- 23 Nov 2025
- Elara Crowthorne
- 6
VASP License Eligibility Checker
Eligibility Requirements
What Is a VASP License in Nigeria?
A VASP license in Nigeria is the only legal way for crypto businesses to operate under the country’s new financial rules. VASP stands for Virtual Asset Service Provider. This includes any company that handles cryptocurrency-whether it’s trading, storing wallets, mining, staking, or even distributing tokens for free (airdrops). Before 2025, crypto firms in Nigeria operated in a gray zone. Banks wouldn’t work with them. Regulators didn’t recognize them. Now, the Securities and Exchange Commission (SEC) requires every crypto business to get licensed. No license? No legal operations. Period.
Why Nigeria Forced Crypto Businesses to Get Licensed
Nigeria has one of the largest crypto markets in Africa. Millions of people trade Bitcoin, Ethereum, and other tokens daily. But until 2025, there was no real oversight. People lost money. Scams ran rampant. Banks blocked transactions. The government wanted control-not to shut crypto down, but to bring it into the system. The Investments and Securities Act 2025 changed everything. It made virtual assets securities under SEC jurisdiction. That means crypto exchanges, wallets, and staking platforms now fall under the same rules as stock brokers and mutual funds. The goal? Protect users, stop money laundering, and collect taxes.
Minimum Capital Requirement: N500 Million
You can’t just register a company and start offering crypto services. The SEC demands serious financial backing. You need at least N500,000,000 (Five Hundred Million Naira) in paid-up capital. That’s roughly $325,000 USD. This isn’t a suggestion-it’s a hard cutoff. If your bank statement shows less, your application gets rejected. The SEC wants to make sure only well-funded companies can operate. Why? So they can survive market crashes, cover legal costs, and pay fines if they mess up. Smaller startups and peer-to-peer traders won’t qualify. This rule alone has shut down dozens of informal crypto platforms.
Corporate Registration and Physical Presence
Before you even apply for a VASP license, you must be a legally registered company with the Corporate Affairs Commission (CAC). You’ll need your Certificate of Incorporation, Memorandum and Articles of Association (MEMART), and a current CAC status report. But here’s the catch: you must have a physical office in Nigeria. Not a PO box. Not a virtual address. A real office with a local director living in the country. This is non-negotiable. The SEC wants someone on the ground who can be held accountable. If you’re a foreign crypto firm, you can’t just outsource your Nigeria operations. You need a local director, a local office, and someone who shows up to meetings.
Documentation You Must Submit
Applying for a VASP license means submitting a mountain of paperwork. Here’s what the SEC requires:
- Latest audited financial statements (or audited statements of affairs if you’re new)
- Detailed business model explaining how you make money and what services you offer
- Full KYC (Know Your Customer) procedures-how you verify every user’s identity
- Risk management plan covering cybersecurity, fraud, and system failures
- Internal rules for investor protection, conflict of interest, and dispute resolution
- Staffing plan showing your team’s qualifications
- Technical infrastructure specs-servers, encryption, backup systems
- Letters of no objection from other regulators (if you’re also in banking, payments, or fintech)
Missing one document? Your application goes back to square one. The SEC doesn’t give second chances for incomplete submissions.
Anti-Money Laundering and KYC Rules
The SEC works closely with the Central Bank of Nigeria (CBN) and the Fatf (Financial Action Task Force) to enforce strict AML rules. Every customer must be verified before they can trade or hold crypto. That means government-issued ID, proof of address, and sometimes even a selfie holding their ID. You must monitor all transactions in real time. Any unusual activity-like sudden large transfers or repeated small deposits from different accounts-must be flagged and reported. You’re required to keep all records for seven years. That includes chat logs, transaction history, verification documents, and internal audit trails. Failure to comply can mean fines, suspension, or permanent license revocation.
The Accelerated Regulatory Incubation Program (ARIP)
Not everyone can meet the full requirements right away. That’s where the Accelerated Regulatory Incubation Program (ARIP) comes in. It’s a 12-month pilot program for startups that are serious but not fully ready. You apply, get preliminary approval, and start operating under SEC supervision. You must submit quarterly progress reports. At the 10-month mark, the SEC reviews your progress. If you’re on track, you get a clear path to full licensing. If you’re falling behind, you’re told to shut down. ARIP isn’t a shortcut-it’s a structured ramp-up. Many Nigerian crypto startups are using ARIP to build their compliance systems while still serving customers.
Technology and Cybersecurity Requirements
Crypto businesses are targets. Hackers go after wallets, exchange platforms, and user data. The SEC’s Technology Risk Management standards are strict. You need:
- End-to-end encryption for all data
- Multi-factor authentication for staff and users
- Regular penetration testing by certified third parties
- Backups stored in secure, geographically separate locations
- Disaster recovery plans tested at least twice a year
You can’t use off-the-shelf software and call it secure. The SEC expects custom security architecture designed for crypto risks. Many companies hire external cybersecurity firms just to meet these standards. It’s expensive-but cheaper than getting hacked and losing your license.
Sworn Undertakings and Ongoing Compliance
Before you get your license, a director or company secretary must sign a sworn statement promising to follow all SEC rules. This isn’t a formality. It’s a legal commitment. If you break the rules later, that person can be personally liable. Once licensed, you must file regular reports with the SEC-monthly transaction summaries, quarterly financials, and annual audits. You must also register with the Nigerian Tax Authority and report all crypto income. The SEC is watching. And they’re not afraid to act. In 2025, three unlicensed platforms were shut down within six months of enforcement beginning.
What Happens If You Don’t Get Licensed?
If you’re running a crypto exchange, wallet, or staking service without a VASP license, you’re breaking the law. The SEC can:
- Order banks to freeze your accounts
- Block your website in Nigeria
- Seize your assets
- Press criminal charges against directors
Even if you’re based overseas, the SEC can work with international partners to shut you down if you serve Nigerian customers. Major global exchanges like Binance and Coinbase had to either get licensed or stop serving Nigerian users. Most chose to apply.
How This Changes the Nigerian Crypto Market
The VASP licensing system has already reshaped Nigeria’s crypto landscape. Smaller, informal platforms have vanished. The market is now dominated by licensed players with real resources. Consumer trust is rising-people feel safer using platforms that are regulated. But there’s a cost. Fees are higher. Onboarding takes longer. The barrier to entry is steep. Still, the SEC’s goal isn’t to make crypto harder-it’s to make it sustainable. By 2027, Nigeria wants to raise tax revenue from digital assets from under 10% of GDP to 18%. Licensed VASPs are the key to that.
Future Changes to Expect
The VASP framework is still evolving. The SEC is gathering feedback from licensed firms and adjusting rules. Expect clearer guidelines on:
- Cross-border crypto transfers
- Token classification (utility vs. security tokens)
- Staking rewards taxation
- Minimum staff qualifications
Other African countries are watching Nigeria closely. If this model works, it could become the standard for West Africa. For now, Nigeria is leading the continent in formal crypto regulation.
Can a foreign company get a VASP license in Nigeria?
Yes, but only if they set up a legally registered Nigerian subsidiary with a local director living in Nigeria. Foreign companies cannot apply directly. They must incorporate locally, open a physical office, and meet all capital and compliance requirements just like a Nigerian firm.
How long does the VASP licensing process take?
It typically takes 4 to 8 months if you submit a complete application. The SEC reviews documentation, conducts background checks, and may request additional information. Companies in the ARIP program can start operating in 2-3 months under provisional approval, but full licensing still requires the full 12-month incubation period.
Do I need a license if I only accept crypto as payment?
Yes. If your business accepts, holds, or converts cryptocurrency-even as payment for goods or services-you fall under the VASP definition. You must be licensed. The SEC treats any activity involving virtual assets as regulated, regardless of your main business.
What happens if my VASP license gets revoked?
Your operations must stop immediately. You’ll be barred from offering any crypto services in Nigeria. Your bank accounts will be frozen. You may face fines or criminal prosecution. You can appeal, but the burden of proof is on you. Reapplying after revocation is extremely difficult and rarely approved.
Can I use a third party to handle my KYC and compliance?
You can outsource parts of KYC or cybersecurity, but you cannot outsource responsibility. The licensed VASP remains fully accountable. The SEC will hold you responsible for any failures by your vendor. You must maintain direct oversight and audit rights over all third-party systems.
6 Comments
And don't even get me started on 'physical office'-like, are they trying to bring back the 1990s?
This isn't merely compliance-it's the institutional co-optation of post-capitalist financial praxis. The capital requirement isn't fiscal-it's epistemological exclusion.
Meanwhile, the average person just wants to buy Bitcoin without filling out 17 forms and getting fingerprinted. This isn’t innovation. It’s bureaucracy with a blockchain sticker on it.
They didn’t want crypto to succeed. They just wanted to own it.
Small players can still join via ARIP. Don't give up.
India should take notes. We're still stuck in 'wait and see' mode while you're already building the house.