The Virtual Assets Regulation (CBN 2025 Draft): What’s Coming, and How to Structure a Compliant Crypto Exchange in Nigeria Now

Abstract

Nigeria has entered a new era for digital assets. The Investments and Securities Act 2025 (ISA 2025) now explicitly recognises virtual assets as securities and vests the Securities and Exchange Commission (SEC) with statutory authority to license and regulate Virtual Asset Service Providers (VASPs). At the same time, the Central Bank of Nigeria (CBN), which since 2017 prohibited regulated financial institutions from dealing in cryptocurrencies, is preparing its own virtual assets regulatory framework. While the CBN’s 2025 draft guidelines remain unpublished at the time of writing, the apex bank has signalled a coordinated approach with the SEC, focusing on AML/CFT, financial stability, and the supervision of VASP banking relationships. This article examines the likely contours of the emerging dual‑regulator regime, contrasts it with the current prohibition on banks dealing in crypto, surveys the legal workarounds (peer‑to‑peer trading and offshore settlement) that exchanges currently rely on, and provides a practical, future‑proof compliance roadmap for crypto exchanges seeking to operate in Nigeria now and under the forthcoming framework.

Keywords: Virtual Assets, Crypto Exchange, VASP, CBN 2025 Draft, ISA 2025, Nigeria, Licensing, P2P.

1. Introduction

For years, Nigeria was a paradoxical jurisdiction for virtual assets: home to one of the world’s largest crypto‑adopting populations, yet subject to a formal prohibition on banks servicing crypto businesses. The CBN’s circular of 5 February 2021, which directed all deposit money banks to close accounts of persons or entities transacting in or operating cryptocurrency exchanges, did not create new restrictions but reaffirmed a prohibition first imposed by CBN circular dated 12 January 2017. The effect, however, was the same, regulated financial institutions were forbidden from using, holding, trading or transacting in cryptocurrencies, and crypto‑related businesses were cut off from the formal banking system.

That landscape has changed dramatically. In March 2025, President Bola Ahmed Tinubu signed the Investments and Securities Act 2025 (ISA 2025) into law. The Act repeals the ISA 2007 and, for the first time in Nigerian statutory law, expressly recognises digital and virtual assets, including cryptocurrencies, tokens, non‑fungible tokens and stablecoins, as securities. More importantly, it vests the SEC with express statutory powers to register, license and enforce compliance in the digital asset space, and mandates that all crypto exchanges, wallet providers, custodians and token issuance platforms must obtain SEC authorisation before operating in or serving Nigerian users.

At the same time, the CBN is moving to assert its own regulatory role. In December 2023, the CBN lifted the de facto banking ban by issuing guidelines that permit licensed VASPs to open and maintain bank accounts, subject to strict AML/CFT and risk‑management standards. In 2025, the CBN has announced that it will collaborate with the SEC to produce a comprehensive framework for virtual assets, and has circulated a draft framework (the “CBN 2025 Draft”) that is expected to introduce AI‑powered real‑time AML monitoring, enhanced consumer protection rules, and a coordinated supervisory architecture. Although the full text of the CBN 2025 Draft has not been publicly released as of this writing, its likely features can be inferred from official statements, the ISA 2025 framework, and the earlier CBN Guidelines on Virtual Asset Accounts (2023).

This article addresses three interrelated questions for crypto exchange operators: (1) what is coming under the CBN 2025 Draft and the SEC licensing regime; (2) what are the current legal restrictions and the workarounds, particularly peer‑to‑peer (P2P) trading and offshore settlement, that have sustained the market; and (3) how can a compliant crypto exchange be structured now to be future‑proof under the forthcoming dual‑regulator framework?

2. The CBN 2025 Draft: What Is Coming?

The CBN 2025 Draft is not yet a published regulation. However, based on the CBN’s December 2023 Guidelines on the operation of bank accounts for VASPs, its May 2025 draft framework on AI‑powered AML/CFT standards, and public statements by CBN Governor Olayemi Cardoso, several key features are likely.

2.1 Coordinated Dual‑Regulator Architecture

The CBN has indicated it will work jointly with the SEC to create a “sustainable framework” for digital assets. This follows the approach already embodied in the government’s 2026 White Paper on virtual assets, which proposes a distributed model of oversight: the CBN will supervise payment‑related tokens such as stablecoins, while the SEC regulates assets classified as investment products. This division of labour is intended to align with global standards and to give each agency the tools to manage risks within its mandate.

For a crypto exchange, this means that if the exchange facilitates spot trading of Bitcoin or Ethereum, those assets are likely to fall under the SEC’s investment‑product perimeter. If the exchange also issues or facilitates payment stablecoins, the CBN may assert oversight over that activity. Exchanges will need to comply with both regulators, for example, maintaining SEC registration for its exchange activities while adhering to CBN‑prescribed AML/CFT reporting and real‑time transaction monitoring obligations.

2.2 Mandatory VASP Registration and Banking Access

The CBN 2025 Draft is expected to make formal what the 2023 Guidelines already foreshadowed: a licensed VASP (registered with the SEC) will be permitted to open and maintain bank accounts with CBN‑regulated financial institutions, provided it meets stringent conditions. These conditions are likely to include:

• real‑time AML/CFT transaction monitoring systems (the CBN’s May 2025 draft framework required all financial institutions to implement “real‑time transaction alert systems that flag suspicious activities”);
• segregation of client assets from company assets;
• minimum capital requirements (the SEC’s January 2026 circular already introduced VASP‑specific capital thresholds, with Digital Asset Platform Operators and Digital Assets Intermediaries requiring minimum paid‑up capital of N500 million, and Real‑World Assets Tokenisation Platforms requiring N1 billion);
• regular reporting to the CBN on VASP‑bank relationships, transaction volumes and suspicious activity reports; and
• fitness‑and‑propriety requirements for directors and senior management.

2.3 AI‑Powered AML/CFT and Data Sharing

One of the most distinctive features of the CBN’s 2025 draft framework is its emphasis on artificial intelligence and machine learning for AML compliance. The May 2025 draft proposed that financial institutions, including VASPs, once integrated, must deploy AI systems to “reduce false positives, detect suspicious activity in real time, and strengthen the overall effectiveness of Nigeria’s AML regime.” This is likely to be carried over into the final CBN virtual assets guidelines. Exchanges that intend to operate in the regulated space will need to invest in transaction monitoring technology that can meet these standards and interface with the CBN’s proposed “Supervisory Telemetry Fabric”, a real‑time data‑sharing system designed to give regulators visibility into the virtual asset market.

2.4 Virtual Asset Regulatory Authority (VARA) or Equivalent?

The 2026 White Paper proposed the creation of a Virtual Asset Regulatory Authority (VARA) as a coordinating structure bringing together the CBN, the SEC, the Nigeria Revenue Service and financial intelligence agencies. While the CBN 2025 Draft may not itself create a new agency, it is likely to establish a formal inter‑agency coordination mechanism, possibly with a secretariat hosted by the CBN. Exchanges should prepare for consolidated reporting obligations and a single point of contact for regulatory filings.

3. The SEC Licensing Regime: The Core Compliance Pillar

Under ISA 2025, the SEC is the apex regulator for virtual assets that qualify as securities. The definition of “securities” in Section 357 of ISA 2025 is broad enough to encompass virtually all cryptocurrencies, tokens and stablecoins (with the exception of the e‑Naira and other regulated electronic money). Consequently, almost any crypto exchange serving Nigerian users will require SEC authorisation.

3.1 Who Must Register?

The SEC’s Digital Assets Rules (as amended in June 2025) require registration for:

• Virtual Asset Service Providers (VASPs): entities conducting exchange between virtual assets and fiat, exchange between virtual assets, transfer of virtual assets, safekeeping/administration of virtual assets, or participation in financial services related to a virtual asset offering.
• Digital Asset Exchanges (DAXs): secondary market venues for trading digital assets.
• Digital Asset Offering Platforms (DAOPs): primary issuance gateways.
• Digital Asset Custodians (DACs): entities holding client assets.
• Digital Asset Intermediaries (DAIs), Digital Asset Platform Operators (DAPOs), and Real‑World Assets Tokenisation and Offering Platforms (RATOPs): categories introduced in the SEC’s January 2026 circular.

Crucially, foreign exchanges that serve Nigerian users are also in scope. The SEC applies functional jurisdiction: an offshore exchange may be required to register if it allows Nigerian account registration, markets to Nigerian users, facilitates trading by Nigerian residents, accepts Nigerian identification documents, or processes Nigerian bank transfers. Physical incorporation in Nigeria is not a safe harbour.

3.2 The Registration Pathway: ARIP and Full Licensing

The SEC has operationalised a structured onboarding path through the Accelerated Regulatory Incubation Program (ARIP). ARIP functions as a regulatory sandbox that allows digital asset operators to enter the Nigerian market under regulatory supervision before receiving a full licence.

The ARIP process involves:

1. Initial Assessment Filing: The promoter submits an online assessment form, a draft white paper, a legal opinion classifying the tokens as securities or otherwise, and information about the issuer.
2. Eligibility Notification: The SEC reviews the filing and confirms eligibility.
3. Formal Application: Upon clearance, the applicant submits a full ARIP application.
4. Approval‑in‑Principle (AIP): The applicant receives an AIP and is permitted to operate under ARIP for a period determined by the SEC.
5. Full Registration: After the incubation period, the VASP transitions to full registration under the Digital Assets Rules.

ARIP provides a valuable interim status, it allows a crypto exchange to begin operations with regulatory authorisation while working toward full compliance. It also gives the SEC the opportunity to refine its rules based on real‑world business models.

3.3 Minimum Capital Requirements

The SEC’s January 2026 circular imposed significant capital thresholds for VASP licences. For a typical crypto exchange, the relevant categories are:

Existing operators have been given an 18‑month transitional period, until 30 June 2027, to comply with these new thresholds. For new entrants, the capital requirement must be met at the time of application.

3.4 Ongoing Compliance Obligations

A registered VASP must maintain:

• Fitness‑and‑proper management: at least five directors, three of whom must be Nigerian residents.
• AML/CFT programme: including a risk‑based approach, customer due diligence, record‑keeping, and suspicious transaction reporting.
• Travel rule compliance: for transactions above certain thresholds.
• Client asset segregation: client funds and virtual assets must be held separately from the company’s own assets.
• Regular reporting: to the SEC on trading volumes, client complaints, and financial condition.
• Audit and disclosure obligations: annual financial statements audited by a registered firm, and clear disclosure of fees, risks and trading rules.

4. The Current CBN Ban on Banks Dealing in Crypto, and the Legal Workarounds

Despite the ISA 2025 and the CBN’s 2023 guidelines, the underlying prohibition on banks dealing in cryptocurrency has not been fully repealed. The CBN’s 2017 directive and 2021 circular remain in force as a matter of CBN policy, except to the extent they have been modified by the 2023 Guidelines and any forthcoming 2025 framework. In practice, many Nigerian banks remain reluctant to open accounts for crypto‑related businesses, and those that do often impose stringent conditions.

This has given rise to two principal legal workarounds: peer‑to‑peer (P2P) trading and offshore settlement.

4.1 Peer‑to‑Peer Trading

P2P trading platforms allow buyers and sellers of cryptocurrency to transact directly with each other, without the exchange itself taking custody of funds or executing trades on a matched‑order book. The platform merely facilitates introductions, provides an escrow mechanism, and verifies identity. Because the transaction is between two individuals, the P2P platform can argue that it is not a “virtual asset exchange” under the SEC’s Digital Assets Rules, but rather a communications or matching service.

In the absence of formal registration, P2P has flourished in Nigeria. The SEC’s 2025 stakeholder engagement acknowledged that P2P trading has “flourished outside formal oversight” under the pre‑ISA 2025 regime. However, the ISA 2025 and the SEC’s amended Digital Assets Rules arguably bring many P2P platforms within the definition of a VASP. If a platform facilitates exchange between virtual assets and fiat, or between virtual assets, and does so for or on behalf of another person, it is likely a VASP, regardless of whether it uses a centralised order book or a P2P matching engine.

The CBN has also taken a harder stance on P2P. In 2024, the CBN discovered that some traders were using P2P platforms to manipulate the naira through pump‑and‑dump strategies, and it began working with fintechs to restrict P2P trading. Several major platforms, including Quidax, subsequently pulled their P2P offerings.

For an exchange seeking to be future‑proof, relying on a pure‑P2P model without SEC registration is increasingly risky. The SEC has made clear that any platform facilitating crypto trading for Nigerian users falls within its jurisdiction, and the CBN is actively monitoring P2P flows for AML/CFT and currency manipulation concerns.

4.2 Offshore Settlement

A second workaround is for a Nigerian‑facing exchange to be incorporated and licensed outside Nigeria (e.g., in a jurisdiction such as the Cayman Islands, the British Virgin Islands or Estonia) and to route all fiat settlements through offshore bank accounts. Nigerian users would deposit naira into a local agent’s account (or use a P2P on‑ramp), which is then converted to crypto on the offshore exchange. The exchange itself never touches naira; it merely records crypto trades.

The ISA 2025’s functional jurisdiction provision, however, is designed to capture precisely this structure. If an offshore exchange allows Nigerian residents to register, accepts Nigerian identification, or markets to Nigerian users, the SEC may assert jurisdiction and require registration. The CBN’s 2025 Draft is also expected to impose obligations on offshore VASPs that have a significant Nigerian user base, possibly through a “local presence” requirement.

Moreover, the Nigeria Tax Administration Act 2025 (NTAA) now defines “virtual assets” broadly and imposes tax obligations on transactions involving Nigerian residents, regardless of where the exchange is incorporated. Offshore exchanges that do not comply with Nigerian tax and regulatory requirements risk being blocked by internet service providers or having their payment rails disrupted.

5. Future‑Proof Compliance Roadmap for Crypto Exchanges

Given the direction of travel, SEC licensing as the primary gateway, CBN oversight of banking relationships and AML/CFT, and functional jurisdiction over offshore platforms, exchanges that wish to operate in Nigeria sustainably should take the following steps now.

Step 1: Assess Whether Your Activity Requires SEC Registration

Conduct a legal analysis of your business model under the ISA 2025 and the SEC’s Digital Assets Rules. If you facilitate exchange between crypto and fiat, exchange between different cryptos, transfer of virtual assets, safekeeping or administration of virtual assets, or participation in a virtual asset offering, you are likely a VASP and must register. If in doubt, assume you are in scope, the SEC has signalled an enforcement‑focused approach.

Step 2: Incorporate a Nigerian Subsidiary and Appoint Resident Directors

While the SEC can assert jurisdiction over foreign entities, the registration process is streamlined for Nigerian‑incorporated companies. A Nigerian subsidiary also facilitates compliance with the CBN’s banking guidelines, as banks are more comfortable dealing with locally incorporated VASPs. The SEC requires at least three Nigerian‑resident directors out of a minimum of five directors.

Step 3: Prepare for the ARIP Sandbox

The fastest path to regulatory authorisation is through the ARIP. Prepare a comprehensive application package, including:

• a detailed white paper describing your platform, tokenomics, and risk controls;
• a legal opinion classifying the tokens you offer as securities (or otherwise) under Nigerian law;
• your AML/CFT policies and procedures, including travel rule compliance;
• a fit‑and‑proper declaration for all directors and senior management;
• evidence of the minimum paid‑up capital (which, for most crypto exchanges, will be N500 million under the DAI or DAPO categories); and
• a business continuity and cybersecurity plan.

Engaging Nigerian legal counsel with experience in capital markets and fintech is strongly recommended.

Step 4: Establish Banking Relationships in Anticipation of the CBN 2025 Framework

Even before the CBN 2025 Draft is finalised, approach commercial banks that have indicated willingness to work with licensed VASPs. The CBN’s 2023 Guidelines require banks to conduct enhanced due diligence on VASP customers, including reviewing the VASP’s SEC registration, AML/CFT controls, and risk management framework. Prepare a due diligence package that demonstrates your compliance readiness.

Step 5: Implement AI‑Enabled Real‑Time AML/CFT Monitoring

The CBN’s draft AML framework will likely require real‑time transaction monitoring using AI or machine learning. Invest in or partner with a transaction monitoring solution that can:

• screen transactions against sanctions lists and watchlists in real time;
• detect patterns indicative of money laundering, terrorist financing, or fraud;
• generate suspicious activity reports in a format acceptable to the Nigerian Financial Intelligence Unit (NFIU); and
• interface with the CBN’s proposed Supervisory Telemetry Fabric.

Step 6: Plan for Tax Compliance

The NTAA 2025 imposes tax obligations on virtual asset transactions. Even if you are an offshore exchange, if you have Nigerian users, you may be required to register with the Federal Inland Revenue Service (FIRS) and remit taxes on income derived from Nigerian sources. Coordinate with your tax advisors to ensure you are not caught off‑guard.

Step 7: Monitor Legislative Developments

The National Assembly is considering additional legislation. A bill for “an Act to Regulate the Use, Issuance, and Operation of Crypto currencies and Related Digital Currencies in Nigeria” was introduced in November 2025, and the House of Representatives’ Ad‑Hoc Committee on Cryptocurrency Adoption is working towards “Nigeria’s first comprehensive legal and regulatory framework for cryptocurrency and digital finance operations.” While these legislative efforts may overlap with the ISA 2025 and the CBN 2025 Draft, they could also introduce new requirements (e.g., a licensing regime distinct from the SEC’s) or clarify residual ambiguities. Exchanges should participate in stakeholder consultations where possible.

6. Conclusion

Nigeria’s virtual assets regulatory landscape is evolving from prohibition to structured, dual‑regulator oversight. The ISA 2025 has given the SEC clear statutory authority to license VASPs, and the CBN’s forthcoming 2025 guidelines will establish the rules for banking relationships and AML/CFT compliance. Crypto exchanges that wish to operate in this dynamic market must move away from the legal grey areas of pure P2P or offshore‑only models and embrace formal registration.

The compliance roadmap is demanding, minimum capital of up to N1 billion, real‑time AI‑powered AML systems, fit‑and‑proper director requirements, and ongoing reporting obligations. However, the rewards are substantial: access to the formal banking system, regulatory clarity, investor confidence, and a sustainable position in one of the world’s most vibrant digital asset markets.

For forward‑looking exchanges, the time to act is now. By entering the ARIP sandbox, building a compliant Nigerian presence, and aligning with both the SEC and CBN frameworks, exchanges can not only survive the transition to full regulation but also help shape the future of virtual assets in Nigeria.

References

1. Investments and Securities Act, No. … of 2025 (Nigeria). 
2. Central Bank of Nigeria, Circular to Deposit Money Banks on Cryptocurrencies, 5 February 2021. 
3. Central Bank of Nigeria, Guidelines on the Operation of Bank Accounts for Virtual Assets Service Providers (VASPs), December 2023. 
4. Securities and Exchange Commission (Nigeria), Framework on Accelerated Regulatory Incubation Program (ARIP) for the Onboarding of Virtual Assets Service Providers (VASPs) and Other Digital Investment Service Providers (DISPs), 21 June 2024. 
5. Securities and Exchange Commission (Nigeria), Amendments to the Rules on Digital Assets Issuance, Offering Platform, Exchange and Custody, effective 30 June 2025. 
6. Securities and Exchange Commission (Nigeria), Circular on Revised Minimum Capital Requirements for Capital Market Operators and Introduction of New VASP Licence Categories, January 2026. 
7. Federal Government of Nigeria, White Paper on Virtual Assets Regulation, 2026. 
8. Nigeria Tax Administration Act, No. … of 2025 (Nigeria). 
9. Aluko & Oyebode, “ISA 2025 and NTAA 2025: Further Developments in the Regulatory Oversight of Virtual Assets,” July 2025. 
10. Cryptoverse Lawyers, “The Ultimate Guide to Crypto Licensing in Nigeria (2025 Edition),” 2025. 
11. FinTech Association of Nigeria, “Nigeria’s ISA 2025: Key Takeaways from FinTechNGR’s Stakeholder Engagement with the SEC,” May 2025. 
12. Goldsmiths Solicitors, “How Virtual Assets Service Providers (VASPs) Can Obtain Licenses in Nigeria,” October 2025. 
13. BusinessDay, “Higher capital thresholds and new VASP licences: Key takeaways from the Nigerian SEC’s January 2026 circular,” 7 May 2026. 
14. BusinessDay, “Nigeria targets $92bn crypto flows in offshore oversight test,” 29 April 2026