VASP Licensing in Nigeria: Requirements and Process for Crypto Businesses

What Is a VASP License in Nigeria?

A VASP (Virtual Asset Service Provider) license in Nigeria is the only legal way for crypto businesses to operate after the 2025 Investments and Securities Act. Before this law, Nigerian crypto firms worked in a gray zone-no official oversight, no banking access, and constant risk of shutdowns. Now, the Securities and Exchange Commission (SEC) requires every company offering crypto services to get licensed. That includes exchanges, wallet providers, staking platforms, mining operations, and even businesses that accept crypto as payment.

If you’re running a crypto business in Nigeria and don’t have a VASP license, you’re operating illegally. The SEC doesn’t just want paperwork-they want real, accountable companies with real money, real offices, and real people on the ground.

Who Needs a VASP License?

The list of regulated activities is broad. If your business does any of these, you need a license:

• Buying, selling, or trading cryptocurrencies like Bitcoin or Ethereum
• Hosting digital wallets for customers (custodial wallets)
• Running staking services where users earn rewards by locking up crypto
• Issuing or selling tokens (including NFTs if they’re treated as securities)
• Operating crypto mining farms
• Distributing airdrops or token giveaways
• Processing payments in crypto for goods or services

Even if you’re a small startup, if you touch virtual assets in any of these ways, the SEC considers you a VASP. There are no exceptions for size or revenue.

Minimum Capital Requirement: N500 Million

One of the biggest hurdles for new crypto firms is the capital requirement. The SEC demands a minimum paid-up capital of N500,000,000 (about $325,000 USD). This isn’t a suggestion-it’s a hard rule. You must prove you have this money in a Nigerian bank account, locked and ready for audit.

This requirement is among the highest in Africa and rivals some EU countries. It’s meant to keep out fly-by-night operators and ensure only serious, well-funded companies can enter the market. For many startups, this is a dealbreaker. Some have tried to raise funds through token sales, but the SEC won’t accept crypto as capital-you need actual Naira or foreign currency deposited in a Nigerian bank.

Corporate Registration and Physical Presence

You can’t just register a company online and call it a day. The SEC requires:

• A company registered with the Corporate Affairs Commission (CAC)
• A valid Certificate of Incorporation
• Memorandum and Articles of Association (MEMART)
• A current status report from CAC

But here’s the catch: you must have a physical office in Nigeria. No virtual offices, no co-working spaces with a mailbox. You need a real address where your business operates daily. And one of your directors must be a Nigerian resident-someone who lives in the country and can be held accountable by regulators.

This rule targets foreign crypto firms that used to operate remotely. Now, if you’re a U.S.-based exchange wanting to serve Nigerian customers, you can’t just set up a website and collect Naira. You need a local entity, a local director, and a local office.

Documentation: What You Must Submit

The SEC doesn’t just want proof of money and a physical address. You need a full operational blueprint:

• Latest audited financial statements (or a statement of affairs if you’re new)
• A detailed business model explaining your services, target market, and revenue plan
• Full KYC (Know Your Customer) and AML (Anti-Money Laundering) procedures
• Customer protection policies, conflict of interest rules, and dispute resolution processes
• Technical infrastructure details: cybersecurity systems, data encryption, backup protocols
• Staffing plan: names, roles, and qualifications of key personnel
• Letters of no objection from other regulators (if you’re also in banking, fintech, or payments)

Every document must be signed, stamped, and notarized. The SEC will check for consistency. If your business model says you’ll serve retail users, but your KYC system only works for institutions, your application gets rejected.

The Accelerated Regulatory Incubation Program (ARIP)

If the full license feels overwhelming, the SEC offers the Accelerated Regulatory Incubation Program (ARIP). This is a 12-month pilot path for startups that are serious but not yet ready for full compliance.

Here’s how ARIP works:

1. You apply with basic documents: CAC registration, proof of Nigerian office, and a clear business plan
2. SEC gives you preliminary approval to operate under supervision
3. You must submit quarterly progress reports
4. At month 10, the SEC reviews your progress and gives feedback
5. At month 12, you either get full VASP license or must shut down

ARIP isn’t a shortcut-it’s a training ground. You still need to meet all the same standards, but you get time and guidance. Many fintech startups use ARIP to build their systems before going live. But remember: you can’t raise funds or charge fees during ARIP unless the SEC explicitly allows it.

Compliance: KYC, AML, and Record Keeping

Once licensed, you’re under constant watch. The SEC and Central Bank of Nigeria (CBN) require strict compliance with:

• KYC: Every customer must provide government-issued ID, proof of address, and a selfie. Biometric verification is recommended.
• AML: You must monitor all transactions for suspicious patterns. Large, rapid transfers, multiple small deposits from different accounts, or transactions with high-risk jurisdictions trigger alerts.
• Record retention: You must keep all customer data, transaction logs, and communications for at least seven years. That’s longer than most banks.
• Reporting: You must file Suspicious Transaction Reports (STRs) with the Nigerian Financial Intelligence Unit (NFIU) within 72 hours of detection.

Failing to report a suspicious transaction can lead to fines, suspension, or revocation of your license. The SEC has already penalized several platforms for weak monitoring systems.

Technology and Security Requirements

Security isn’t optional. The SEC’s Technology Risk Management Guidelines demand:

• Two-factor authentication for all user accounts
• Cold storage for at least 90% of customer crypto assets
• Regular penetration testing by certified third-party auditors
• Encryption of all data at rest and in transit
• Disaster recovery plan with offsite backups
• System uptime of at least 99.5% annually

Many crypto firms thought they could use third-party APIs for security. The SEC says no-you must control your own infrastructure. You can’t outsource your responsibility.

Costs and Hidden Expenses

Getting the license isn’t just about the N500 million capital. You’ll spend more on:

• Legal fees for documentation: N1.5-3 million
• Auditor fees for financial statements: N1-2 million
• IT security setup: N5-15 million (depending on scale)
• Staff salaries for compliance officers: N500,000-1 million per person monthly
• Annual renewal fees: N250,000

For a small exchange, total setup costs can hit N20 million ($13,000 USD) before you even start serving customers. That’s why many small operators have shut down or moved offshore.

What Happens If You Don’t Apply?

The SEC has already started shutting down unlicensed platforms. In early 2025, three major peer-to-peer trading apps were blocked by Nigerian ISPs. Bank accounts linked to unlicensed VASPs were frozen. Customers lost access to their funds.

There’s no grace period. If you’re operating without a license after January 1, 2025, you’re breaking the law. The SEC can refer cases to the Nigerian Police Force for criminal prosecution. Fines can reach up to N1 billion, and directors can face jail time.

Why This Matters for Nigeria’s Crypto Future

Nigeria was once the biggest crypto market in Africa-driven by P2P trading, remittances, and youth adoption. The old system was chaotic but alive. The new system is controlled, but stable.

For licensed firms, this means access to banks, partnerships with fintechs, and investor confidence. For users, it means safer wallets and clearer rules. For the government, it means more tax revenue-crypto transactions are now trackable, and the goal is to raise tax collection from under 10% of GDP to 18% by 2027.

But it’s not perfect. High costs have pushed many innovators out. Some say it’s over-regulation. Others say it’s the only way to protect consumers in a market flooded with scams.

Next Steps for Crypto Businesses

If you’re ready to apply:

1. Register your company with CAC
2. Open a corporate bank account in Nigeria
3. Secure N500 million in paid-up capital
4. Set up a physical office with a Nigerian resident director
5. Build your KYC/AML system and cybersecurity infrastructure
6. Prepare all documentation
7. Apply via the SEC’s online portal or through ARIP

Don’t wait. The SEC is reviewing applications faster than ever. But they’re rejecting more too-because the bar is high, and they’re serious.

What’s Next for VASP Regulation in Nigeria?

The 2025 law is just the beginning. The SEC is expected to release detailed operational guidelines in 2026, covering:

• How to handle cross-border crypto transfers
• Rules for decentralized finance (DeFi) protocols
• Clarification on NFTs and tokenized assets
• Potential adjustments to capital requirements based on business type

Nigeria is setting a standard for Africa. Other countries are watching. If you want to scale across West Africa, getting your VASP license right now isn’t just about compliance-it’s about being ready for the future.