Nigeria SEC crypto exchange registration: ARIP and the technical requirements

No crypto exchange in Nigeria holds full registration with the Securities and Exchange Commission (SEC) yet. In remarks reported by Nairametrics on 29 October 2026, the SEC’s Director General said that “no digital asset operator yet holds a final registration with the Commission.” What exists is the Accelerated Regulatory Incubation Programme (ARIP), launched in June 2024. Nairametrics counts 14 firms with an approval-in-principle under it; the SEC notices we read confirm ten admitted in July and August 2026. The SEC calls approval-in-principle “not a final licence”.

The SEC was still admitting firms to ARIP in August 2026, and draft rules issued on 20 August 2026 would make it the standard route to registration as a Digital Asset Exchange (DAX), Digital Asset Custodian (DAC) or other category. Minimum capital for an exchange rises to ₦2 billion by 30 June 2027. The draft also spells out what your systems must show: cold storage, reconciliation, tamper-evident records, 24-hour incident reports and electronic access for the SEC.

This article maps each obligation to the control in the platform, the evidence an assessor can open and the person who owns it. It is a technical reading, not legal advice, and it marks what is in force and what is still draft.

What is the status of ARIP?

Date	What happened
11 May 2022	SEC Rules on Issuance, Offering Platforms and Custody of Digital Assets (the 2022 Rules)
22 December 2023	CBN guidelines on bank accounts for VASPs
June 2024	ARIP Framework published; operating VASPs given 30 days to apply (as Aluko & Oyebode reported)
25 March 2025	President assents to the Investments and Securities Act 2025 (ISA 2025)
16 January 2026	Circular 26-1 raises minimum capital, compliance by 30 June 2027
2 July and 12 August 2026	SEC admits seven, then three more VASPs into ARIP
17 July 2026	Presidency announces an Executive Order on virtual assets coordination
20 August 2026	SEC issues draft Rules on Digital and Virtual Asset Operations, Custody and Markets

Under the June 2024 framework an applicant must be incorporated in Nigeria with a resident chief executive (para 6), show registration with the Nigerian Financial Intelligence Unit (NFIU) (para 18), pay ₦2 million and hold a fidelity bond covering 25% of required shareholders’ funds (para 20). Participants may not promote themselves or grow their customer base by more than 10% (para 29). Unauthorised commercial trading, offering or custody platforms face a penalty of at least ₦20 million (para 41).

The draft keeps ARIP as a “pre-registration assessment”, makes an approval-in-principle valid for two years and requires a platform demonstration before formal registration (rule 2(2)). Existing capital market operators and firms licensed in an IOSCO-member jurisdiction may be allowed to skip it.

What does the ISA 2025 change?

The Act commenced on 25 March 2025 and was gazetted on 2 May 2025. Section 357 defines “securities” to include “virtual and digital assets”. Section 3(3) directs the SEC to register and regulate “virtual and digital asset exchanges” and virtual asset service providers. Section 61 makes carrying on investments and securities business without registration an offence: a fine of at least ₦5 million, at least five years’ imprisonment, or both.

SEC or CBN?

Not every token is the SEC’s. Aluko & Oyebode read the Nigeria Tax Administration Act 2025 as keeping SEC oversight for virtual assets “that qualify as securities”. The Executive Order of 17 July 2026, as the Presidency described it (we could not obtain the text of the Order), puts “payment, settlement, custody and other services involving non-security virtual assets” under the Central Bank of Nigeria (CBN), which since 31 March 2026 has also run an AML supervision pilot with six VASPs; taking part in the pilot is not a licence. Ask counsel to map each service to a regulator before you design the file.

How much capital does an exchange need?

Category	Previous minimum (as listed in Circular 26-1)	Circular 26-1 (in force, by 30 June 2027)	August 2026 draft
Digital Asset Exchange	₦500 million	₦2 billion	₦2 billion
Digital Asset Custodian	₦500 million	₦2 billion	₦2 billion
Digital Asset Offering Platform	₦500 million	₦1 billion	₦500 million
Digital Assets Platform Operator	n/a	₦500 million	₦500 million
Ancillary VASP (AVASP), Circular 26-1	n/a	₦300 million	no matching category
VASP, August 2026 draft	n/a	no matching category	₦200 million

At the CBN central rate of ₦1,345.76 to the dollar on 30 October 2026, ₦2 billion is about USD 1.49 million. The draft keeps the fidelity bond at 25% of minimum capital and a registration fee of ₦30 million for an exchange (₦15 million for a VASP). The draft lists different figures for some categories, and its VASP category is not obviously the circular’s AVASP. Circular 26-1 is the instrument in force today; check for later amendments.

What do the current texts ask about your systems?

Three instruments carry the current requirements; which parts apply depends on your activities and status. The ARIP Framework asks for an operational plan covering “the type of technology or infrastructure utilized”, risk management, data protection and an exit plan (para 36). Participants file weekly and monthly trading statistics, quarterly compliance reports and incident reports (para 21), keep systems and records open for inspection (para 24) and include the Travel Rule in AML controls (para 28).

The 2022 Rules (Part E, exchanges) let the SEC ask before launch for “evidence of Information Technology (IT) assurance regarding the system readiness” and an internal auditor’s declaration covering security, continuity, data integrity, audit trail and a Chief Information Security Officer (rule 9.0). They also require a continuity plan, which “should” use a secondary site (rule 21), “real-time market surveillance” (23.5(c)) and multi-signature arrangements for client assets (24.1(b)).

The SEC AML/CFT/CPF Regulations 2022 treat every virtual asset transfer as a cross-border wire transfer. For transfers of USD 1,000 or more, the originator’s full name, wallet address and physical address, national identity number or incorporation number travel with it, with the beneficiary’s name and wallet address; below that, both parties’ names and wallet addresses (regulation 15).

What controls and evidence will an assessor look for?

The requirement column paraphrases the text, with its citation. “Draft” means the August 2026 proposed rules. The control, evidence and owner columns are our implementation recommendation, drawn from running exchange, wallet and custody software at the reference exchange since 2024 and from technical files we have prepared for licence applications. They are not legal requirements.

Requirement (citation, status)	Control in the platform	Evidence	Owner
Client assets segregated, with multi-signature (2022 Rules 24.1(b), in force); an exchange holds only hot wallets incidental to trading, other custody sits with a registered DAC it cannot control unilaterally (draft 15(5))	Client and house wallets separate; per-client ledger accounts; cold tier run by the custodian entity with its own approvers	Wallet map naming each wallet’s legal owner; chart of accounts; custody agreement	CTO, finance
Custodian keeps at least 80% of client assets in cold storage; hot and warm limited to operational needs, with documented limits (draft 5(4)(a)–(b))	Hot ceiling per asset; automatic sweep above it	Daily cold share per asset; history of limit changes	Treasury
No single person can authorise a material transaction; backups stored apart from signing systems; key-management technology meets FIPS 140-3, ISO/IEC 19790, Common Criteria or an equivalent (draft 5(5)(b), 5(6))	M-of-N approvals by amount band; named approvers; certified hardware	Policy export, approval log, key ceremony record, validation certificate naming the module and version	CISO
Reconcile client assets, report a discrepancy within 24 hours, proof of reserves above a threshold (draft 5(4)(c), 5(8)(b)); reconcile client fiat daily against bank, provider and ledger (draft 15(7)(d))	Client liabilities reconciled against on-chain holdings per asset; client sub-ledgers against the general ledger; bank statement import; breaks alerted, not hidden	Reconciliation reports, break log, reserve report showing assets, client liabilities and open breaks	Treasury, finance
Tamper-evident audit trail of orders, trades, cancellations, wallet addresses, transaction IDs and access logs (draft 15(2)(h)); records for at least seven years (draft 3(6)(b))	Append-only, hash-chained logs; archive with restore	Sample export; integrity check; restore test	CTO
Real-time market surveillance (2022 Rules 23.5(c), in force); detect wash trades, spoofing, layering; report detected abuse to the SEC within 24 hours; circuit breakers and halts (draft 15(2)(f), 15(9))	Self-trade prevention; surveillance alerts; per-market halts and price collars	Alert register; case log; halt log	Compliance officer
Incident reports (ARIP para 21, in force); initial notice within 24 hours, detailed report within 48 (draft 3(4)(b)–(c))	Alerting, incident classes, on-call, notification template	Incident register; drill timeline	CISO, CEO
Continuity plan with recovery time objectives, secondary site recommended, periodic testing (2022 Rules 21, in force); custodian audited yearly by an SEC-recognised expert, including recovery tests (draft 5(7))	Standby site; encrypted backups; timed restore drills	Board-approved plan; drill report with times; audit report	CTO
Weekly and monthly statistics, systems open to inspection (ARIP paras 21, 24, in force); API access on request; data held abroad readable (draft 3(7)(a)–(c), (i))	Reports generated from the ledger; read-only regulator role or reporting replica	Generated samples; access log; export sample	CTO, compliance
Tag domestic and cross-border flows to identifiable users (draft 3(7)(d)–(g)); Travel Rule data (AML Regulations 15, in force)	Jurisdiction tag on every transfer; Travel Rule messaging; withdrawals held when data is missing	Tagged export; message log	MLRO
Prior SEC approval for material changes to technology architecture, custody or outsourcing (draft 3(4)(a)); SEC access to outsourced records (2022 Rules 13.1(d), in force)	Architecture baseline; changes classified at release; third-party register	Change log; contracts with access clause	CTO, CEO
SEC no-objection before an asset is traded (2022 Rules 23.1, in force; draft 15(3))	A market cannot go live without an approval reference	Listing file per asset	Compliance officer

Draft rule 15(1)(b) also bars an exchange from dealing, liquidity provision or proprietary trading without express approval, and 15(9)(i) lists “global liquidity arrangements” as a conflict to disclose. If the operator quotes the book and hedges each fill elsewhere, as our Mirror engine does, describe it in the application as a separate market model, with its execution and conflict controls, and ask counsel whether it needs express approval.

What does the CBN expect from banks serving VASPs?

The CBN’s 22 December 2023 guidelines bind banks, not exchanges, but the controls land in your system. A designated account needs “evidence of a valid licence issued by” the SEC (7.3(a)); if you hold only an approval-in-principle, get the bank’s written confirmation that it accepts it. For the naira settlement account (7.9):

• the bank sees “the details of the transactions on the VASP platform leading to settlement” online, in real time;
• debits from the settlement account go only to its funding account, and withdrawals from it are limited to twice a quarter;
• collateral is 150% of the highest net debit position over the past 10 days, settlement is T+3 and the account holds no foreign-currency positions.

Our reading of what that means in practice: a bank-facing read-only feed of the transactions behind each settlement, settlement debits bound to the funding account, and a daily calculation of the highest net debit over the last 10 days for the collateral. Agree the structure with the bank.

What does the law not spell out?

General good practice beyond the wording of the texts above:

• An independent penetration test before the platform demonstration; the 2022 Rules ask for “IT assurance” without defining it.
• Timed restore drills on clean hardware, not only backup success messages.
• Separate infrastructure and approvers for the custodian entity, so the exchange cannot sign its moves even by accident.

Common gaps to check for: one hot wallet for house and client funds, statistics built in spreadsheets, the admin panel as the only window into data, and hosting contracts with no regulator access clause.

What should an operator do now?

1. Settle the perimeter with counsel: which services fall to the SEC and which to the CBN.
2. If you target Nigerian customers without authorisation, have counsel assess your position and the application route now; ISA section 61 and ARIP para 41 both carry penalties, and applying does not by itself authorise you to keep operating.
3. Plan ₦2 billion of capital for an exchange or custodian by 30 June 2027.
4. Design custody for the draft as well as current rules: the draft would limit an exchange to hot wallets incidental to trading, with other custody at a registered custodian, and make existing exchanges regularise internal custody units (15(5), 15(6)(k)).
5. Generate evidence from the system, not spreadsheets.
6. Rehearse a platform demonstration and an incident against the 24-hour clock.
7. Watch for the final rules; the draft is not yet law and may change.

Nigeria SEC digital asset FAQ

Is the SEC’s ARIP still open in 2026?

The SEC admitted seven firms on 2 July 2026 and three more on 12 August 2026, and we found no notice closing it; confirm the current intake with the SEC. The August 2026 draft would keep ARIP as the standard path to registration, with a two-year approval-in-principle.

Has any crypto exchange received full SEC registration in Nigeria?

Not as of late October 2026: in remarks reported on 29 October 2026, the SEC’s Director General said no digital asset operator yet holds final registration. ARIP firms operate on a conditional approval-in-principle, which the SEC says is not a final licence.

How much capital does a crypto exchange need in Nigeria?

₦2 billion under Circular 26-1, to be met by 30 June 2027, up from ₦500 million. Add a fidelity bond of at least 25% of minimum capital and, under the 2022 Rules and the draft, a ₦30 million registration fee.

Can a foreign exchange serve Nigerians without SEC registration?

The ARIP Framework covers foreign operators that target Nigerian investors, but applicants must be incorporated in Nigeria with a resident chief executive. The draft bars business “targeted at persons resident in Nigeria” without registration.

Do servers have to be in Nigeria?

The texts we cite set no blanket rule to host all servers in Nigeria; check your registration conditions, data-protection law and bank requirements. The draft requires timely, enforceable access for the SEC to data held abroad (rule 3(7)(i)) and lets it require custodians to keep key management or redundancy in Nigeria (rule 5(5)(e)).

Does licence-ready software make an exchange compliant?

No. Software provides controls and evidence; registration depends on your company, capital, people and conduct, and the SEC decides.

How BitPolaris helps

BitPolaris builds the exchange, wallet and custody software that has run in production at the reference exchange since 2024. It is software, not a custodian or a licence. Custody is self-hosted only, so it can run on a separately registered custodian’s own infrastructure with its own approvers: hot, warm and cold tiers with a hot ceiling per asset and automatic sweeps above it, M-of-N approvals by named officers, whitelists with a 24-hour delay, ledger-against-chain reconciliation around the clock, signed proof-of-reserves exports and an exportable log of every operator action. The exchange adds self-trade prevention, KYC tiers, roles and permissions, and reports. Optional fiat rails support EUR and TRY bank transfers; naira would be integration work to scope. Our cloud option is a dedicated EU instance, so assess it against the SEC’s outsourcing and data-access rules.

The Licence Technical Pack covers the documentation:

Item	Price excl. VAT (31 October 2026)	What you get
Lite	€1,250 one-time	For platform customers: standard sections, your regime noted
Pro	€6,300 one-time	Section by section to one regime, your diagrams, third-party register, recorded restore drill; 50% credited against a platform licence within six months
Regulator Q&A	€1,450 a month	Engineer answers to technical questions during review

Pro maps MiCA, the Central Bank of Armenia, SPK and VARA as standard; agree a Nigeria scope with us before you buy. Background: what regulators ask for and Kenya’s VASP Act checklist.

We are not a law firm and do not file applications; you and your counsel do. The pack describes controls but is not an audit or IT assurance report. Installing our software does not make anyone compliant or registered.

Sources

1. Investments and Securities Act, 2025, Official Gazette No. 19, Vol. 112, 2 May 2025, SEC copy
2. SEC, Framework on Accelerated Regulatory Incubation Program for the Onboarding of VASPs and DISPs, June 2024
3. SEC, ARIP checklist for VASP onboarding, 25 May 2025
4. SEC, Rules on Issuance, Offering Platforms and Custody of Digital Assets, 11 May 2022
5. SEC, Circular 26-1: Revised Minimum Capital for Regulated Capital Market Entities, 16 January 2026
6. SEC, Proposed Rules on Digital and Virtual Asset Operations, Custody and Markets, 20 August 2026
7. SEC, Capital Market Operators AML/CFT/CPF Regulations, 2022
8. SEC, Seven new fintech firms admitted into ARIP, 2 July 2026
9. SEC, Additional VASPs cleared for ARIP, 12 August 2026
10. Central Bank of Nigeria, Guidelines on Operations of Bank Accounts for Virtual Assets Service Providers, 22 December 2023
11. Central Bank of Nigeria, exchange rates, 30 October 2026
12. Nairametrics, SEC says no digital asset operator has secured final registration under ARIP, 29 October 2026
13. Nairametrics, Tinubu signs Virtual Assets Executive Order, 17 July 2026
14. Aluko & Oyebode, SEC Issues New Framework for Virtual Asset Service Providers, July 2024
15. Aluko & Oyebode, ISA 2025 and NTAA 2025: Further Developments in the Regulatory Oversight of Virtual Assets, c. July 2025
16. Aluko & Oyebode, CBN Commences AML/CFT/CPF Supervision Pilot for VASPs, April 2026
17. Olaniwun Ajayi LP, Developments Under the SEC Proposed Rules on Digital and Virtual Assets Operations, Custody and Markets 2026, 29 September 2026