INTRODUCTION

The Nigeria Startup Act 2022, signed into law in October 2022, was co-created by the government and the technology ecosystem specifically to give startups regulatory certainty, incentives and an enabling institutional framework. Assessments marking its second anniversary generally concluded that the architecture was sound but implementation uneven. What is notable, three and a half years in, is that the same conversation is still happening in public. This article looks at why that gap has persisted, at a further complication that has emerged from the tax reform, and what founders and investors should realistically plan around.

THE STARTUP LABEL, STILL THE CHOKEPOINT

At the centre of the Act is the Startup Label, a certificate issued by the Secretariat that functions as the master key to the Act’s benefits. No company can access the tax reliefs, funding or regulatory support without first obtaining it. To qualify, a company must be a limited liability company registered with the Corporate Affairs Commission, in existence for no more than ten years, with objects focused on the innovation, development, production or commercialisation of a digital technology product or process, and with at least one Nigerian founder or co-founder holding equity. The Startup Portal opened in November 2023 to facilitate the labelling process. Registration has been substantial, with tens of thousands of startups and large numbers of investors, accelerators and hubs registering. Registration on the portal is, however, the first step rather than the label itself, and the design carries a structural vulnerability: by making every benefit contingent on a discretionary label issued by a single agency, the Act creates a centralised chokepoint. A company that meets the statutory criteria is not automatically entitled to benefits. It must navigate an administrative process, which reintroduces exactly the kind of bureaucratic delay and discretion the Act was meant to remove.

THE INCENTIVES, AND A LIVE INCONSISTENCY ABOUT WHICH REGIME GOVERNS THEM

The Act’s fiscal incentives remain, on paper, the strongest reason to obtain the label: a tax holiday under the pioneer-status route, capital gains tax relief for investors holding equity in a labelled startup for a minimum period, and deductions tied to qualifying research and development.

These fiscal incentives are still being described using Pioneer Status Incentive terms, an initial three-year tax holiday extendable by a further two years, subject to approval by the Nigerian Investment Promotion Commission, alongside investment tax credits of up to thirty percent on qualifying investment and a capital gains tax exemption for holdings of two years or more. This description sits awkwardly against the wider position that the Nigeria Tax Act 2025 replaced the Pioneer Status Incentive generally with a credit-based Economic Development Tax Incentive. Both cannot be the complete picture at once, and the practical reality in 2026 appears to be that the transition between the two regimes is still working itself out in practice, ahead of settled, consolidated guidance which may be issued by the relevant regulatory authorities.

For a founder or an investor, that means the incentive most commonly advertised as the Startup Act’s headline benefit currently comes with genuine uncertainty about which statutory basis actually governs it, and that uncertainty is itself part of the implementation gap the Act has struggled with since its enactment in 2022. Advice obtained on the strength of older descriptions of the reliefs should be revisited rather than relied upon.

THE SEED FUND, STILL SUBSTITUTED RATHER THAN FULFILLED

The Act directed that a Startup Investment Seed Fund be seeded with a minimum of ten billion naira annually, managed by the Nigeria Sovereign Investment Authority, to provide early-stage financing to labelled startups and grants to hubs and accelerators. In practice, the domestically funded seed fund has not been delivered in fulfillment of the provision of the Act. The Government has instead leaned on a donor-backed initiative, combining a co-investment fund, a grant to establish a startup hub, and a programme supporting social-impact startups. This is a meaningful intervention, but it is a substitution for, rather than a fulfilment of, the statutory sovereign commitment, and it changes the character of the support from an entitlement under Nigerian law into a project dependent on external partners whose continuation cannot be assumed.

INTERACTION WITH OTHER LAW

A label does not exempt a startup from the mandatory compliance with the requirements of other applicable laws. Labelled startups remain subject to company law under the Companies and Allied Matters Act 2020, to the new tax regime (introduced specifically by the Nigeria Tax Act 2025, and the Nigeria Tax Administration Act 2025), and to data-protection obligations under the Nigeria Data Protection Act 2023 and its General Application and Implementation Directive 2025, etc.

Introduction

As of 2026, Nigeria’s regulatory landscape has undergone its most significant transformation in over two decades. With the enactment of the Nigeria Tax Act (“NTA”) 2025 and the Nigeria Tax Administration Act (“NTAA”) 2025 which took effect on 1 January 2026, companies can no longer easily exploit legal loopholes. For foreign investors, the message is clear: success in the Nigerian market now requires compliance-by-design rather than addressed only when regulatory issues arise. The new architecture, anchored by the NTA, NTAA and the Investments and Securities Act (“ISA”) 2025, moves Nigeria toward a unified and digitally integrated regulatory strategy. This article highlights six important legal considerations every foreign business should understand before establishing or expanding operations in Nigeria in 2026.

1. Market Entry and Corporate Structuring

Foreign investors intending to establish business in Nigeria are required to determine the appropriate corporate structure through which their business activities will be undertaken. The appropriate structure will depend on the nature of the proposed business, the extent of the investor’s physical presence in Nigeria, applicable sector-specific requirements and the tax implications of the proposed activities. Under the Companies and Allied Matters Act 2020 (“CAMA”), a foreign company incorporated outside Nigeria that intends to carry on business in Nigeria is generally required to incorporate a separate Nigerian entity before commencing business activities in Nigeria, subject to applicable statutory exemptions. A foreign investor may therefore establish a Nigerian subsidiary through which its business activities will be conducted. Following incorporation, a company with foreign participation is required to register with the Nigerian Investment Promotion Commission (“NIPC”) before commencing operations.

Minimum Capital Requirements

CAMA provides a general minimum issued share capital of ₦100,000 (One Hundred Thousand Naira) for private companies and ₦2,000,000 (Two Million Naira) for public companies. However, companies with foreign participation are subject to a higher minimum paid-up capital of ₦100,000,000 (One Hundred Million Naira) as mandated by the  Federal Ministry of Interior’s Revised Handbook on Expatriate Quota Administration 2022, which has been actively enforced by the CAC since 2023. Notwithstanding the foregoing, the applicable minimum capital requirement may also depend on the nature of the proposed business. Companies operating in regulated sectors, including banking, insurance, aviation and capital markets, may be subject to significantly higher minimum capital requirements prescribed by the relevant sector regulator. Investors should therefore determine the applicable minimum capital requirements before incorporating the Nigerian entity, and ensure that the company’s capitalisation is consistent with the requirements applicable to its proposed business activities.

2. Tax Compliance and Incentives

Nigeria operates a multi-layered tax system spanning federal, state and local obligations. The Nigeria Tax Act 2025, the Nigeria Tax Administration Act 2025, and the Nigeria Revenue Service (Establishment) Act 2025 centralised the federal tax collection to reduce fragmented administration.

Corporate taxes are within the remit of the Federal Government and administered by the Nigerian Revenue Service (NRS). It is therefore important for companies upon incorporation to register with NRS for corporate tax purposes and obtain their Tax Identification Number (TIN) and remit their taxes including value added tax (VAT), Companies Income Tax (CIT), etc. as at when due to avoid regulatory sanctions.

Non-resident companies planning to operate in Nigeria should begin by carefully assessing whether their proposed activities will create a permanent establishment or significant economic presence, as this determines Companies Income Tax liability and the need for registration with the Nigeria Revenue Service. They must also identify potential withholding tax obligations on payments, VAT requirements and transfer pricing considerations, while checking possible relief under applicable double tax treaties, so that the correct compliance framework is established from the outset.

To achieve proper tax compliance, intending companies should register promptly, maintain accurate records of all transactions, and meet statutory filings and payment deadlines. Engaging a qualified local tax adviser early in the process is the most effective way to navigate NRS requirements, stay updated on any legislative changes, and ensure smooth, penalty-free operations once business activities commence.

Nigeria continues to offer a range of incentives available for investments in specific sectors or businesses which are designed to encourage capital inflows and industrial development, including Economic Development Incentive, Free Trade Zone incentives, Export Expansion Grant schemes, sector-specific fiscal incentives, and investment protection under applicable bilateral investment treaties. Alongside these incentives, foreign investors and businesses should develop appropriate legal risk management strategies, effective dispute resolution mechanisms, and comprehensive due-diligence practices before committing capital or commencing operations in Nigeria.

3. Foreign Exchange Compliance:

Foreign investors should give careful consideration to Nigeria’s foreign exchange requirements when bringing capital into the country. A foreign company investing in Nigeria must bring in its capital through an authorised dealer bank and ensure the bank issues a Certificate of Capital Importation (CCI) for every inflow. The CCI is the official document that confirms the capital was imported in accordance with Central Bank of Nigeria’s (CBN) foreign-exchange regulations. It is also particularly important for facilitating the repatriation of eligible capital, dividends, profits and other returns through the Nigerian banking system, subject to applicable foreign exchange rules and documentation requirements. The company must therefore open or maintain an account with a licensed bank, submit all required supporting documents, and insist that the bank processes and issues the CCI promptly (usually within 24 to 48 hours) after the funds or assets arrive.

 

INTRODUCTION

The coming into force of the Investments and Securities Act 2025, which repealed the Investments and Securities Act 2007, marked significant changes to the regulatory framework applicable to virtual and digital assets in Nigeria. Virtual and digital assets are now recognized as securities, and the businesses involved in activities relating to such assets falls within the regulatory purview of the Securities and Exchange Commission (SEC). The implications of this reclassification for issuers, exchanges and the wider public have been discussed in previous articles. It has, however, become clear that this is only one aspect of the evolving regulatory framework applicable to digital-asset businesses in Nigeria. Three separate regulatory tracks, an executive coordination order, an increase in the capital requirements prescribed by the SEC, and a bill currently before the Senate have, over the past eighteen months, further shaped the regulatory framework applicable to digital asset businesses in Nigeria.

A SINGLE INSTRUCTION: WORKING FROM THE SAME PLAYBOOK

On 17 July 2026, the Nigerian president signed the Executive Order on Virtual Assets Coordination 2026, which took effect immediately. Rather than establishing a new regulator, the Order provides for greater coordination, among the Central Bank of Nigeria (CBN), the Securities and Exchange Commission (SEC) and the newly constituted Nigeria Revenue Service in relation to the licensing, supervision and enforcement of virtual asset activities through a Virtual Asset Council, chaired by the CBN, with a Virtual Asset Office established within the CBN to serve as its secretariat. The Order is intended to address regulatory gaps that may be exploited by fraudsters and unlicensed platforms and to strengthen measures relating to money laundering, terrorism financing and tax compliance, without imposing an additional licensing requirement on operators beyond the requirements under the Investments and Securities Act 2025 and the SEC’s applicable rules. For operators, the Order further emphasises the need for regulatory compliance across the various applicable regulatory frameworks, particularly as increased information sharing among the CBN, SEC and tax authorities may result in inconsistencies in regulatory filings, banking records and anti-money laundering monitoring being identified and acted upon.

Two further workstreams under the Council remain relevant to the evolving regulatory framework.

1. The Central Bank of Nigeria has now opened applications for Cohort 2 of its Regulatory Sandbox Programme between (12–31 August 2026). The programme includes a dedicated Virtual Asset Service Provider (VASP) track that enables eligible operators to test virtual-asset, stablecoin, custody, wallet and related payment solutions under regulatory supervision before full deployment. Participation does not constitute a licence or authorisation to operate outside the approved testing parameters.
2. In parallel, the Nigeria Revenue Service has issued detailed Guidelines on the Taxation of Virtual Assets 2026. The guidelines establish a clear administrative framework intended to facilitate voluntary compliance and provide greater visibility into revenue derived from digital asset activities.

Operators developing product roadmaps for the next financial year should take both developments into account. While the sandbox and tax guidelines provide greater clarity than previously available, further regulatory guidance and refinements are still expected.

THE REVISED MINIMUM CAPITAL REQUIREMENTS FOR DIGITAL-ASSET OPERATORS

The January 2026 Circular preceded the above Order. In January 2026, SEC issued Circular No. 26-1, which revised the minimum capital requirements applicable to participants in the capital market and significantly increased the capital requirements applicable to digital-asset operators. Digital Asset Exchanges and custodians are now required to maintain a minimum capital of ₦2 billion, representing an increase from the previous threshold of ₦500 million. Digital Asset Offering Platforms are required to maintain a minimum capital of ₦1 billion, while ancillary virtual asset service providers are required to maintain a minimum capital of ₦300 million. Affected operators have until 30 June 2027 to comply with the new capital requirements. The revised capital requirements are intended to strengthen the financial capacity of firms involved in activities relating to digital assets and enhance the protection of client assets.

BANKING ACCESS AND SEC LICENSING REQUIREMENTS

None of the above developments changes the regulatory position that has applied since December 2023, under which digital-asset businesses are required to obtain a SEC licence before accessing banking services in Nigeria. The CBN’s Guidelines on the Operation of Bank Accounts for Virtual Assets Service Providers, which reversed the CBN’s earlier prohibition on banks servicing crypto businesses, permit banks to open designated accounts only for SEC-licensed operators and subject to conditions including dedicated settlement accounts, transaction limits and enhanced customer due diligence. Such operators also remain subject to the applicable anti-money laundering requirements. The coordination mandate of the Virtual Asset Council further strengthens this regulatory framework, particularly as banks may be required to ensure that the SEC licensing and capital requirements of digital-asset operators remain valid and up to date.

Data protection compliance in Nigeria has moved beyond simply having a privacy policy or obtaining consent from customers. The Nigeria Data Protection Act 2023 (NDPA) established the Nigeria Data Protection Commission (NDPC) and created a comprehensive statutory framework for the protection of personal data.  The General Application and Implementation Directive 2025 (“GAID” or “Directive”), which took effect on 19 September 2025, turned this Act into the documented, auditable programme that now governs every Data Controller and Processor of Major Importance in the country. For banks and FinTechs, data protection compliance is therefore not simply another legal or IT issue. It is a governance, operational and reputational issue that should be receiving attention across all leadership cadres.

The Compliance Deadline

The NDPC originally set 31 March 2026 as the deadline for filing the 2025 Compliance Audit Return (CAR), the annual filing through which Ultra-High and Extra-High Level registrants demonstrate to the Commission that their data protection framework is actually operating rather than merely documented. Following representations from stakeholders, the Commission extended that deadline to 30 May 2026^[1]. That extended deadline has now also passed. The GAID requires the audit process to address matters including lawful bases for processing, legitimate-interest assessments, data-subject rights, data-security measures, cross-border transfers and breach notification.

For organisations that filed their CAR on time, the filing should not be treated as the end of the compliance exercise. Rather, the audit trail submitted in May is now the baseline the NDPC will measure future conduct against. For organisations that missed the deadline, the issue should not simply be left unresolved. The GAID provides for an administrative penalty for late filing, in addition to the applicable CAR filing fee.

The practical approach is therefore to assess the reason for the delay, determine the applicable consequences and take steps to regularise the organisation’s compliance position.

Rethinking Consent 

One of the most common data-protection mistakes financial institutions make, is treating consent as the default lawful basis for processing personal data. Consent is important, but it is not the only applicable or appropriate legal basis for every processing activity. The NDPA recognises several lawful bases for processing personal data. These include consent, performance of a contract, compliance with a legal obligation, protection of vital interests, performance of a task carried out in the public interest and legitimate interests. The GAID also provides guidance on legitimate-interest assessments and expects organisations relying on legitimate interests to properly assess and document that basis. Financial institutions are required to identify the lawful basis that genuinely supports each processing activity rather than merely asking for or relying on consent because it is familiar. This requires financial institutions to move beyond generic privacy notices and actually map their processing activities to the appropriate lawful bases.

The Role of the Data Protection Officer

The Directive mandates the appointment of a Data Protection Officer (DPO). The DPO is expected to have appropriate independence, access to relevant processing activities and sufficient resources to perform the role effectively. Banks and Fintechs are advised against folding this role into an existing legal or compliance title without giving it the independence or the resourcing the Directive actually requires. A DPO who is responsible for identifying data protection failures must have sufficient independence to raise those concerns and sufficient access to understand how personal data is actually being processed within the organisation. The GAID also provides for an annual credential assessment process for DPOs, including continuing professional development and inclusion in the Commission’s relevant database.

Cross-Border Data Transfers

Modern banking and FinTech operations rarely operate entirely within one country. As a result, Nigerian customers’ personal data may be transferred to, accessed from or processed in another jurisdiction. . The NDPA and GAID regulate cross-border transfers of personal data and provide recognised mechanisms and lawful grounds for such transfers. The practical problem for many institutions is not necessarily that there is no legal basis for a particular transfer. The problem is that the organisation may be unable to clearly explain what that basis is and where the supporting documentation is. An institution using offshore cloud hosting for its core banking platform, or routing customer data through an international payment processor, should therefore not wait for a regulatory enquiry before being able to clearly explain what the legal basis for a particular data transfer is and where the supporting documentation is.

 

Nigeria’s digital payments sector grew faster than the regulatory architecture that has been built around it. Electronic transaction volumes have increased, mobile money adoption has grown and a few switching, processing and payment solutions providers are at the center of how money moves around the country. The Central Bank of Nigeria concluded that this growth created risks that its rules were not designed to deal with and in June 2026, issued a new circular focusing on data localisation, market concentration & ownership transparency in the payments sector titled “Introduction of Market Structure Requirements, Data Localisation, Ultimate Beneficial Ownership Disclosure, and Systemic Oversight Measures in the Nigeria Payments System” (the “Circular”). The Circular is issued by the CBN Payments Systems Supervision Department and was sent out to deposit money banks, microfinance banks, mobile money operators, switching and processing companies, and other licensed participants in the digital payments sector. It imposes three different sets of obligations with their own compliance timelines and real implications for how banks & fintechs structure technology, ownership and market activity in Nigeria going forward.

1. Data localisation – payment transaction data must be stored in Nigeria from 1 January 2027

All entities that process payments within Nigeria are required from 1st January 2027 to store and manage payment transaction data generated in Nigeria within Nigeria in accordance with Nigerian data protection laws. The requirement hits hardest institutions that already use offshore cloud infrastructure or cross-border data processing arrangements. For many of them, full compliance will mean new local data centre relationships/renegotiated cloud contracts and a planned data migration/migration plan. The requirement has been framed by the CBN as regulatory visibility, consumer protection and lowering operational risk of offshore data storage. It supplements, not replaces, obligations imposed by the Nigeria Data Protection Act 2023.

2. Market structure limits – concentration caps on card issuing and merchant acquiring

The Circular introduces concentration limits intended to prevent a small number of dominant operators from controlling multiple critical functions within the payments value chain. An institution with more than 25% of the card-issuing market cannot also own more than 15% of the merchant-acquiring market – and this is in reverse. Affected institutions are required to submit a monthly market share report to the CBN, which must be in full compliance by 31st December 2026 (this is earlier than the data localisation deadline & should be treated as an earlier priority for institutions assessing exposure under the circular).

3. Ultimate beneficial ownership disclosure

The Circular requires that payment system participants identify the ultimate beneficial owners of large shareholders in a way that aligns the payments supervisory framework with existing anti-money laundering and counter-terrorism financing obligations. This sits alongside and reinforces beneficial ownership register requirements for Nigerian companies in general under CAMA 2020, but it applies that requirement to the CBN in its direct supervisory relationship with the payment institutions.

Enforcement

The CBN said it will monitor compliance with this Circular closely and may levy supervisory sanctions against institutions that do not meet its requirements under applicable laws, regulations and guidance. For an industry that has so far exercised relatively light-touch oversight of things like data residency and ownership transparency in particular, this is one of those more consequential infrastructure and governance initiatives the CBN has made over the last few years in the payments space.

Introduction

On 10 June 2026, the CBN published an Exposure Draft of Revised Guidelines for the Licensing and Regulation of Financial Holding Companies in Nigeria. The Exposure Draft’s public consultation window ends on 9 July 2026. Among the most significant changes to the holding company framework in the draft is the move from three-pillar structures to four-pillar structures. If approved, the proposed framework would be the most significant revamp of the holding company framework since the guidelines were issued for Nigerian banking groups during restructuring away from universal banking into holding companies structures in 2014.

The proposed changes must be understood by financial holding companies, their banking and non-banking subsidiaries, shareholders, and their advisers. The comment window is brief, the required structural changes under the final guidelines have long implementation deadlines and several of the proposals including capital requirements and foreign subsidiary ownership, for example, have material implications that require modelling even before the issuance of final rules.

We outline five of the biggest proposals in the CBN exposure draft and what banking groups need to do by the time the consultation deadline passes.

1. Holding companies should not make lending decisions.

The draft guidelines limit holding companies to credit functions, restricting the company from playing any role in credit administration and approval of any subsidiary. This responds to a corporate governance issue that the CBN sees consistently across all banking groups: that the break between the holding company and operating bank, and hence between holding company management and the subsidiary bank’s lending, is functionally illusory, as holding company management does or can influence lending at the subsidiary. For those banking groups where historically holding company’s top management have been part of credit committees, or have been involved in investment decisions of the banking subsidiary, this prohibition will require that new corporate arrangements are made for the allocation of governance rights and corporate reporting lines.

2. 51% of each subsidiary is to be a minimum equity stake

Every financial holding company must have not less than 51% equity interest in all of its subsidiaries. Re-structure is required where current structures do not meet this test. The draft introduces a requirement to register holding companies as a person with significant control in the appropriate corporate authority which is a practical requirement for disclosure obligations where corporate groups have used complex sub-group structures.

3. Capital must be at least 20% in excess of the sum of minimum capital of the subsidiaries

There is a new holding company capital adequacy standard included in the draft: regulatory capital must be at least 20% greater than the sum of the minimum regulatory capital requirements of all subsidiaries. The capital implications of the requirement for a group, when that group has, or has significant plans to, have multiple regulated subsidiaries (e.g. a commercial bank, an insurance company, a fund manager, and a payment subsidiary) are potentially material and will need to be modelled against the current group capital position prior to final guidelines being published.

4. Foreign subsidiaries have to be located at the parent holding company and not the bank level.

Under the extant 2014 framework, there is an equivalence between what a Nigerian banking subsidiary may be equity-hold in a foreign-owned subsidiary. The draft reverses that: equity-hold in the foreign-owned subsidiary must flow through a holding company itself (or at most, a single-interposition holding company). For banking groups with African subsidiaries (the ownership structure of which will now flow through the Nigerian Bank), this requires that corporate restructure, regulatory approval, and the tax treatment of the transfer of the equity be conducted with immediacy. Also,any shared services have to be at arm’s length. It plugs what the CBN refers to as holes in arrangements for shared services between bank groups. Group owners have historically provided technology, compliance and operation back-up to subsidiaries in ways the CBN now considers as giving subsidiaries unfair advantages over rivals elsewhere within the group. The draft wants any shared services to operate through formal, arm’s length agreements.

5. Group customers cannot be shared without consent.

As with other regulatory frameworks, the Draft includes a clear data governance rule in the banking group framework- sharing of customer data across group entities that are closely linked without the express consent of the customer (except as permitted in NDPA 2023) is not allowed. This takes the Banking group framework in line with the NDPA and creates a compliance obligation that some will have to consider for their existing data management and technology architectures.

The Central Bank of Nigeria (CBN) framework on open banking has now transitioned from a policy document to a phased implementation. Nigeria has a comprehensive history of open banking; with the Central Bank issuing Africa’s first Open Banking Regulatory framework in February 2021, followed by the Operational Guidelines in March 2023. In April 2025, the CBN provided August 2025 as the launch date for an operation that would have seen Nigeria emerge as the first African country to launch national open banking. However, the initial launch date was deferred as the CBN stressed that a wholly automated system that offers robust data protection and stringent consumer protection mechanisms should first be in place.

By May 2026, Nigeria’s phased rollout, the implementation dates are now spread across mid-2026, confirmed in CBN’s FinTech Report which was released in February 2026. The implementation workstreams comprise 5 key areas, namely:

1. Governance & Regulation;
2. Legal & Compliance;
3. Technical & Infrastructure;
4. Data Security; and
5. Stakeholder Engagement.

Stakeholders have finalized and submitted their various deliverables in September 2025 and are currently pending review by the CBN. The Nigeria Inter-Bank Settlement System (NIBSS) has been nominated as the Open Banking Registry and will hold the public repository for all registered participants in the framework. All institutions that intend to participate will need to obtain a CBN license.

 

Legal and Regulatory Considerations for Intending Open Banking Participants

Here, we consider 5 legal questions that all banks and FinTech’s in Nigeria should now be seeking answers to, and which compliance gaps organisations in general have not addressed.

1. Do Application Programming Interface (API) Agreements meet CBN Data sharing obligations?

The legal and technical standards that apply to the application programming interfaces  that allow for the sharing of financial information under Nigeria’s Open Banking framework are not guidelines; they are mandatory requirements and should not be treated as optional. The API agreements in place between banks and technology suppliers that existed prior to the extant open banking regime were not designed with this framework in mind and most of these will not satisfy the CBN framework.

All organisations with existing API agreements should re-examine them and ensure they meet all extant requirements. The relevant questions to ask regarding every API agreement include: whether it adequately defines the categories of data allowed to be accessed and if those are consistent with the tiers prescribed by CBN data access framework; whether the security levels required of the third party supplier meet the CBN’s minimum technical specifications; what the third party supplier’s obligations would be should data breach occur, including details on notification timelines and remedies, and whether the agreement’s terms for termination effectively allow the data supplier to cease data access if the third party supplier does not comply with their obligations under the framework.

2. Are Customer Consent Frameworks Updated for Open Banking?

All data sharing arrangements under the CBN Open Banking framework will be contingent on customer consent which must be informed, specific, granular, and withdrawable. CBN has clearly stated that the open banking initiative should operate with customer ownership and control of personal data; which means that  customer should dictate who gets access to it, for how long, and must be able to revoke access at any time. Customer ownership and control over data was one of the key reasons given for the August 2025 delay.

A compliant open banking consent framework should outline; the specific data categories accessible to the third-party supplier; the purpose for which the third-party supplier would be utilizing the data; duration and frequency of third-party supplier’s access to data; customer’s right to revoke consent at any time, how that is done; and ramifications to the customer’s relationship with both bank and third-party supplier if the customer withdraws consent or withholds it.

A consent framework review should involve examining all customer-facing terms and digital interfaces where the company currently captures customer data and assesses its suitability for open banking. Where consent is not suitable for this purpose, new consent needs to be collected from existing customers before the institution’s data is shared under the open banking regime.

Lending from development finance institutions such as the International Finance Corporation, African Development Bank, Proparco, and German Development Finance Institution, DEG, and other multilateral and bilateral development finance institutions is becoming more accessible to Nigerian businesses across sectors. There may be longer tenors, attractive pricing, or even a strategic partnership that adds credibility and capital.

However, borrowers should be aware that DFI loans are not commercial bank loans. They come with conditions, obligations and consequences that many Nigerian borrowers are not prepared for when they enter the facility agreement.

In this article, we identify the five most critical areas where DFI lending most often cause problems for Nigerian borrowers and what every borrower should know before signing.

 

1. ENVIRONMENTAL AND SOCIAL COMPLIANCE

Every major development finance institution lends under an Environmental and Social (E &S) framework – IFC Performance standards are the most common and most widely used directly (for IFC loans) or by reference (for many bilateral DFIs and funds that use IFC Standards as their benchmark). Respecting the applicable E & S framework is an obligation that goes beyond drawdown alone – it is an ongoing obligation throughout the life of the facility.

Specific E & S obligations that Nigerian borrowers most commonly fail to meet are: preparation and maintenance of an Environmental and Social Management System (ESMS) meeting the relevant performance standard; community and stakeholder engagement in accordance with DFI requirements; and reporting of adverse E1and1S incidents to the lender within specified timeframes.

Breach of E & S covenants is a default under most DFI facility agreements and DFI lenders have accelerated loans on E & S grounds. This is not a theoretical risk. By signing DFI facility agreements without understanding the E & S obligations, they are taking on a material default risk that is unrelated to their financial performance.

 

2. REPORTING OBLIGATIONS

Many times, DFI facility agreements place reporting obligations that are far more stringent than equivalent provisions in Nigerian commercial bank facilities. The typical requirements for borrowers are: an annual audited financial statement prepared under specific accounting standards (usually IFRS); quarterly management accounts are included within specified periods of each quarter; annual E & S compliance reports based on the applicable performance standard, verified by an independent E & S consultant; annual conformity certificates from the directors of the borrower show compliance with all financial and non-financial covenants. Events of default, material adverse change, or material litigation shall be made promptly known.

This creates a significant management burden that is often not realised until the first annual report cycle when the borrower is already in breach of its reporting obligations. More management time, external audit costs, and consultant costs related to DFI reporting should be budgeted by Nigerian businesses using the facility for the first time.

 

3. RESTRICTIONS ON DIVIDENDS AND RELATED-PARTY TRANSACTIONS

Restrictions on dividends and related-party transactions are typically contained in financial covenants in the loan facility agreements. Those restrictions protect the lender and they prevent value being stripped from the borrower in ways that impair its ability to service its debt obligations but they also have big commercial implications for borrowers and their shareholders.

These are some of the restrictions that Nigerian borrowers should pay attention to: dividend lock-up provisions – which may stop dividend payments entirely or limit them to a percentage of distributable profits; related-party transaction restrictions – typically, DFI approval is required for all transactions between the borrower and its affiliates that exceed a certain threshold; restrictive capital expenditure rules that may prevent the borrower from making new investments without lender consent; and they place restrictions on debt incurrence that prevent the borrower from taking on additional financial indebtedness above some level.

By integrating financial services products into non-financial platforms and business models, embedded finance is changing the Nigerian financial services landscape faster than the regulatory and legal frameworks that govern it. Several banks are distributing financial products through digital channels using FinTech. The fintechs are leveraging bank APIs to deliver services that were once available only to licensed financial houses. Retailers, logistics companies and software companies are integrating payments, lending and insurance into their customer experiences.

This has huge commercial potential. Legal risks are also real and not adequately managed in most bank-finance partnership arrangements we review. Five key legal requirements that every embedded finance partnership in Nigeria must meet before the arrangement goes live are laid out in this article.

 

1. REGULATORY APPROVALS

The CBN must sign off on every bank-financed arrangement in Nigeria. As well as the Central Bank of Nigeria’s framework for the regulation and supervision of FinTech companies and its guidelines on third-party service provider arrangements, there are bank-finTech partnerships that operate outside these requirements and are subject to regulatory sanctions for both parties.

Before any embedded finance arrangement is structured, the key regulatory questions are: Should it have its own CBN license for what it does in the partnership, or is it using the bank’s license? When is the bank authorised to operate the FinTech? So has the arrangement been disclosed to the CBN as required by those guidelines? Which party has ongoing reporting obligations in relation to embedded finance activity?

A partnership agreement that leaves these questions unanswered or that fails to get regulatory approvals does not create regulatory exposure. It may also be unenforceable in Nigerian law if it requires either party to do something that is not permitted by its licence.

 

2. LIABILITY ALLOCATION

The most commercially sensitive and often overlooked element of bank-finance partnership agreements in Nigeria is liability allocation. Whether or not a transaction fails, a customer is damaged, or a regulation is broken,  the question of who pays has to be settled before the event, not during it.

So the specific liability scenarios that need to be covered in every embedded finance partnership agreement are: technology failures; who is liable for system downtime, failed transactions and data errors that affect customers? Who is responsible for customer harm caused by embedded financial products? AML/KYC failures; Who should be vetting the customer and checking that the transaction is not being used for money laundering or terrorist financing? If the embedded finance arrangement breaches CBN guidelines; who pays the regulatory and financial costs?

 

The right answer to each of these depends on who controls the technology, interacts with customers, holds the license, and can prevent the failure. Not acceptable is an agreement that is silent on these questions or that places liability resolution in a post-event dispute process.

 

3. DATA SHARING & NDPA COMPLIANCE

Embedded finance relationships necessarily involve sharing customer financial and personal data between the bank and the non-financial platform. All such sharing is governed by the Nigeria Data Protection Act 2023 (NDPA) and specifically facilitated by the CBN’s Operational Guidelines for Open Banking in Nigeria (2023) which states a clear legal basis before the partnership launches and each data sharing arrangement must have a legal basis before the partnership goes live.

 

Specifically, embedded finance partnerships require a lawful basis for each type of data shared – consent, contract, legitimate interest, or other basis appropriate to the data and sharing arrangement; a data processing agreement between the bank and the FinTech outlining the processing, security requirements, data retention, and obligations in case of data breach – the bank will be a data controller for regulatory reasons, but the contractual relationship must be clear; and a customer disclosure framework that informs customers at the point of engagement what data will be shared and used under the arrangement.

 

In embedded finance arrangements data ownership becomes a commercial issue as well as a regulatory one. Data generated by embedded finance is of great commercial use – for product development, credit risk assessment, and targeted offers. Clauses regarding who gets to own, use, and commercialise the data are among the most commercially critical elements of any bank-finance partnership agreement.

There is no loan facility stronger than the security that underlies it. Any bank that doesn’t properly secure its assets is not a secured creditor. And a borrower that does not understand its perfection obligations might find that its representations to its lender were false. These are five security perfection mistakes we see often and every party involved in a Nigerian credit transaction needs to know about them.

1. Unregistered Charges at the CAC

Charges by a Nigerian company over its assets must be registered with the CAC within 90 days under the Companies and Allied Matters Act 2020. An unregistered charge is void against a liquidator, administrator, or any other creditor, so the secured lender is essentially on par with all other unsecured creditors in an insolvency or enforcement situation.

We know this is a requirement, but it is often not met, especially in transactions where several parties move very quickly, where the borrower’s lawyers are doing all the perfecting without the lender being involved in the process, or where post-closing perfection undertakings are given but never enforced.

A documented perfection checklist, under lender counsel supervision, with CAC registration evidence gathered and verified before drawdown – that’s the solution. The principle is simple: There is no registration and there is no drawdown.

2. Missed or Incorrect Stamp Duty

Loan agreements, debentures and mortgages in Nigeria are subject to Stamp Duty. In Nigerian courts, an unstamped or inadequately stamped document is not admissible as evidence. The document does not disappear; the parties remain obligated to each other. It removes the possibility that those obligations can be enforced in courts.

In many cases, the stamp duty position on complex instruments such as debentures with multiple asset classes, syndicated facilities with multiple lenders, and cross-border security packages is not clear, and Nigerian stamp duty law has not kept up with the pace of modern lending transactions. Lenders and their advisers should not rely on precedent or think that what was accepted in a previous transaction will be accepted here. Specific advice on the position of each instrument before execution is the standard.

 

3. DEFECTIVE DEBENTURES

Debentures with defects create both fixed and floating charges on a company’s assets. But the scope and enforceability of those charges depends entirely on how the debenture is written – and badly written debentures are very common in Nigerian lending transactions.

The most common defects are:

• It fails to mention the asset classes that bear the primary security value.
• Use of ambiguous descriptions of charged assets.
• Not including important provisions for the crystallization of the floating charge into a fixed charge.

Debenture provisions that violate the company’s articles of association are unlikely to be fit for purpose. That goes for FinTechs, technology companies and businesses whose assets are intangible.