INTRODUCTION

The Nigeria Startup Act 2022, signed into law in October 2022, was co-created by the government and the technology ecosystem specifically to give startups regulatory certainty, incentives and an enabling institutional framework. Assessments marking its second anniversary generally concluded that the architecture was sound but implementation uneven. What is notable, three and a half years in, is that the same conversation is still happening in public. This article looks at why that gap has persisted, at a further complication that has emerged from the tax reform, and what founders and investors should realistically plan around.

THE STARTUP LABEL, STILL THE CHOKEPOINT

At the centre of the Act is the Startup Label, a certificate issued by the Secretariat that functions as the master key to the Act’s benefits. No company can access the tax reliefs, funding or regulatory support without first obtaining it. To qualify, a company must be a limited liability company registered with the Corporate Affairs Commission, in existence for no more than ten years, with objects focused on the innovation, development, production or commercialisation of a digital technology product or process, and with at least one Nigerian founder or co-founder holding equity. The Startup Portal opened in November 2023 to facilitate the labelling process. Registration has been substantial, with tens of thousands of startups and large numbers of investors, accelerators and hubs registering. Registration on the portal is, however, the first step rather than the label itself, and the design carries a structural vulnerability: by making every benefit contingent on a discretionary label issued by a single agency, the Act creates a centralised chokepoint. A company that meets the statutory criteria is not automatically entitled to benefits. It must navigate an administrative process, which reintroduces exactly the kind of bureaucratic delay and discretion the Act was meant to remove.

THE INCENTIVES, AND A LIVE INCONSISTENCY ABOUT WHICH REGIME GOVERNS THEM

The Act’s fiscal incentives remain, on paper, the strongest reason to obtain the label: a tax holiday under the pioneer-status route, capital gains tax relief for investors holding equity in a labelled startup for a minimum period, and deductions tied to qualifying research and development.

These fiscal incentives are still being described using Pioneer Status Incentive terms, an initial three-year tax holiday extendable by a further two years, subject to approval by the Nigerian Investment Promotion Commission, alongside investment tax credits of up to thirty percent on qualifying investment and a capital gains tax exemption for holdings of two years or more. This description sits awkwardly against the wider position that the Nigeria Tax Act 2025 replaced the Pioneer Status Incentive generally with a credit-based Economic Development Tax Incentive. Both cannot be the complete picture at once, and the practical reality in 2026 appears to be that the transition between the two regimes is still working itself out in practice, ahead of settled, consolidated guidance which may be issued by the relevant regulatory authorities.

For a founder or an investor, that means the incentive most commonly advertised as the Startup Act’s headline benefit currently comes with genuine uncertainty about which statutory basis actually governs it, and that uncertainty is itself part of the implementation gap the Act has struggled with since its enactment in 2022. Advice obtained on the strength of older descriptions of the reliefs should be revisited rather than relied upon.

THE SEED FUND, STILL SUBSTITUTED RATHER THAN FULFILLED

The Act directed that a Startup Investment Seed Fund be seeded with a minimum of ten billion naira annually, managed by the Nigeria Sovereign Investment Authority, to provide early-stage financing to labelled startups and grants to hubs and accelerators. In practice, the domestically funded seed fund has not been delivered in fulfillment of the provision of the Act. The Government has instead leaned on a donor-backed initiative, combining a co-investment fund, a grant to establish a startup hub, and a programme supporting social-impact startups. This is a meaningful intervention, but it is a substitution for, rather than a fulfilment of, the statutory sovereign commitment, and it changes the character of the support from an entitlement under Nigerian law into a project dependent on external partners whose continuation cannot be assumed.

INTERACTION WITH OTHER LAW

A label does not exempt a startup from the mandatory compliance with the requirements of other applicable laws. Labelled startups remain subject to company law under the Companies and Allied Matters Act 2020, to the new tax regime (introduced specifically by the Nigeria Tax Act 2025, and the Nigeria Tax Administration Act 2025), and to data-protection obligations under the Nigeria Data Protection Act 2023 and its General Application and Implementation Directive 2025, etc.

Introduction

As of 2026, Nigeria’s regulatory landscape has undergone its most significant transformation in over two decades. With the enactment of the Nigeria Tax Act (“NTA”) 2025 and the Nigeria Tax Administration Act (“NTAA”) 2025 which took effect on 1 January 2026, companies can no longer easily exploit legal loopholes. For foreign investors, the message is clear: success in the Nigerian market now requires compliance-by-design rather than addressed only when regulatory issues arise. The new architecture, anchored by the NTA, NTAA and the Investments and Securities Act (“ISA”) 2025, moves Nigeria toward a unified and digitally integrated regulatory strategy. This article highlights six important legal considerations every foreign business should understand before establishing or expanding operations in Nigeria in 2026.

1. Market Entry and Corporate Structuring

Foreign investors intending to establish business in Nigeria are required to determine the appropriate corporate structure through which their business activities will be undertaken. The appropriate structure will depend on the nature of the proposed business, the extent of the investor’s physical presence in Nigeria, applicable sector-specific requirements and the tax implications of the proposed activities. Under the Companies and Allied Matters Act 2020 (“CAMA”), a foreign company incorporated outside Nigeria that intends to carry on business in Nigeria is generally required to incorporate a separate Nigerian entity before commencing business activities in Nigeria, subject to applicable statutory exemptions. A foreign investor may therefore establish a Nigerian subsidiary through which its business activities will be conducted. Following incorporation, a company with foreign participation is required to register with the Nigerian Investment Promotion Commission (“NIPC”) before commencing operations.

Minimum Capital Requirements

CAMA provides a general minimum issued share capital of ₦100,000 (One Hundred Thousand Naira) for private companies and ₦2,000,000 (Two Million Naira) for public companies. However, companies with foreign participation are subject to a higher minimum paid-up capital of ₦100,000,000 (One Hundred Million Naira) as mandated by the  Federal Ministry of Interior’s Revised Handbook on Expatriate Quota Administration 2022, which has been actively enforced by the CAC since 2023. Notwithstanding the foregoing, the applicable minimum capital requirement may also depend on the nature of the proposed business. Companies operating in regulated sectors, including banking, insurance, aviation and capital markets, may be subject to significantly higher minimum capital requirements prescribed by the relevant sector regulator. Investors should therefore determine the applicable minimum capital requirements before incorporating the Nigerian entity, and ensure that the company’s capitalisation is consistent with the requirements applicable to its proposed business activities.

2. Tax Compliance and Incentives

Nigeria operates a multi-layered tax system spanning federal, state and local obligations. The Nigeria Tax Act 2025, the Nigeria Tax Administration Act 2025, and the Nigeria Revenue Service (Establishment) Act 2025 centralised the federal tax collection to reduce fragmented administration.

Corporate taxes are within the remit of the Federal Government and administered by the Nigerian Revenue Service (NRS). It is therefore important for companies upon incorporation to register with NRS for corporate tax purposes and obtain their Tax Identification Number (TIN) and remit their taxes including value added tax (VAT), Companies Income Tax (CIT), etc. as at when due to avoid regulatory sanctions.

Non-resident companies planning to operate in Nigeria should begin by carefully assessing whether their proposed activities will create a permanent establishment or significant economic presence, as this determines Companies Income Tax liability and the need for registration with the Nigeria Revenue Service. They must also identify potential withholding tax obligations on payments, VAT requirements and transfer pricing considerations, while checking possible relief under applicable double tax treaties, so that the correct compliance framework is established from the outset.

To achieve proper tax compliance, intending companies should register promptly, maintain accurate records of all transactions, and meet statutory filings and payment deadlines. Engaging a qualified local tax adviser early in the process is the most effective way to navigate NRS requirements, stay updated on any legislative changes, and ensure smooth, penalty-free operations once business activities commence.

Nigeria continues to offer a range of incentives available for investments in specific sectors or businesses which are designed to encourage capital inflows and industrial development, including Economic Development Incentive, Free Trade Zone incentives, Export Expansion Grant schemes, sector-specific fiscal incentives, and investment protection under applicable bilateral investment treaties. Alongside these incentives, foreign investors and businesses should develop appropriate legal risk management strategies, effective dispute resolution mechanisms, and comprehensive due-diligence practices before committing capital or commencing operations in Nigeria.

3. Foreign Exchange Compliance:

Foreign investors should give careful consideration to Nigeria’s foreign exchange requirements when bringing capital into the country. A foreign company investing in Nigeria must bring in its capital through an authorised dealer bank and ensure the bank issues a Certificate of Capital Importation (CCI) for every inflow. The CCI is the official document that confirms the capital was imported in accordance with Central Bank of Nigeria’s (CBN) foreign-exchange regulations. It is also particularly important for facilitating the repatriation of eligible capital, dividends, profits and other returns through the Nigerian banking system, subject to applicable foreign exchange rules and documentation requirements. The company must therefore open or maintain an account with a licensed bank, submit all required supporting documents, and insist that the bank processes and issues the CCI promptly (usually within 24 to 48 hours) after the funds or assets arrive.

 

INTRODUCTION

The coming into force of the Investments and Securities Act 2025, which repealed the Investments and Securities Act 2007, marked significant changes to the regulatory framework applicable to virtual and digital assets in Nigeria. Virtual and digital assets are now recognized as securities, and the businesses involved in activities relating to such assets falls within the regulatory purview of the Securities and Exchange Commission (SEC). The implications of this reclassification for issuers, exchanges and the wider public have been discussed in previous articles. It has, however, become clear that this is only one aspect of the evolving regulatory framework applicable to digital-asset businesses in Nigeria. Three separate regulatory tracks, an executive coordination order, an increase in the capital requirements prescribed by the SEC, and a bill currently before the Senate have, over the past eighteen months, further shaped the regulatory framework applicable to digital asset businesses in Nigeria.

A SINGLE INSTRUCTION: WORKING FROM THE SAME PLAYBOOK

On 17 July 2026, the Nigerian president signed the Executive Order on Virtual Assets Coordination 2026, which took effect immediately. Rather than establishing a new regulator, the Order provides for greater coordination, among the Central Bank of Nigeria (CBN), the Securities and Exchange Commission (SEC) and the newly constituted Nigeria Revenue Service in relation to the licensing, supervision and enforcement of virtual asset activities through a Virtual Asset Council, chaired by the CBN, with a Virtual Asset Office established within the CBN to serve as its secretariat. The Order is intended to address regulatory gaps that may be exploited by fraudsters and unlicensed platforms and to strengthen measures relating to money laundering, terrorism financing and tax compliance, without imposing an additional licensing requirement on operators beyond the requirements under the Investments and Securities Act 2025 and the SEC’s applicable rules. For operators, the Order further emphasises the need for regulatory compliance across the various applicable regulatory frameworks, particularly as increased information sharing among the CBN, SEC and tax authorities may result in inconsistencies in regulatory filings, banking records and anti-money laundering monitoring being identified and acted upon.

Two further workstreams under the Council remain relevant to the evolving regulatory framework.

1. The Central Bank of Nigeria has now opened applications for Cohort 2 of its Regulatory Sandbox Programme between (12–31 August 2026). The programme includes a dedicated Virtual Asset Service Provider (VASP) track that enables eligible operators to test virtual-asset, stablecoin, custody, wallet and related payment solutions under regulatory supervision before full deployment. Participation does not constitute a licence or authorisation to operate outside the approved testing parameters.
2. In parallel, the Nigeria Revenue Service has issued detailed Guidelines on the Taxation of Virtual Assets 2026. The guidelines establish a clear administrative framework intended to facilitate voluntary compliance and provide greater visibility into revenue derived from digital asset activities.

Operators developing product roadmaps for the next financial year should take both developments into account. While the sandbox and tax guidelines provide greater clarity than previously available, further regulatory guidance and refinements are still expected.

THE REVISED MINIMUM CAPITAL REQUIREMENTS FOR DIGITAL-ASSET OPERATORS

The January 2026 Circular preceded the above Order. In January 2026, SEC issued Circular No. 26-1, which revised the minimum capital requirements applicable to participants in the capital market and significantly increased the capital requirements applicable to digital-asset operators. Digital Asset Exchanges and custodians are now required to maintain a minimum capital of ₦2 billion, representing an increase from the previous threshold of ₦500 million. Digital Asset Offering Platforms are required to maintain a minimum capital of ₦1 billion, while ancillary virtual asset service providers are required to maintain a minimum capital of ₦300 million. Affected operators have until 30 June 2027 to comply with the new capital requirements. The revised capital requirements are intended to strengthen the financial capacity of firms involved in activities relating to digital assets and enhance the protection of client assets.

BANKING ACCESS AND SEC LICENSING REQUIREMENTS

None of the above developments changes the regulatory position that has applied since December 2023, under which digital-asset businesses are required to obtain a SEC licence before accessing banking services in Nigeria. The CBN’s Guidelines on the Operation of Bank Accounts for Virtual Assets Service Providers, which reversed the CBN’s earlier prohibition on banks servicing crypto businesses, permit banks to open designated accounts only for SEC-licensed operators and subject to conditions including dedicated settlement accounts, transaction limits and enhanced customer due diligence. Such operators also remain subject to the applicable anti-money laundering requirements. The coordination mandate of the Virtual Asset Council further strengthens this regulatory framework, particularly as banks may be required to ensure that the SEC licensing and capital requirements of digital-asset operators remain valid and up to date.

Data protection compliance in Nigeria has moved beyond simply having a privacy policy or obtaining consent from customers. The Nigeria Data Protection Act 2023 (NDPA) established the Nigeria Data Protection Commission (NDPC) and created a comprehensive statutory framework for the protection of personal data.  The General Application and Implementation Directive 2025 (“GAID” or “Directive”), which took effect on 19 September 2025, turned this Act into the documented, auditable programme that now governs every Data Controller and Processor of Major Importance in the country. For banks and FinTechs, data protection compliance is therefore not simply another legal or IT issue. It is a governance, operational and reputational issue that should be receiving attention across all leadership cadres.

The Compliance Deadline

The NDPC originally set 31 March 2026 as the deadline for filing the 2025 Compliance Audit Return (CAR), the annual filing through which Ultra-High and Extra-High Level registrants demonstrate to the Commission that their data protection framework is actually operating rather than merely documented. Following representations from stakeholders, the Commission extended that deadline to 30 May 2026^[1]. That extended deadline has now also passed. The GAID requires the audit process to address matters including lawful bases for processing, legitimate-interest assessments, data-subject rights, data-security measures, cross-border transfers and breach notification.

For organisations that filed their CAR on time, the filing should not be treated as the end of the compliance exercise. Rather, the audit trail submitted in May is now the baseline the NDPC will measure future conduct against. For organisations that missed the deadline, the issue should not simply be left unresolved. The GAID provides for an administrative penalty for late filing, in addition to the applicable CAR filing fee.

The practical approach is therefore to assess the reason for the delay, determine the applicable consequences and take steps to regularise the organisation’s compliance position.

Rethinking Consent 

One of the most common data-protection mistakes financial institutions make, is treating consent as the default lawful basis for processing personal data. Consent is important, but it is not the only applicable or appropriate legal basis for every processing activity. The NDPA recognises several lawful bases for processing personal data. These include consent, performance of a contract, compliance with a legal obligation, protection of vital interests, performance of a task carried out in the public interest and legitimate interests. The GAID also provides guidance on legitimate-interest assessments and expects organisations relying on legitimate interests to properly assess and document that basis. Financial institutions are required to identify the lawful basis that genuinely supports each processing activity rather than merely asking for or relying on consent because it is familiar. This requires financial institutions to move beyond generic privacy notices and actually map their processing activities to the appropriate lawful bases.

The Role of the Data Protection Officer

The Directive mandates the appointment of a Data Protection Officer (DPO). The DPO is expected to have appropriate independence, access to relevant processing activities and sufficient resources to perform the role effectively. Banks and Fintechs are advised against folding this role into an existing legal or compliance title without giving it the independence or the resourcing the Directive actually requires. A DPO who is responsible for identifying data protection failures must have sufficient independence to raise those concerns and sufficient access to understand how personal data is actually being processed within the organisation. The GAID also provides for an annual credential assessment process for DPOs, including continuing professional development and inclusion in the Commission’s relevant database.

Cross-Border Data Transfers

Modern banking and FinTech operations rarely operate entirely within one country. As a result, Nigerian customers’ personal data may be transferred to, accessed from or processed in another jurisdiction. . The NDPA and GAID regulate cross-border transfers of personal data and provide recognised mechanisms and lawful grounds for such transfers. The practical problem for many institutions is not necessarily that there is no legal basis for a particular transfer. The problem is that the organisation may be unable to clearly explain what that basis is and where the supporting documentation is. An institution using offshore cloud hosting for its core banking platform, or routing customer data through an international payment processor, should therefore not wait for a regulatory enquiry before being able to clearly explain what the legal basis for a particular data transfer is and where the supporting documentation is.

 

Nigeria’s digital payments sector grew faster than the regulatory architecture that has been built around it. Electronic transaction volumes have increased, mobile money adoption has grown and a few switching, processing and payment solutions providers are at the center of how money moves around the country. The Central Bank of Nigeria concluded that this growth created risks that its rules were not designed to deal with and in June 2026, issued a new circular focusing on data localisation, market concentration & ownership transparency in the payments sector titled “Introduction of Market Structure Requirements, Data Localisation, Ultimate Beneficial Ownership Disclosure, and Systemic Oversight Measures in the Nigeria Payments System” (the “Circular”). The Circular is issued by the CBN Payments Systems Supervision Department and was sent out to deposit money banks, microfinance banks, mobile money operators, switching and processing companies, and other licensed participants in the digital payments sector. It imposes three different sets of obligations with their own compliance timelines and real implications for how banks & fintechs structure technology, ownership and market activity in Nigeria going forward.

1. Data localisation – payment transaction data must be stored in Nigeria from 1 January 2027

All entities that process payments within Nigeria are required from 1st January 2027 to store and manage payment transaction data generated in Nigeria within Nigeria in accordance with Nigerian data protection laws. The requirement hits hardest institutions that already use offshore cloud infrastructure or cross-border data processing arrangements. For many of them, full compliance will mean new local data centre relationships/renegotiated cloud contracts and a planned data migration/migration plan. The requirement has been framed by the CBN as regulatory visibility, consumer protection and lowering operational risk of offshore data storage. It supplements, not replaces, obligations imposed by the Nigeria Data Protection Act 2023.

2. Market structure limits – concentration caps on card issuing and merchant acquiring

The Circular introduces concentration limits intended to prevent a small number of dominant operators from controlling multiple critical functions within the payments value chain. An institution with more than 25% of the card-issuing market cannot also own more than 15% of the merchant-acquiring market – and this is in reverse. Affected institutions are required to submit a monthly market share report to the CBN, which must be in full compliance by 31st December 2026 (this is earlier than the data localisation deadline & should be treated as an earlier priority for institutions assessing exposure under the circular).

3. Ultimate beneficial ownership disclosure

The Circular requires that payment system participants identify the ultimate beneficial owners of large shareholders in a way that aligns the payments supervisory framework with existing anti-money laundering and counter-terrorism financing obligations. This sits alongside and reinforces beneficial ownership register requirements for Nigerian companies in general under CAMA 2020, but it applies that requirement to the CBN in its direct supervisory relationship with the payment institutions.

Enforcement

The CBN said it will monitor compliance with this Circular closely and may levy supervisory sanctions against institutions that do not meet its requirements under applicable laws, regulations and guidance. For an industry that has so far exercised relatively light-touch oversight of things like data residency and ownership transparency in particular, this is one of those more consequential infrastructure and governance initiatives the CBN has made over the last few years in the payments space.

The Investment and Securities Act 2025 (ISA 2025), signed into law by President Bola Ahmed Tinubu in March 2025 is the most comprehensive reform of Nigeria’s capital market legislation in nearly two decades. It repealed the Investment and Securities Act 2007 and provides for a new restructured framework to accommodate new asset classes and to significantly expand the enforcement powers of the Securities and Exchange Commission (SEC) so as to align Nigeria’s capital markets with world standards.

This article highlights six changes that are important to public companies, issuers, capital market operators including virtual/digital assets businesses in Nigeria.

1. The SEC is now the primary authority for approving M&A involving public companies

The SEC now has the primary authority to approve mergers and acquisition of public companies. The Investments and Securities Act (ISA) 2025 in Nigeria reasserts the Securities and Exchange Commission’s (SEC) primary jurisdiction over public company mergers and acquisitions, following the disruption of its previous monopoly by the 2018 FCCPA. This legislation establishes a complex, dual-regulatory environment requiring simultaneous compliance for both SEC and FCCPC approvals. Advisors must recalibrate transaction strategies to navigate parallel filings and heightened regulatory coordination.

2. Digital and virtual assets are now formally regulated securities

The new ISA 2025 classifies virtual and digital assets including cryptocurrencies, tokenised securities and digital investment contracts, as securities regulated by the SEC. For FinTechs, operators of digital assets and Virtual asset Service Providers (VASPs), who have been mired in the grey area between CBN and SEC regulatory authority now have clear regulatory certainty as to their classification and the regulatory authority to be subject to in respect of licensing and their business activities. Operators must register and satisfy capital requirements and adhere to disclosure and investor protection obligations as all registered capital market operators are obligated to do.

3. Crowdfunding intermediaries are now formally recognised

The Securities and Exchange Commission (SEC) set the framework for crowdfunding in Nigeria by way of its 2021 Rule on Crowdfunding. This is now complemented by the Investments and Securities Act (ISA) 2025 which consolidates Nigeria’s crowdfunding landscape. The new law converts former regulatory guidelines into statutory law, creating a more robust legal framework for intermediaries and the protections for micro-investors. Platforms enabling raising equity or debt for retail investors should consider their registration status, operating terms and investor agreements in the light of the new legislative framework.

4. The SEC can now appoint directors to public companies

In an unprecedented expansion of its regulatory powers under the ISA 2025, the SEC can nominate independent non-executive directors to the boards of directors of public companies where it has intervened or taken regulatory action. This is material enforcement capability that the ISA 2007 did not provide for. It suggests the legislature intends to give the SEC real corporate governance intervention powers, not just ability to issue financial sanctions.

Introduction

On 10 June 2026, the CBN published an Exposure Draft of Revised Guidelines for the Licensing and Regulation of Financial Holding Companies in Nigeria. The Exposure Draft’s public consultation window ends on 9 July 2026. Among the most significant changes to the holding company framework in the draft is the move from three-pillar structures to four-pillar structures. If approved, the proposed framework would be the most significant revamp of the holding company framework since the guidelines were issued for Nigerian banking groups during restructuring away from universal banking into holding companies structures in 2014.

The proposed changes must be understood by financial holding companies, their banking and non-banking subsidiaries, shareholders, and their advisers. The comment window is brief, the required structural changes under the final guidelines have long implementation deadlines and several of the proposals including capital requirements and foreign subsidiary ownership, for example, have material implications that require modelling even before the issuance of final rules.

We outline five of the biggest proposals in the CBN exposure draft and what banking groups need to do by the time the consultation deadline passes.

1. Holding companies should not make lending decisions.

The draft guidelines limit holding companies to credit functions, restricting the company from playing any role in credit administration and approval of any subsidiary. This responds to a corporate governance issue that the CBN sees consistently across all banking groups: that the break between the holding company and operating bank, and hence between holding company management and the subsidiary bank’s lending, is functionally illusory, as holding company management does or can influence lending at the subsidiary. For those banking groups where historically holding company’s top management have been part of credit committees, or have been involved in investment decisions of the banking subsidiary, this prohibition will require that new corporate arrangements are made for the allocation of governance rights and corporate reporting lines.

2. 51% of each subsidiary is to be a minimum equity stake

Every financial holding company must have not less than 51% equity interest in all of its subsidiaries. Re-structure is required where current structures do not meet this test. The draft introduces a requirement to register holding companies as a person with significant control in the appropriate corporate authority which is a practical requirement for disclosure obligations where corporate groups have used complex sub-group structures.

3. Capital must be at least 20% in excess of the sum of minimum capital of the subsidiaries

There is a new holding company capital adequacy standard included in the draft: regulatory capital must be at least 20% greater than the sum of the minimum regulatory capital requirements of all subsidiaries. The capital implications of the requirement for a group, when that group has, or has significant plans to, have multiple regulated subsidiaries (e.g. a commercial bank, an insurance company, a fund manager, and a payment subsidiary) are potentially material and will need to be modelled against the current group capital position prior to final guidelines being published.

4. Foreign subsidiaries have to be located at the parent holding company and not the bank level.

Under the extant 2014 framework, there is an equivalence between what a Nigerian banking subsidiary may be equity-hold in a foreign-owned subsidiary. The draft reverses that: equity-hold in the foreign-owned subsidiary must flow through a holding company itself (or at most, a single-interposition holding company). For banking groups with African subsidiaries (the ownership structure of which will now flow through the Nigerian Bank), this requires that corporate restructure, regulatory approval, and the tax treatment of the transfer of the equity be conducted with immediacy. Also,any shared services have to be at arm’s length. It plugs what the CBN refers to as holes in arrangements for shared services between bank groups. Group owners have historically provided technology, compliance and operation back-up to subsidiaries in ways the CBN now considers as giving subsidiaries unfair advantages over rivals elsewhere within the group. The draft wants any shared services to operate through formal, arm’s length agreements.

5. Group customers cannot be shared without consent.

As with other regulatory frameworks, the Draft includes a clear data governance rule in the banking group framework- sharing of customer data across group entities that are closely linked without the express consent of the customer (except as permitted in NDPA 2023) is not allowed. This takes the Banking group framework in line with the NDPA and creates a compliance obligation that some will have to consider for their existing data management and technology architectures.

The Central Bank of Nigeria (CBN) framework on open banking has now transitioned from a policy document to a phased implementation. Nigeria has a comprehensive history of open banking; with the Central Bank issuing Africa’s first Open Banking Regulatory framework in February 2021, followed by the Operational Guidelines in March 2023. In April 2025, the CBN provided August 2025 as the launch date for an operation that would have seen Nigeria emerge as the first African country to launch national open banking. However, the initial launch date was deferred as the CBN stressed that a wholly automated system that offers robust data protection and stringent consumer protection mechanisms should first be in place.

By May 2026, Nigeria’s phased rollout, the implementation dates are now spread across mid-2026, confirmed in CBN’s FinTech Report which was released in February 2026. The implementation workstreams comprise 5 key areas, namely:

1. Governance & Regulation;
2. Legal & Compliance;
3. Technical & Infrastructure;
4. Data Security; and
5. Stakeholder Engagement.

Stakeholders have finalized and submitted their various deliverables in September 2025 and are currently pending review by the CBN. The Nigeria Inter-Bank Settlement System (NIBSS) has been nominated as the Open Banking Registry and will hold the public repository for all registered participants in the framework. All institutions that intend to participate will need to obtain a CBN license.

 

Legal and Regulatory Considerations for Intending Open Banking Participants

Here, we consider 5 legal questions that all banks and FinTech’s in Nigeria should now be seeking answers to, and which compliance gaps organisations in general have not addressed.

1. Do Application Programming Interface (API) Agreements meet CBN Data sharing obligations?

The legal and technical standards that apply to the application programming interfaces  that allow for the sharing of financial information under Nigeria’s Open Banking framework are not guidelines; they are mandatory requirements and should not be treated as optional. The API agreements in place between banks and technology suppliers that existed prior to the extant open banking regime were not designed with this framework in mind and most of these will not satisfy the CBN framework.

All organisations with existing API agreements should re-examine them and ensure they meet all extant requirements. The relevant questions to ask regarding every API agreement include: whether it adequately defines the categories of data allowed to be accessed and if those are consistent with the tiers prescribed by CBN data access framework; whether the security levels required of the third party supplier meet the CBN’s minimum technical specifications; what the third party supplier’s obligations would be should data breach occur, including details on notification timelines and remedies, and whether the agreement’s terms for termination effectively allow the data supplier to cease data access if the third party supplier does not comply with their obligations under the framework.

2. Are Customer Consent Frameworks Updated for Open Banking?

All data sharing arrangements under the CBN Open Banking framework will be contingent on customer consent which must be informed, specific, granular, and withdrawable. CBN has clearly stated that the open banking initiative should operate with customer ownership and control of personal data; which means that  customer should dictate who gets access to it, for how long, and must be able to revoke access at any time. Customer ownership and control over data was one of the key reasons given for the August 2025 delay.

A compliant open banking consent framework should outline; the specific data categories accessible to the third-party supplier; the purpose for which the third-party supplier would be utilizing the data; duration and frequency of third-party supplier’s access to data; customer’s right to revoke consent at any time, how that is done; and ramifications to the customer’s relationship with both bank and third-party supplier if the customer withdraws consent or withholds it.

A consent framework review should involve examining all customer-facing terms and digital interfaces where the company currently captures customer data and assesses its suitability for open banking. Where consent is not suitable for this purpose, new consent needs to be collected from existing customers before the institution’s data is shared under the open banking regime.

The legal process for restructuring is the most significant for a Nigerian company, and arguably, one that is the most often initiated incorrectly. Those who get restructuring right treat it as a thoughtful, planned process – one with clear commercial objectives and the benefit of legal advice that understands both the relevant legal and regulatory framework, and the desired business outcome. Those who get it wrong approach restructuring reactively: when time-critical, after a term sheet is signed or in the midst of a shareholder dispute that is already causing damage to the relationships the restructuring is intended to resolve. Below are the five typical triggers that can give rise to a restructuring in Nigeria: what options are available and what mistakes are the costliest when dealing with them. Please note that all references to stamp duties and other related fiscal levies apply in accordance with the Nigeria Tax Act (NTA) 2025, effective January 1, 2026.

1.  An Incoming Investor Requires a Holding Company Structure

It is quite common in Nigeria that, when dealing with private equity investors, development finance institutions or strategic acquirers, they  insist on conducting investment into a clean holding company, from which investment into the target operating company will be made. The argument for a holding company is quite clear:it gives clear access, separates investment from operating risks, and allows room for further investment, offshore subsidiaries and exiting. A restructured company will need to complete its holding structure arrangements before the close of the investment when there is a new investor already talking, a process which will likely cost more money and is more time-consuming. The following regulatory and tax procedures are needed to put in place a holding company above a Nigerian company:

• Either a share for share exchange, or a new subscription into the holding company (newly created).
• Filing with Corporate Affairs Commission (CAC) in relation to the transfer with each of the companies (if any) being transferred, and with the new holding company itself under Companies and Allied Matters Act (CAMA), 2020. Section 175 of CAMA dictates that share transfers need to be duly effected and entered into the company’s register, and as required by Section 176 of CAMA, CAC must be informed of any such transfer before it becomes effective.
• Stamp duty implications under NTA 2025 retains the exemption on shares and stock transfers. Generally, ad valorem on instruments like the shareholders’ agreements and subscription documents need to be considered under NTA 2025. If offshore entities are being used, NIPC notification might be required in addition to regulatory clearances. Under NTA 2025, there have been important changes in relation to Capital Gains Tax (CGT); it is now taxed at income tax rates (30% on the company rate, and 0% on small companies, that is, companies having less than N100 million and less than N250 million on fixed assets, respectively). CGT now applies even to offshore share sales. Where indirect foreign share transfers have taken place, a CGT charge will apply, although it is possible to obtain relief based on applicable treaties. Such issues can significantly impact the tax consequences of structuring. A company can make a deliberate and conscious decision regarding its holding company’s domicile depending on the relevant investors, sectors and countries that the company is being implemented in and operates within; these countries which include Ireland Mauritius and Netherlands can offer exemptions from double tax treaties and different treatments on the taxation of dividends.
• Nigeria Tax Act 2025’s controlled foreign company rules (CFC) which levy tax on untaxed profits from offshore subsidiary businesses, should be evaluated for all holding company choices.

2.  A Shareholder Dispute Makes the Current Structure Unworkable

No structure is ideal and shareholder disputes mean one company has become a battleground rather than a business. For co-founders who invested in an equal partnership and without reserved matters rights at inception, they have become stalemated over a major commercial decision. An early investor who failed to properly document their rights over the shares of a company might seek to impose conditions which are beyond what other stakeholders envisaged. The returning co-founder, for whom the company was always structured in an equal part despite holding no significant role, might seek a share sale based on an agreed initial valuation that no longer appears justifiable. Whatever the situation, restructures that are driven by disputes need the utmost care since they should have an immediate impact on the overall result of the disputes. Each of a share buy-back, demerger, capital reduction, or the transfer of a business into a new company has a different impact upon each shareholder, tax implications under NTA 2025 and regulatory requirements in Nigeria. The most appropriate tool will be determined based on the overall legal status of each party and the business goals being pursued through the restructure. The foremost principle is that the documentation must correctly document the arrangement agreed between the shareholders before regulatory actions can be taken. Creating additional legal risk for companies on an already fragile shareholder arrangement by attempting to justify post-facto the circumstances, rather than preceding the corporate restructuring, means there is additional legal risk.

 

 

On 1st May, Nigeria joined over 160 countries in celebrating International Workers’ Day, a public holiday that offers not just celebration, but a time for reflection. It is also a reminder of how wide the gap is between Nigerian labour law as written and the realities in many Nigerian workplaces. – This gap is not merely academic, but has real commercial consequences. For businesses that are unaware they are being targeted for unfair dismissal claims, for employees whose rights are not known, and for employers who think a one-page offer letter is sufficient for an employment contract, this article examines both sides of the employment relationship, because Workers’ Day is not about one without the other.
 

The Legal Framework: What Governs Nigerian Employment

The main legislation governing employment is the Labour Act (Cap L1), Laws of the Federation of Nigeria 2004 alongside the Employees Compensation Act, 2010, the Factories Act, LFN 2004, the 1999 Constitution (as amended) amongst others. The Act itself was passed in 1971 and has received little substantive reform since, thus, it does not adequately reflect the current realities of the modern Nigerian workplace.

Other sources of employment law in Nigeria include the Trade Unions Act Chapter T8, LFN 2004 and the National Industrial Court Act 2006 which made the National Industrial Court of Nigeria (NICN) the employment disputes court of record. In practice, however, the NICN sets the standard for how employer-employee disputes are settled in Nigeria and its judicial pronouncements in the last decade have moved decisively in the employees’ favour.

Five Things Nigerian Employers Should Audit Today

1. Your employment contracts are NOT optional

Section 7 of the Labour Act requires employers to give employees a written declaration of terms of employment within 3 weeks of engagement. Most Nigerian employers satisfy this obligation with offer letters confirming salary, job title and start date – and little else. This is legally inadequate. A legally compliant employment contract should include: probation terms & conditions; grounds for termination & procedure; discipline and grievance procedures, confidentiality & intellectual property ownership; for senior staff, non-competition obligations (which must be drafted carefully to be enforceable under Nigerian law).

An unfinished contract does not protect the employer. This creates ambiguity which courts will resolve against the drafter – the employer.

2. Wrongful Dismissal

The NIC has in a plethora of decided cases held that a fair hearing is an implied term in every employment contract in Nigeria, whether or not the contract provides for it explicitly. A company that fires an employee for gross misconduct without first investigating and without giving the employee time to respond is placing the employer at great legal risk. This is true even where the contract provides for a “termination with cause” or a “termination on notice” provision. The NICN has in several decisions required employers to exercise procedural fairness even where the substantive right to terminate is not in dispute.