AML Compliance In Nigeria’s Virtual Asset Sector:What Market Players Should Know

Introduction:

In Nigeria’s evolving virtual asset ecosystem, compliance with Anti-Money Laundering/Countering the Financing of Terrorism/Countering Proliferation Financing (“AML/CFT/CPF”) extends well beyond a box-ticking exercise. For operators in this sector, compliance with these obligations determines market access, business viability, and bankability; with breaches carrying immediate legal, financial, and reputational consequences.

Recent enforcement trends are instructive. The money laundering action instituted against Binance¹ demonstrates the level of scrutiny facing Virtual Asset Service Providers² (“VASPs”) and how quickly compliance gaps can translate into operational and investor risk.

With the enactment of the Investments and Securities Act, 2025 (the “ISA”), which formally recognises virtual assets as securities,³ and Nigeria’s exit from the Financial Action Task Force⁴ (the “FATF”) grey list, the regulatory landscape has become more structured and accountability-driven. While this progress signals improved regulatory alignment, it also places a heightened and continuing obligation on both regulators and market participants to sustain that progress. In practical terms, AML compliance now functions not only as a regulatory requirement, but as a signal of credibility in Nigeria’s business environment.

This piece examines how AML compliance shapes market access, where enforcement risk is emerging, and the practical steps businesses must take to remain compliant, investible, and competitive within Nigeria’s evolving digital asset ecosystem.

Key AML Obligations as a Market Imperative

The Securities and Exchange Commission Rules on Issuance, Offering Platforms and Custody of Digital Assets, 2022 (the “SEC Rules”) remain Nigeria’s most comprehensive framework governing virtual asset activities. A central feature of the SEC Rules is the clear obligation on VASPs to establish and maintain robust policies, procedures, and internal controls to mitigate the risks of money laundering, terrorist financing, and proliferation financing, and to ensure full compliance with applicable AML and CFT laws and regulations.⁵

By implication, VASPs are fully embedded within Nigeria’s broader financial crime compliance architecture.

Chief among these are the Nigeria Tax Administration Act, 2025 (the “NTAA”), and the Money Laundering (Prevention and Prohibition) Act, 2022 (the “MLA”), each of which imposes specific and enforceable obligations on VASPs. Notably, the MLA expands the definitions of “Financial Institutions” and “Funds” to expressly include VASPs and virtual assets,⁶ confirming that operators in this space are treated as full participants within Nigeria’s AML framework, rather than as peripheral or lightly regulated actors.

For businesses, AML compliance in Nigeria’s virtual asset sector is no longer peripheral; it is a structural obligation that determines market viability. In practical terms, key requirements now include the implementation of know your customer (“KYC”)⁷ and customer due diligence (“CDD”) systems; transaction monitoring and reporting obligations;⁸ retention of transaction records and related information for a minimum of 5 (five) years,⁹ which must be made available to the authorities immediately upon request.¹⁰ These requirements are also broadly aligned with global standards developed by the FATF.¹¹

A recurring concern within the industry, however, is that the implementation of AML obligations may undermine one of the perceived attractions of blockchain technology, often described as “anonymity”. This concern is more accurately addressed by distinguishing between anonymity at the transaction layer and compliance at the platform level. While VASPs are required to collect and verify customer information at onboarding, blockchain transactions themselves remain pseudonymous. Participants transacting on-chain do not automatically have access to the real-world identities behind wallet addresses.

In effect, AML compliance does not eliminate transactional privacy. Rather, it requires VASPs to maintain a verifiable and accessible repository of customer identity information. This ensures that where it becomes legally necessary, such as pursuant to regulatory inquiry or lawful investigation, the identity behind a specific wallet can be ascertained. It does not imply that participants engaged in ordinary transactions gain visibility into each other’s identities.

Taken together, these developments signal a decisive shift in Nigeria’s regulatory posture. The virtual asset sector is no longer operating at the margins of the financial system; it is being actively integrated into a rules-based, compliance-driven framework. In practical terms, the ability to demonstrate compliance readiness is fast becoming the primary determinant of whether a VASP can enter, operate, and scale within the Nigerian market.

Common AML Pitfalls and Practical Actions for Virtual Asset Operators

The common blind spots, and the priority actions they call for, are outlined below:

a. Customer Due Diligence: KYC procedures continue to fall short of regulatory expectations, particularly in relation to beneficial ownership identification. Given that one of the defining challenges of the virtual asset landscape is its largely pseudonymous configuration, it is imperative for operators to conduct robust due diligence for both corporate and individual clients before they are onboarded onto the platform. The adoption of tiered CDD frameworks, alongside enhanced due diligence for politically exposed persons and high-risk customers, materially improves transparency and reduces both regulatory and reputational exposure, while also strengthening institutional confidence.

b. Transaction Monitoring and Reporting: Suspicious transaction¹² reporting remains a core pillar of AML compliance, yet it is frequently overlooked in practice. For fiat currency (Naira) transactions, there is a duty on financial institutions to report to the Nigerian Financial Intelligence Unit any single transaction or lodgement of funds in excess of ₦5 million for individuals and ₦10 million for body corporates.¹³ Further regulatory guidance is, however, awaited on the monetary threshold applicable to virtual asset transactions.

c. Governance and Internal Controls: Weak internal governance structures remain a recurring compliance failure, with AML obligations often treated as operational afterthoughts rather than board-level responsibilities. VASPs are statutorily required to implement safeguards aimed at preventing the laundering of funds, including the designation of compliance officers at management level across headquarters, branches, and local offices, regular specialised AML training for employees, and the maintenance of an internal audit function to monitor compliance with the MLA.¹⁴ Beyond monetary penalties, a more far-reaching commercial risk is the potential suspension or withdrawal of an operator’s licence where regulatory breaches are established.¹⁵

d. Internal AML Policies as a Market Access and Investment Requirement: Beyond regulatory compliance, the development, documentation, and consistent implementation of robust internal AML policies have become a critical commercial requirement. In practice, investors, lenders, counterparties, and financial institutions increasingly require clear evidence of a VASP’s AML framework as a condition for engagement. Accordingly, businesses must not only adopt comprehensive, risk-based AML policies, but also demonstrate adherence to those policies in day-to-day operations. A well-structured and actively implemented AML framework serves as both a compliance safeguard and a credibility signal to investors.

e. Risk-Based Assessments and Technology-Enabled Compliance: The adoption of a risk-based AML framework is equally critical. In line with FATF recommendations, the MLA requires that AML risk assessments be conducted prior to the deployment of new technologies, products, or services, with a view to identifying and mitigating emerging risks.¹⁶ Given that virtual assets are underpinned by new and evolving technology, operators are advised to conduct deep, business-specific risk assessments. In parallel, leveraging technology for compliance intelligence, including blockchain analytics, artificial intelligence, and regulatory technology (RegTech) tools, enhances anomaly detection, monitoring accuracy, and auditability, while also delivering operational efficiencies.

f. Cross-Border Cooperation and Capacity Building: VASPs operating in Nigeria are further advised to collaborate with foreign counterparts, particularly for information and data sharing in relation to cross-border transactions, to mitigate exposure to regulatory liability. Finally, given the relatively early stage of virtual asset regulation in Nigeria, a notable knowledge gap persists among regulators, investors, and businesses alike. In this context, sustained investment in expert-led training for staff and management, coupled with constructive engagement with regulators through sandbox participation, consultation processes, and supervisory dialogue, enables operators to anticipate regulatory developments and align their operations accordingly.

Conclusion

VASPs should note that the Presidential Executive Order on Virtual Assets Coordination, 2026,¹⁷ which seeks to harmonise regulatory mandates within Nigeria’s virtual asset ecosystem, may affect the regulator responsible for overseeing particular virtual asset activities. However, regardless of whether a VASP falls under the oversight of the SEC, the Central Bank of Nigeria, or another competent authority, compliance with the AML/CFT/CPF obligations under the MLA remains non-negotiable.

Nigeria’s virtual asset ecosystem presents strong commercial opportunity, supported by clearer regulatory frameworks, increasing AML/CFT enforcement, and growing market adoption. However, these developments have also reshaped the sector’s risk profile, making compliance a central determinant of market participation.

Accordingly, AML compliance is more than a legal requirement; it is a measure of operational readiness and credibility. For VASPs, the ability to embed compliance into governance, systems, and day-to-day operations will increasingly determine access to the market and long-term viability. Businesses that proactively engage with regulators, invest in robust risk management frameworks, and seek informed legal guidance will be best positioned to navigate the regulatory requirements and compete effectively in the evolving market.

Footnotes

1 EFCC v. Binance, Suit No: FHC/ABJ/CR/138/2024 (Counts 4 and 5 of the charge sheet). We however understand that settlement meetings are underway to resolve the matter out of Court.

2 Virtual assets are digital representations of value that can be transferred, digitally traded, and used for payment or investment purposes; a VASP is any entity that conducts activities for or on behalf of another person, including exchange between virtual assets and fiat currencies, exchange between one or more forms of virtual assets, transfer of virtual assets, and custody of virtual assets. See CBN circular: https://www.cbn.gov.ng/out/2024/fprd/guidelines%20on%20operations%20of%20bank%20accounts%20for%20virtual%20asset%20providers.pdf. Accessed 2 May 2026.

3 Section 357 of the ISA.

4 Nigeria exited the grey list on 24 October 2025. See Templars publication https://www.templars-law.com/app/uploads/2025/10/Nigeria-Exits-FATF-Grey-List.pdf

5 Part D, Rule 5.0 (i) of the SEC Rules.

6 Section 30 of the MLA.

7 Sections 3 and 4 of the MLA; Paragraph 5(d), Fifth Schedule to the NTAA.

8 Section 7 of the MLA; Paragraph 5(a) and (c), Fifth Schedule to the NTAA. Such reports are to be made within 48 (forty-eight) hours.

9 Section 8 of the MLA; Paragraph 5(f) Fifth Schedule to the NTAA, provides for a minimum period of 7 (seven) years. We note that the MLA and the NTAA provide for different retention periods. To avoid regulatory exposure, VASPs are advised to comply with the longer duration to minimise regulatory breach.

10 Section 9 of the MLA.

11 FATF Report: https://www.fatf-gafi.org/content/dam/fatf-gafi/reports/Understanding-Mitigating-Risks-Offshore-VASPs.pdf.coredownload.inline.pdf accessed 24 July 2026.

12 According to Section 7(1)(a) of the MLA, a transaction is regarded as suspicious where it involves an unjustifiable or unreasonable frequency, is structured with unusual or unjustified complexity, lacks any clear economic justification or lawful purpose, or is inconsistent with the known transaction pattern of the relevant account or business relationship.

13 Section 11(1) of the MLA.

14 Section 10 of the MLA. Additionally, a penalty of not less than ₦1,000,000 may be imposed on financial institutions (including VASPs) for the breach of this obligation.

15 Section 10(2)(b) of the MLA.

16 Section 13 of the MLA.

17 State House, available at https://statehouse.gov.ng/president-tinubu-signs-executive-order-on-virtual-assets-establishes-council-to-harmonise-regulation-of-digital-economy/ accessed 29 July 2026.