Custodial wallet / SaaS in Nigeria
Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).
Custodial SaaS is conditionally permitted in Nigeria with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Must register as a reporting entity on NFIU's goAML portal.
- File Suspicious Transaction Reports (STRs) with NFIU within 24 hours of suspicion.
- Conduct KYC/CDD on all customers (risk-based approach).
- Maintain internal compliance programs, record-keeping, and staff training under SCUML/NFIU framework.
- Operate under the Money Laundering (Prohibition and Prevention) Act (MLPPA).
- National ID linkage required for all transactions (per 2024-2026 framework rules).
- Report transactions to FIRS (Nigeria Revenue Service) for tax purposes — exchange transaction reporting mandated from January 1, 2026.
Key Restrictions
- Must obtain a Digital Asset Custody (DAC) license from SEC Nigeria with NGN 2B minimum capital.
- Must incorporate with the Corporate Affairs Commission (CAC) as a VASP.
- Must pass SEC's Approval in Principle (ARIP) process before operations.
- Must obtain CBN clearance for banking services if needed.
- Must pay registration fee of ₦30 million (~$72,000) for full license.
- SaaS provider is the regulated entity (custodian) — white-label clients likely do not need separate custody licensing but must comply with their own AML obligations as VASPs if they touch crypto.
- Naira delisting from P2P exchanges required per 2024-2026 framework rules.
- Geofencing / blocking of US persons may be needed to avoid OFAC sanctions exposure.
Key Risks
- High enforcement risk: EFCC has frozen over 1,100 bank accounts of crypto traders in active investigations — custody providers with Nigerian bank accounts face similar freezing risk.
- Regulatory framework is new (2024 rules, ARIP framework June 2024) — limited track record of licensing approvals and enforcement capacity.
- CBN historical hostility (Feb 2021 ban on bank servicing) only partially reversed Dec 2023 — residual banking access risk.
- NFIU/SCUML dual oversight creates coordination risk and potential conflicting obligations.
- Naira volatility and FX controls drive regulatory focus on currency manipulation — custody providers enabling P2P or FX services face enhanced scrutiny.
- FIRs tax reporting mandate from Jan 2026 adds compliance burden with unclear implementation guidance.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
SEC Rules on Issuance, Offering Platforms and Custody of Digital Assets 2022: https://sec.gov.ng/documents/8/Rules-on-Issuance-Offering-and-Custody-of-Digital-Assets.pdf
VASP: VASP License from SEC Nigeria. Exchange: NGN 500M (~$320K USD). Offering Platform: NGN 100M. Custody: NGN 2B. Broker-Dealer: NGN 100M. 3-6 months. Highest crypto adoption in Africa. Framework is new — enforcement capacity limited.
CUSTODY: Digital Asset Custody license — NGN 2B minimum capital
Incorporate with CAC as VASP.
Apply to SEC under ARIP: Pay application fee ₦100,000 (~$240), processing fee ₦300,000 (~$722).
Receive Approval in Principle; meet conditions (capital, bond, KYC policies, officers).
Pay registration fee ₦30 million (~$72,000); obtain full license and "No Objection" letter before operations.
Obtain CBN clearance for banking services if needed.
Investments and Securities Act 2025
Securities and Exchange Commission (SEC): Oversees crypto exchanges, Virtual Asset Service Providers (VASPs), and digital asset platforms as securities; enforces capital markets regulations and licensing.
Federal Inland Revenue Service (FIRS), transitioning to Nigeria Revenue Service (NRS): Handles crypto taxation, collects taxes on trading gains, and mandates exchange transaction reporting starting January 1, 2026.
NFIU's Mandate: NFIU receives mandatory reports (e.g., Suspicious Transaction Reports within 24 hours) from Financial Institutions (FIs), Other Financial Institutions (OFIs), and DNFBPs. Businesses must register as reporting entities on the NFIU's goAML portal, submitting documents like CAC registration, industry regulator licenses (e.g., CBN, SEC), and compliance officer details.
SCUML's Mandate: SCUML enforces AML/CFT rules for DNFBPs (e.g., lawyers, accountants, real estate agents), including registration (with certificate issuance), risk-based customer due diligence (CDD), internal compliance programs, record-keeping, staff training, and reporting suspicious activities to NFIU. From January 1, 2026, all DNFBP reports must use the SCUML portal exclusively.
Shared Framework: Both operate under laws like the Money Laundering (Prohibition and Prevention) Act (MLPPA). DNFBPs report to NFIU but are supervised by SCUML, while FIs report directly to NFIU via regulators like CBN or SEC. All entities must conduct KYC/CDD, risk assessments, and file timely reports to align with FATF/GIABA standards.
Entity Targeted: Over 1,100 (specifically 1,146) bank accounts of crypto traders and peer-to-peer merchants. Violation Type: Foreign-exchange racketeering, currency (naira) manipulation, money laundering, terrorism financing. Penalty Amount: Not specified (accounts frozen, no fines detailed).
Date: Accounts frozen as part of an ongoing investigation starting early 2024; court order obtained by April 2024 (90-day investigation period noted)
Outcome: Accounts frozen pending investigation completion; EFCC part of interagency task force probing naira manipulation linked to platforms like Binance. Investigation ongoing with potential blocks on fund retrieval even if court-ordered
New frameworks mandate national ID linkage for transactions and naira delisting from P2P exchanges (2024-2026), with penalties like license loss for unreported transactions.
CBN VASP Guidelines (Dec 2023)
ARIP Framework (June 2024)
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — custodial wallet/SaaS providers may operate in Nigeria but must obtain a Digital Asset Custody (DAC) license with NGN 2B minimum capital, incorporate locally, pass SEC ARIP process, and comply with dual NFIU/SCUML AML obligations, with significant enforcement risks from EFCC account freezes and evolving CBN/SEC frameworks.
Questions this verdict aims to answer
- What custody license / qualified-custodian status applies?
- What segregation, insurance, and proof-of-reserves rules apply?
- What AML obligations attach to the SaaS vs the white-label client?