestic crypto industry, not just regulating foreign ones.
Documentation You Must Submit
The paperwork is intense. Here’s what you need to send to the SEC:
- Certificate of Incorporation from CAC
- Memorandum and Articles of Association (MEMART)
- Latest audited financial statements (or audited statements of affairs for new companies)
- Proof of physical office lease or ownership
- Details of all directors and key personnel (including CVs and background checks)
- A detailed business model explaining how your service works
- Full KYC and AML procedures - including how you verify identities and monitor transactions
- Technical infrastructure specs: cybersecurity systems, data encryption, backup protocols
- Internal rules covering investor protection, conflict of interest, and dispute resolution
- Sworn undertakings signed by directors committing to comply with SEC rules
Missing one document? Your application gets rejected. No second chances. The SEC doesn’t play around.
Two Paths to Licensing: Standard vs. ARIP
The SEC offers two ways to get licensed:
1. Standard Registration
This is the full route. You submit everything, wait 6-12 months for review, and if approved, you get your license. It’s slow, expensive, and requires full compliance from day one.
2. Accelerated Regulatory Incubation Program (ARIP)
This is the smarter option for startups. ARIP lets you start operating under SEC supervision before you’ve completed every requirement. Here’s how it works:
- Submit an initial application with your corporate docs and business plan
- Receive preliminary approval in principle
- Begin operations under SEC oversight - you can accept users and process transactions
- Submit quarterly progress reports
- At the 10-month mark, the SEC reviews your progress and gives feedback
- At 12 months, you either complete full registration or shut down
ARIP is designed for companies that are serious but still building their systems. It’s a sandbox with teeth. If you’re not making real progress, you’re out. But if you’re moving fast and following the rules? You can launch faster and avoid the long wait.
Compliance: KYC, AML, and Record Keeping
Once licensed, you’re not done. You’re now under constant watch. The SEC and Central Bank of Nigeria (CBN) require strict compliance with:
- Know Your Customer (KYC): You must verify every user’s identity using government-issued IDs, facial recognition, and live video checks. No exceptions.
- Anti-Money Laundering (AML): All transactions are monitored. Any unusual activity - large transfers, rapid deposits and withdrawals, or connections to blacklisted wallets - must be reported within 24 hours.
- Record Retention: You must keep all customer data, transaction logs, and communication records for seven years. That’s longer than most banks.
- Tax Compliance: You must register with the Federal Inland Revenue Service (FIRS) and report crypto income as taxable.
Failure to report suspicious activity? Fines up to N50 million. Repeated violations? License revoked. The SEC doesn’t just want compliance - they want proof of it.
Technology Requirements: Security Is Non-Negotiable
The SEC doesn’t just care about your paperwork. They care about your servers.
You must have:
- Multi-factor authentication for all staff and user accounts
- End-to-end encryption for data at rest and in transit
- Regular penetration testing by accredited cybersecurity firms
- Cold storage for 95% of customer crypto assets
- Disaster recovery plans with backup data centers
- System logs that can’t be altered
One licensed VASP lost its license in late 2025 after a hacker stole $12 million because they were using outdated software. The SEC said: “You didn’t meet the minimum security standard.” No appeal.
Why This Matters: The Bigger Picture
Nigeria isn’t trying to kill crypto. They’re trying to tame it.
Before 2025, the Central Bank banned banks from serving crypto firms. That forced users into risky peer-to-peer deals. Now, licensed VASPs can open bank accounts, access payment rails, and operate like real businesses. This has already brought in over $2 billion in new investment into Nigerian crypto firms.
But it’s not easy. The compliance costs are high. A mid-sized exchange now spends over $1.2 million a year just on compliance, security, and legal fees. Those costs are being passed to users - transaction fees are up 30% since licensing began.
Still, the benefits are real. Licensed platforms now have trust. Users feel safer. Investors are stepping in. And the government? They’re collecting taxes from a sector that was once invisible.
What Happens If You Don’t Get Licensed?
Unlicensed VASPs are being shut down. Bank accounts are frozen. Domains are seized. Executives are being investigated.
One major peer-to-peer platform, which had 800,000 users, was raided in January 2026. Their CEO was arrested for operating without a license. The SEC didn’t give a warning. They didn’t ask nicely. They acted.
If you’re still operating without a license, you’re playing Russian roulette with your business - and your freedom.
Final Thoughts
VASP licensing in Nigeria isn’t a hurdle. It’s a gate. And the gate is wide open - if you’re ready to play by the rules.
The requirements are tough. The paperwork is heavy. The costs are high. But the reward? Legitimacy. Access. Growth. And the chance to be part of Africa’s most advanced crypto regulatory system.
If you’re serious about building a crypto business in Nigeria, don’t try to bypass the system. Join it. Prepare. Invest. Comply. And get licensed - before it’s too late.
Can a foreign company get a VASP license in Nigeria without a local partner?
No. Foreign companies must incorporate a legal entity in Nigeria with a Nigerian resident director and a physical office. You cannot operate remotely. Most international firms partner with local fintech companies or hire Nigerian executives to meet these requirements.
Is the N500 million capital requirement flexible for startups?
No. The N500 million paid-up capital is non-negotiable. Even under the Accelerated Regulatory Incubation Program (ARIP), you must still meet this requirement before receiving preliminary approval. The SEC views this as a filter for serious operators with real financial backing.
How long does the VASP licensing process take?
Under the standard process, it takes 6 to 12 months. Under the ARIP program, you can begin operating in 2-3 months, but full licensing still takes up to 12 months. The timeline depends on how complete your documentation is and how quickly you respond to SEC requests.
What happens if my VASP license is revoked?
If your license is revoked, you must immediately cease all virtual asset activities. You are required to return customer funds within 30 days. Failure to do so can lead to criminal charges. Your directors may be barred from holding future positions in regulated entities. The SEC publishes revoked licenses publicly.
Do I need separate approvals from the Central Bank of Nigeria (CBN)?
You don’t need a separate license from the CBN, but you must comply with their AML/CFT guidelines. The SEC coordinates with the CBN and FIRS. If you violate CBN rules - like failing to report suspicious transactions - the SEC can suspend or revoke your license.