How to Get a VASP License in Nigeria: Step‑by‑Step Guide for Crypto Companies

• By JayKay Sun
• 18 Mar, 2025
• 24 Comments

Crypto startups eyeing Nigeria’s massive market quickly learn that operating without a licence is a dead‑end. Since the 2025 Investments and Securities Act, the Securities and Exchange Commission (SEC Nigeria’s securities regulator that now oversees virtual assets) has made a full‑blown VASP licence mandatory for any service dealing with digital tokens, wallets or payments.

What does the process actually look like? Which paperwork will make you sweat? And can you shortcut the wait with the Accelerated Regulatory Incubation Program (ARIP a fast‑track licensing scheme for crypto firms)? Below you’ll find a plain‑English roadmap that takes you from idea to a legally recognised crypto business in Nigeria.

Key Takeaways

• Minimum paid‑up capital: N500,000,000 (≈$325k USD).
• You need a physical office and a resident director.
• Two licensing tracks: standard registration or the 12‑month ARIP incubation.
• AML/KYC records must be kept for at least seven years.
• Compliance costs are high, but a licence unlocks banking services and consumer trust.

Why Nigeria’s VASP Licence Matters

Before 2025, crypto firms operated in a gray zone, using peer‑to‑peer platforms and avoiding the Central Bank’s ban on banking services. The SEC’s new framework flips the script: virtual assets are now treated as securities, putting every exchange, wallet provider and token issuer under strict supervision. The result? Legitimate firms can finally open corporate bank accounts, attract institutional investors, and advertise with confidence, while regulators gain a clear line of sight into the market.

Core Eligibility Checklist

Before you even fill out the first form, make sure your business ticks these boxes:

1. Incorporated with the CAC Corporate Affairs Commission, Nigeria’s company registrar as a limited liability company.
2. Paid‑up capital of at least N500,000,000.
3. Physical office space in Nigeria, managed by a director who lives in the country.
4. Audited financial statements (or CPA‑prepared statements of affairs for brand‑new entities).
5. Robust AML/KYC program that meets both SEC and CBN Central Bank of Nigeria, which sets financial‑service standards guidelines.

Standard Registration Process

The traditional route is thorough but predictable. Here’s how it unfolds:

1. Prepare documentation. Gather incorporation papers, audited statements, a detailed business model, risk‑management policies, and a seven‑year record‑keeping plan.
2. Submit the application. Upload everything to the SEC’s online portal and pay the non‑refundable fee (≈N10,000,000).
3. SEC review. The regulator screens your capital, tech infrastructure, and AML/KYC controls. Expect a 60‑day turnaround.
4. On‑site inspection. An SEC officer will visit your Nigerian office to verify physical presence and interview the resident director.
5. License issuance. Once approved, you receive a VASP licence valid for three years, renewable upon review.

During the review, the SEC may ask for additional evidence-extra cybersecurity audits, letters of no objection from other regulators, or updated financial projections. Be ready to respond within 14 days to avoid delays.

Accelerated Regulatory Incubation Program (ARIP)

If you need to start operations fast, ARIP is the shortcut. It’s not a free pass; you still meet the core capital and office rules, but you get provisional approval after a lighter initial screening.

Steps for ARIP:

1. File a concise application stating your business model and confirming the core eligibility criteria.
2. Sign a sworn undertaking to comply with SEC rules and to submit quarterly progress reports.
3. Begin operating under SEC supervision-limited to activities outlined in the provisional approval.
4. At month10, the SEC reviews your performance and decides whether you graduate to a full licence.
5. If successful, you complete the remaining documentation and receive a standard three‑year VASP licence. If not, you must either cease operations or re‑apply after remedial changes.

ARIP is attractive for startups that need market traction quickly, but remember the 12‑month window is strict-miss a reporting deadline and you could lose the provisional status.

Deep‑Dive into Compliance Requirements

Getting the licence is only half the battle; staying compliant costs time and money. Below are the non‑negotiable pillars:

Anti‑Money‑Laundering (AML) & Know‑Your‑Customer (KYC)

• Identity verification must include government‑issued ID, facial verification, and proof of address.
• Enhanced due‑diligence for politically exposed persons (PEPs) and high‑value transactions (>N5million).
• Transaction monitoring system that flags unusual patterns and generates SARs (Suspicious Activity Reports) to the Financial Intelligence Unit (FIU).
• All records-customer data, transaction logs, communication-must be retained for at least seven years in a secure, auditable format.

Technology Risk Management

The SEC’s tech‑risk guidelines mirror global best practices. Your platform should have:

• Multi‑factor authentication for admin and user accounts.
• Cold‑storage for at least 80% of custodial assets, with geographically dispersed vaults.
• Regular penetration testing (at least quarterly) and a documented incident‑response plan.
• Data‑encryption at rest and in transit, compliant with Nigeria’s Data Protection Regulation (NDPR).

Financial Reporting & Taxation

Every VASP must register with the Federal Inland Revenue Service (FIRS) and submit:

• Annual audited financial statements.
• Quarterly VAT returns (if applicable).
• Monthly transaction summaries to the SEC’s compliance portal.

Common Pitfalls and How to Avoid Them

Many firms stumble on the same avoidable mistakes:

• Underestimating capital. The N500M requirement is a hard floor-any shortfall leads to immediate rejection.
• Missing the resident director. Appoint a local executive early; you cannot substitute a foreign manager later.
• Incomplete AML policies. Use a vetted KYC provider and retain all audit logs; regulators will ask for screenshots during inspections.
• Ignoring the SEC’s tech checklist. Run a pre‑audit with a cybersecurity firm familiar with Nigerian regulations to catch gaps before the on‑site visit.
• Delaying quarterly reports. Set automated reminders; a missed deadline can trigger a licence suspension.

Strategic Benefits of a VASP Licence

Beyond legality, a licence offers tangible advantages:

• Banking access. Licensed firms can open corporate accounts, obtain credit lines, and settle fiat payments with local banks.
• Investor confidence. Institutional investors only fund entities that can prove regulatory compliance.
• Market differentiation. In a crowded peer‑to‑peer scene, a licence signals trustworthiness to end‑users.
• Potential tax incentives. The Nigerian government has hinted at reduced tax rates for compliant fintech firms.

Next Steps for Your Crypto Business

Ready to start? Follow this quick checklist:

1. Incorporate with the CAC and open a Nigerian bank account for the paid‑up capital.
2. Hire a qualified resident director and secure a physical office (co‑working space works if it meets SEC standards).
3. Develop AML/KYC SOPs and engage a certified compliance vendor.
4. Choose between standard registration or ARIP based on your timeline and budget.
5. Prepare the full documentation packet and submit via the SEC portal.
6. Set up internal compliance monitoring to handle quarterly reporting from day1.

By ticking these boxes, you’ll be on a clear path to a fully licensed crypto operation in Nigeria.

Frequently Asked Questions

What is a VASP licence and who needs it?

A VASP (Virtual Asset Service Provider) licence is a legal authorisation issued by Nigeria’s SEC that allows a company to offer services such as crypto exchange, wallet custody, token issuance, mining, staking or crypto‑based payments. Any business that deals with virtual assets for customers must hold this licence under the 2025 Investments and Securities Act.

How much capital do I need to provide?

The SEC requires a minimum paid‑up capital of N500,000,000 (about $325,000USD). This amount must be fully funded before the licence is granted and remains locked as a financial safety net.

Can a foreign crypto exchange operate in Nigeria without a local office?

No. The SEC mandates a physical office and a resident director for every VASP applicant. Remote‑only models are not accepted, unlike some jurisdictions that allow purely virtual operations.

What’s the difference between the standard licence and ARIP?

Standard registration requires the full documentation set up front and takes roughly 60days for review. ARIP grants a provisional approval after a streamlined submission, letting you start limited operations while you finish the detailed paperwork over a 12‑month incubation period.

How long do I have to keep customer records?

The SEC and FATF standards require that all customer identification data, transaction logs and communications be retained for at least seven years in a secure, auditable format.