SEC Nigeria Crypto Guidelines: What Financial Institutions Must Know in 2026

The Nigerian Securities and Exchange Commission (SEC) has completely rewritten the rules for cryptocurrency in the country. On March 31, 2025, President Bola Ahmed Tinubu signed the Investment and Securities Act (ISA) 2025 into law, and everything changed. For the first time, digital assets like Bitcoin and Ethereum are officially recognized as securities under Nigerian law. This means the SEC now has full authority to license, monitor, and punish crypto businesses - not just as a side note, but as core financial regulators.

What the ISA 2025 Actually Changes

Before 2025, crypto operated in a legal gray zone. The Central Bank of Nigeria (CBN) banned banks from handling crypto transactions in 2021, which pushed users toward peer-to-peer (P2P) trading. But the ISA 2025 doesn’t just lift that ban - it rebuilds the entire system. Digital assets are now legally classified as investment contracts, which puts them under the same rules as stocks and bonds. This isn’t a tweak. It’s a full integration into the national capital market.

Under the new law, any company offering crypto trading, custody, or staking services must get a license from the SEC. Unlicensed platforms are illegal. That’s why exchanges like Quidax and Busha - both Nigerian-founded - are now operating openly. They got their licenses in 2024, before the law even passed, because they knew the change was coming. If you’re running a crypto business in Nigeria and you don’t have that license, you’re already breaking the law.

How Financial Institutions Fit In

Banks and other financial institutions used to be cut off from crypto. The CBN’s 2021 ban meant no bank accounts for crypto firms. But in 2023, that changed. The CBN updated its policy to allow banks to serve licensed Virtual Asset Service Providers (VASPs). Now, if your crypto company is SEC-licensed, you can open a corporate bank account, process payouts, and even receive deposits through traditional banking channels.

This is huge. It means financial institutions aren’t just allowed to work with crypto firms - they’re expected to. But here’s the catch: banks now have legal responsibility to verify that the crypto businesses they serve are licensed. If a bank opens an account for an unlicensed VASP, it can face penalties from both the CBN and the SEC. So banks are now doing due diligence like they would for any high-risk client. They’re asking for license numbers, audit reports, and AML compliance records.

The Three Regulators You Can’t Ignore

You can’t just deal with one agency. In Nigeria, crypto regulation is a three-way system:

• SEC Nigeria: Licenses and supervises VASPs. They enforce investor protection rules and shut down unlicensed or fraudulent platforms.
• Central Bank of Nigeria (CBN): Controls banking access. They decide which financial institutions can serve crypto firms and set rules for transaction monitoring.
• Nigerian Financial Intelligence Unit (NFIU): Watches for money laundering and terrorist financing. Every crypto transaction over ₦5 million must be reported to them.

If you’re a financial institution, you have to satisfy all three. One failure - say, missing an NFIU report - can trigger a full audit from the SEC and freeze your ability to serve crypto clients. There’s no room for half-measures.

Taxes Are Now Enforced - And They’re Strict

The Nigeria Tax Administration Act (NTAA) 2025, effective January 1, 2026, added another layer. VASPs must now file quarterly tax returns and pay corporate income tax on profits. They’re also required to withhold 10% tax on user withdrawals and remit it to the Federal Inland Revenue Service (FIRS).

Penalties for non-compliance are severe. The first month of missed reporting costs ₦10 million ($6,693). Every month after that? Another ₦1 million ($669). That adds up fast. In 2025, the SEC shut down three crypto firms for failing to file taxes. One of them had over ₦2 billion in monthly volume. They didn’t get a warning. They got suspended overnight.

Even more telling: the SEC now requires licensed VASPs to connect their transaction systems directly to the FIRS for real-time tax monitoring. It’s not optional. It’s built into the licensing agreement.

What This Means for Nigerian Users

Nigeria still leads the world in P2P crypto trading. In 2025 alone, over $92 billion in crypto moved through Nigerian wallets. That’s nearly double South Africa’s volume. But now, the market is shifting. More users are moving from P2P to licensed exchanges because they’re safer, faster, and legally protected.

By 2026, Nigeria is expected to have 28.69 million crypto users - up from 19 million in 2024. The number of licensed VASPs has jumped from 5 in 2023 to 27 in early 2026. That’s not just growth. That’s institutionalization.

For everyday users, this means real protections. If a licensed exchange gets hacked, the SEC requires them to have insurance. If they freeze your funds without cause, you can file a complaint and get it reviewed. Before 2025, there was no recourse. Now, there’s a legal path.

What Happens If You Don’t Comply?

The SEC doesn’t just issue warnings. They shut down operations - permanently. In November 2025, they revoked the license of a popular crypto lending platform after discovering it was operating as a Ponzi scheme. The founders were arrested. Their assets were seized. Their bank accounts were frozen. And the CBN blocked all future banking access for any entity linked to them.

Unlicensed operators are now treated like criminals. The ISA 2025 gives the SEC power to prosecute under criminal law. Fines can reach up to ₦100 million ($66,930), and individuals can face jail time. This isn’t a regulatory notice. It’s a criminal indictment.

What Financial Institutions Should Do Now

If you’re a bank, payment processor, or fintech firm operating in Nigeria, here’s what you need to do:

1. Verify every crypto client’s SEC license - ask for the license number and check it on the SEC’s official registry.
2. Implement real-time AML screening - use systems that flag transactions over ₦5 million and auto-report to NFIU.
3. Train your compliance team - the ISA 2025 and NTAA 2025 are not optional reading. They’re mandatory training material.
4. Partner only with licensed VASPs - don’t assume a company is legit because it’s popular. Check the SEC’s public database.
5. Set up tax withholding systems - if you’re processing crypto payouts, you’re legally required to withhold 10% and file quarterly.

There’s no grace period. Enforcement started January 1, 2026. If you’re not ready, you’re already at risk.

The Bigger Picture

Nigeria’s approach isn’t about stopping crypto. It’s about controlling it. By bringing crypto under the same rules as stocks and bonds, the government is turning a chaotic, underground market into a regulated, transparent one. That’s good for investors. It’s good for businesses. And it’s good for Nigeria’s place in the global fintech economy.

Other African countries are watching closely. Kenya and South Africa tax crypto, but they don’t have licensing frameworks like Nigeria’s. Nigeria now has the most detailed, enforceable crypto regulatory system on the continent. And with over $92 billion in annual volume, it’s not just a local story - it’s a regional model.

The message is clear: if you want to operate in Nigeria’s crypto space, you play by the SEC’s rules - or you don’t play at all.