SamuelOn November 5, 2026, the Central Bank of Nigeria (CBN) introduced its Regulations for the Operations of Non-Security Virtual Assets in Nigeria, establishing new licensing, capital, governance and compliance requirements for businesses operating in the sector.
The new regulations cover several categories of virtual asset operators, such as stablecoin issuers, virtual asset service providers (VASPs), digital asset custodians, wallet providers, exchanges, payment services and platform-facilitated peer-to-peer (P2P) services. They also extend to certain foreign operators whose operations target Nigerian customers or could materially affect the country’s financial system, even without a physical presence in Nigeria.
The new framework is not limited to licensing and capital requirements but also places significant emphasis on customer identification, anti-money laundering (AML) controls, sanctions screening, transaction monitoring and regulatory reporting. As a result, businesses operating in Nigeria’s virtual asset ecosystem need to understand these requirements to prepare for regulatory supervision and maintain compliant operations.
Here is what the new CBN regulations require and how Nigerian VASPs can prepare their KYC and AML infrastructure.
What the CBN’s New Virtual Asset Regulations Require
The CBN’s new regulations establish a risk-based framework for the issuance, distribution, exchange, custody, transfer and settlement of non-security virtual assets in Nigeria. The framework covers two categories of stablecoins: Class 1, which refers to naira-referenced stablecoins, and Class 2, which refers to foreign currency-referenced stablecoins. It also covers Deposit Money Tokens and other designated non-security virtual assets.
The regulations clarify the roles of the CBN and the Securities and Exchange Commission (SEC) in overseeing virtual assets. While the CBN regulates non-security virtual assets, the SEC is responsible for those classified as securities or other capital market products. Businesses whose activities fall under both regulatory mandates may need approvals from both authorities. Read the CBN’s official Regulations for the Operations of Non-Security Virtual Assets in Nigeria for the full requirements.
Capital and licensing requirements
One of the key changes is the introduction of minimum paid-up capital requirements for regulated businesses. The CBN has set the following capital thresholds:
- Class 1 stablecoin issuers (naira-referenced): ₦10 billion
- Class 2 stablecoin issuers (foreign currency-referenced): ₦15 billion
- Other non-security virtual asset service providers: ₦1 billion
It is also important to note that other virtual asset service providers that hold an SEC licence must meet the CBN’s capital requirements in addition to those set by the SEC. The CBN may also set higher capital thresholds based on the nature of an operator’s activities and its level of risk exposure.
The regulations further require stablecoin issuers to meet reserve, liquidity and redemption obligations. These requirements are intended to support the stability of issued tokens and protect customers.
Who Needs to Comply and When?
The regulations took effect on November 5, 2026, giving existing operators a 180-calendar-day transition period to apply for the appropriate licence or authorisation. However, certain requirements begin earlier:
- Within 30 days: Register with the CBN.
- Within 60 days: Begin submitting supervisory reports, or earlier if directed by the CBN.
- Immediately: Comply with applicable AML/CFT/CPF requirements.
- Within 180 days: Submit a complete licence application.
Businesses that fail to apply within the transition period must cease the regulated activities until they obtain the required approval.
KYC and AML Compliance Requirements
Beyond licensing, the CBN requires authorised VASPs to establish effective customer due diligence and AML controls. These include:
- Customer verification: Identify and verify individual customers and corporate beneficial owners, including their NIN and BVN where applicable.
- Sanctions and PEP screening: Screen customers and relevant parties against applicable sanctions lists and identify politically exposed persons(PEPs).
- Transaction monitoring: Monitor transactions and wallet activity to detect unusual or suspicious patterns.
- Travel Rule compliance: Collect and transmit required originator and beneficiary information for virtual asset transfers.
- Suspicious transaction reporting: Report suspicious activities to the Nigerian Financial Intelligence Unit (NFIU) within the required timeframe.
- Record keeping and risk assessment: Keep accurate customer and transaction records, assess risks and regularly review compliance controls.
VASPs are also required to maintain documented AML/CFT/CPF policies, appoint a qualified Chief Compliance Officer, train employees and conduct independent compliance audits. These requirements mean businesses must show that their compliance procedures are not just documented but actively implemented and monitored.
How Nigerian VASPs Can Build Audit-Ready KYC and AML Compliance Infrastructure
Meeting the CBN’s requirements means VASPs putting the right systems, people and processes in place. Here are four practical steps VASPs should prioritise.
1. Choose compliance systems with the right capabilities
Rather than relying on separate tools that do not communicate with each other, businesses should invest in compliance systems that bring essential functions together and support:
- Automated identity and business verification.
- PEP and sanctions screening, including checks against the UN Security Council and Nigeria Sanctions lists.
- Automated transaction monitoring supported by blockchain analytics.
- Wallet risk assessment and Travel Rule information exchange.
- Alert management, case investigation and audit trails.
Ensure that the systems integrate properly with existing business operations and allow compliance teams to access relevant customer and transaction data when investigating suspicious activity.
2. Configure transaction monitoring around actual risks
Apart from installing a monitoring system, VASPs also need to configure rules that reflect the risks associated with their customers, products and transaction patterns. For example, monitoring rules should flag unusual transaction volumes, rapid transfers between multiple wallets, structuring, mixing services, suspicious P2P activity and cross-chain transfers that could obscure the movement of funds. Businesses should also set clear alert thresholds and review them regularly as their products and risk exposure change.
3. Establish an alert investigation and escalation process
It is essential to establish a clear review process for every suspicious activity alert. This includes assigning responsibility for investigating alerts, documenting findings and escalating cases that need further action. The CBN requires alerts to be reviewed and their outcomes documented within five business days, or within 24 hours where a possible sanctions match or terrorist financing is involved. Compliance teams should also put procedures in place for for preparing and submitting suspicious transaction reports to the NFIU.
4. Maintain records and regularly test compliance controls
VASPs should keep complete and well-organised records of customer verification, risk assessments, transaction activity, screening results, investigations and reporting decisions. They should also conduct regular internal reviews and independent audits to identify gaps, document findings and implement corrective measures.
Building audit-ready compliance infrastructure is an ongoing process. VASPs need systems that can identify risks, support timely investigations and provide clear evidence that their compliance controls are effective.
Talk to our team to see how Prembly can help your business manage KYC, AML screening and fraud monitoring as it prepares for the CBN’s new requirements.