Navigating Nigerian Fintech Regulations: CBN, SEC, And NDIC Licensing Guide

1. Introduction

A Nigerian fintech startup rarely answers to a single regulator. Depending on whether a platform moves money, holds customer balances, issues investment products, or trades digital assets, it may need to satisfy the Central Bank of Nigeria (“CBN”), the Securities and Exchange Commission (“SEC”), and the Nigeria Deposit Insurance Corporation (“NDIC”) often simultaneously. Each authority enforces distinct licensing categories, capital thresholds, and compliance schedules. These boundaries have shifted substantially following the Investment and Securities Act 2025 (“ISA 2025”) and recent regulatory circulars.

This guide maps the regulatory terrain for founders, investors, and in-house legal counsel structuring or scaling a Nigerian fintech entity.

The CBN Pathway: Payments and Deposit-Taking

Licensing Categories Under the CBN’s updated framework, the principal non-bank payment licences include:

• Payment Solution Service Provider (PSSP): Covers payment gateways, processing, and merchant integration. A PSSP cannot hold customer funds or issue wallets, making it an ideal entry point for early-stage processing startups.
• Mobile Money Operator (MMO): Permits operators to hold and move customer funds using pooled/trust accounts at deposit money banks and to issue e-wallets.
• Payment Terminal Service Provider (PTSP): Covers the deployment and maintenance of point-of-sale (POS) infrastructure.
• Switching and Processing: Covers settlement and routing infrastructure connecting banks, processors, and payment channels.
• Super-Agent: Regulates agent networks delivering agency-banking services on behalf of licensed institutions.
• Payment Service Bank (PSB): Focuses on financial inclusion. PSBs can take deposits and offer payment services, but cannot extend loans or deal in foreign exchange.

Capital requirements vary considerably. Switching and Processing licences carry a minimum paid-up capital requirement of ₦2 billion, while MMO and PSB thresholds sit at or above ₦5 billion.

Critical Distinction: Minimum paid-up share capital is distinct from the refundable escrow deposit lodged with the CBN during application. Conflating these two figures is a common and costly budgeting error for early-stage startups.

The Application Process

The CBN application follows five key stages:

1. Name reservation and incorporation with the Corporate Affairs Commission (CAC).
2. Formal application submission including business plans, governance policies, and capital verification.
3. Issuance of an Approval-in-Principle (AIP).
4. System build-out, integration testing, and on-site CBN inspection.
5. Issuance of the Final Licence.

Note: An AIP is strictly an authorization to build and test systems, it does NOT authorize an operator to onboard paying customers or process live transactions.

1. The SEC Pathway: Investment, Crowdfunding, and Digital Assets

1. When a Fintech Needs SEC Registration

A fintech that limits itself to payment processing will typically stay within the CBN’s perimeter. The moment a product touches investment products, pooled retail capital, algorithm-driven financial advice, or virtual or digital assets, however, the SEC’s jurisdiction is engaged often in parallel with, rather than instead of, any CBN requirement.

1. Crowdfunding Intermediaries

Investment-based crowdfunding is regulated under the SEC’s Rules on Crowdfunding, first issued in January 2021 and now operating within the expanded framework of ISA 2025^[1]. Any platform through which a fundraiser offers investment instruments to the public must be a registered Crowdfunding Intermediary, and the portal itself must separately register with the SEC. Registration requirements are substantial: certified incorporation documents, audited accounts, an operational manual, minimum capital, a fidelity bond, and SEC-sponsored individuals within the governance structure.

1. Robo-Advisory Services

Automated, algorithm-driven investment platforms fall within the SEC’s Rules on Robo-Advisory Services, issued in August 2021^[2]. A Robo-Adviser must satisfy the same business-conduct standards applicable to human-supervised investment advisers regulated by the SEC, and its principal officers must demonstrate relevant experience in both financial management and the underlying technology. Where the platform advises on foreign securities, it must additionally put risk-mitigation mechanisms in place for investors, and it must disclose to clients in writing the assumptions and limitations built into its algorithms and the circumstances in which the operator may override or suspend the automated advice.

1. Virtual and Digital Assets

ISA 2025 makes the most consequential change to this landscape, it expressly brings digital assets, smart contracts, and tokenised securities within the statutory definition of “securities,” and creates dedicated licence categories for Virtual Asset Service Providers and related digital-asset operators^[3]. This resolves at least on paper the jurisdictional grey zone that previously existed between the CBN and SEC over crypto-related activity. Virtual asset business is now unambiguously an SEC-regulated activity, subject to registration, capital, and disclosure obligations applicable to other regulated capital market operators.

A related SEC circular on revised minimum capital requirements, applicable to Virtual Asset Service Providers and to fintech operators generally, increased capital thresholds for several existing licence categories and introduced new thresholds for newly created digital-asset categories^[4].

1. The NDIC Touchpoint: Deposit Insurance for Fintech Customers

The NDIC does not licence fintechs. Its relevance arises because many CBN-licensed fintechs particularly Mobile Money Operators do not hold customer funds directly in their own name, but instead maintain pooled or trust accounts at a partner deposit money bank on behalf of subscribers. The NDIC extends protection to the underlying subscribers of that pool through the Pass-Through Deposit Insurance scheme^[5]. Rather than insuring the pool account as a single lump sum, the NDIC looks through the account to the individual subscriber balances it contains and insures each subscriber separately, up to the applicable coverage limit.

Coverage levels have been revised upward periodically and, as at the NDIC’s most recent general increase, stand at ₦5,000,000 per subscriber for Mobile Money Operator pool accounts aligned with the coverage level for deposit money bank customers and ₦2,000,000 per depositor for Payment Service Banks and Microfinance Banks^[6]. These figures matter to a fintech’s commercial proposition and disclosure obligations: subscriber-facing terms and marketing materials that overstate or understate the coverage actually available expose the operator to both regulatory and consumer-protection risk.

For a startup structuring its banking relationships, the practical point is that pass-through insurance is only available where the underlying pool or trust account arrangement meets the NDIC’s structural requirements including a properly documented bare trust relationship between the operator and its subscribers, and a pool account held at an NDIC-insured deposit money bank. A fintech that structures its custody arrangements loosely, or routes customer funds through an unlicensed intermediary, risks its subscribers falling outside the pass-through scheme entirely, regardless of how the product is marketed.

1. Sequencing the Pathway: A Practical Framework

The three regulatory touchpoints are not encountered simultaneously in practice, and startups that treat them as a single undifferentiated “licensing project” tend to over-engineer their early compliance spend. A more workable sequence is as follows.

1. Start with the Core Function: Identify the single activity that defines the minimum viable product, payment processing, wallet issuance, investment access, or asset custody and secure the licence that activity actually requires before building adjacent features. Most early-stage payments startups will find a PSSP licence sufficient at launch, notwithstanding the temptation to apply for a broader category in anticipation of future functionality.
2. Treat Product Expansion as a Licensing Trigger: Each new feature should be screened against the CBN and SEC perimeters before development begins, not after launch. A savings feature that begins pooling customer funds may convert a PSSP-appropriate business into one that requires an MMO licence; an investment or “round-up and invest” feature will very likely trigger SEC registration, whether as a Robo-Adviser, a crowdfunding intermediary, or otherwise, depending on how the product is structured.
3. Confirm the Deposit Insurance Position Early, Not at Crisis Point: Where a product relies on pooled customer funds, the banking partner, the account structure, and the trust documentation should be settled and the pass-through insurance position confirmed before the product is marketed to consumers. Subscriber-facing claims about fund safety should be reviewed by counsel against the actual structural position, not against a general assumption that “the funds are insured.”
4. Budget for Two Kinds of Capital: Founders raising a seed or Series A round to fund licensing should distinguish, in their capital planning, between paid-up share capital (which supports the balance sheet and is not readily recoverable) and refundable escrow or bond deposits (which are recoverable but tie up working capital for the duration of the licence’s life). Conflating the two in a cap table or investor deck is a recurring and avoidable diligence flag.
5. Common Pitfalls

1. Applying for a licence category broader than the current product requires, and carrying capital and compliance overhead the business is not yet generating revenue to support.
2. Treating an Approval-in-Principle as authorisation to onboard paying customers or move live funds.
3. Adding a savings, investment, or crypto-adjacent feature without first screening it against SEC registration requirements.
4. Marketing “fund safety” or “insured deposits” to consumers without confirming that the underlying account structure actually qualifies for NDIC pass-through coverage.
5. Underestimating the ongoing compliance burden transaction monitoring, sanctions screening, and fraud-liability obligations relative to the one-off cost of obtaining the licence itself.

1. Conclusion

The regulatory pathway for a Nigerian fintech is not a single door but a sequence of doors, each opened by a different regulator in response to what the product actually does. The CBN governs the movement and custody of money, the SEC increasingly governs where that money is invested or tokenised, and the NDIC quietly underwrites the safety net beneath both. Startups that map their product roadmap against all three regulators from the outset rather than discovering a second or third licensing obligation after launch will find the pathway considerably shorter, and considerably less expensive, than those that do not.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.