FinTech Licensing in Nigeria: Between Innovation, Consumer Protection and Regulatory Uncertainty.
Business
FinTech Licensing in Nigeria: Between Innovation, Consumer Protection and Regulatory Uncertainty
Nigeria’s FinTech sector has evolved far beyond its origins in payments disruption. Today, digital platforms intermediate salary flows, power retail commerce, enable cross-border remittances, support algorithmic lending, and increasingly intersect with capital markets through tokenised assets and digital exchanges. Telecommunications infrastructure now doubles as financial rails, while data analytics underpins everything from credit assessment to fraud prevention. Yet the legal architecture governing this ecosystem was not designed for platform-scale financial innovation.
Nigeria’s core financial statutes, including the Banks and Other Financial Institutions Act 2020 (BOFIA 2020), the Investment and Securities Act 2007, the Federal Competition and Consumer Protection Act 2018, the Nigerian Communications Act 2003, and the Nigeria Data Protection Act 2023, were enacted in a regulatory environment defined by institutional silos. They regulate deposit-taking, securities markets, telecommunications infrastructure, consumer protection and data governance as distinct domains.
FinTech platforms do not operate within such boundaries.
A single digital finance company may provide wallet infrastructure, process payments through telecom channels, facilitate tokenised securities transactions, extend embedded credit, and aggregate consumer data across multiple products. Each of these activities potentially engages the jurisdiction of a different regulator.
The Central Bank of Nigeria (CBN) supervises payment systems and other financial institutions under BOFIA 2020. The Securities and Exchange Commission (SEC) regulates securities markets and has extended its oversight to digital assets and virtual asset service providers. The Federal Competition and Consumer Protection Commission (FCCPC) enforces consumer protection and competition standards across sectors. The Nigerian Communications Commission (NCC) retains oversight where telecom infrastructure underpins service delivery, while data governance obligations fall under the Nigeria Data Protection Commission pursuant to the Nigeria Data Protection Act.
Each agency operates within a legally defensible statutory mandate. The difficulty is not regulatory authority; it is regulatory alignment.
In practice, FinTech operators frequently navigate overlapping licensing obligations, parallel compliance requirements and the possibility of concurrent enforcement actions. This generates uncertainty for founders, investors and legal advisers attempting to structure compliant digital finance businesses.
Nigeria therefore does not suffer from under-regulation in the FinTech space. Rather, it faces a growing problem of regulatory misalignment.
The Central Bank’s Regulatory Sandbox Framework illustrates both the progress and the limits of the current approach. The sandbox allows selected firms to test innovative products within defined supervisory parameters. It reflects institutional recognition that emerging financial technologies often require regulatory experimentation.
However, participation in the sandbox does not eliminate parallel exposure to other regulators. A platform experimenting with tokenised financial products may still fall within the SEC’s digital asset rules. Consumer-facing services remain subject to the FCCPC Act. Telecom-enabled delivery channels may attract NCC oversight, while the processing of large volumes of user data engages obligations under the Nigeria Data Protection Act.
The sandbox mitigates uncertainty temporarily. It does not resolve structural overlap.
Digital asset platforms illustrate the jurisdictional complexity most clearly. Where such platforms custody digital value, prudential concerns arise under BOFIA 2020. Where tokens resemble securities or are traded on organised exchanges, the Investment and Securities Act becomes relevant. Consumer protection standards under the FCCPC Act may apply, while data protection obligations arise from the Nigeria Data Protection Act.
The legal question is therefore not whether each statute can apply in isolation. The question is whether Nigeria’s regulatory architecture sufficiently coordinates these powers when they converge within a single technology platform.
These principles are not abstract. They go directly to the legitimacy of regulatory enforcement in sectors where institutional mandates overlap.
Licensing uncertainty carries tangible economic consequences. Investors price regulatory risk into capital allocation decisions. Venture capital funds demand higher risk premiums where enforcement signals are unpredictable. Founders frequently incur substantial compliance costs at early stages simply to anticipate potential jurisdictional overlap.
Where regulatory interpretation evolves primarily through circulars and guidelines rather than legislative amendment, the resulting unpredictability increases the cost of innovation.
BOFIA 2020 significantly expanded the supervisory powers of the Central Bank of Nigeria, including authority to impose administrative sanctions and intervene in financial institutions. These powers are essential for maintaining financial stability. However, when applied uniformly across traditional financial institutions and early-stage technology platforms, prudential supervision may inadvertently discourage innovation.
Consumer protection concerns are often presented as a counterweight to innovation, but this framing is misleading. Nigeria’s consumer protection and data governance regimes are fundamental to building trust in digital financial systems. The FCCPC Act establishes economy-wide consumer safeguards, while the Nigeria Data Protection Act imposes robust obligations for responsible data handling and effective financial innovation depends on such protections.
The policy challenge lies not in the objectives of regulation but in the coherence of its application. International experience suggests that successful FinTech jurisdictions tend to align around several institutional principles: clear regulatory perimeters, tiered licensing structures, proportional capital requirements, formal inter-agency coordination mechanisms, and predictable enforcement thresholds.
Nigeria’s regulatory framework contains elements of these principles but lacks an integrated coordination structure.
Regulatory architecture also sends signals to markets. When licensing categories multiply without consolidation, when circulars revise prior regulatory positions, and when multiple agencies assert authority over the same innovation without a coordination framework, investors interpret the environment as discretionary rather than predictable.
Institutional trust is not built on regulatory leniency. It is built on consistency. Strengthening coherence in Nigeria’s FinTech licensing regime does not require deregulation. It requires institutional design.
Several reforms are both realistic and implementable. First, BOFIA 2020 and the Investment and Securities Act could be amended to include formal inter-regulatory coordination provisions requiring consultation before enforcement actions that affect cross-sector FinTech operators. Joint interpretative guidance would reduce conflicting regulatory signals.
Second, Nigeria could adopt a “lead regulator” model for hybrid FinTech entities. Under this approach, one designated regulator would coordinate supervisory engagement and consolidate compliance reporting while other agencies retain their statutory powers.
Third, regulators could introduce tiered FinTech licensing structures calibrated to operational risk. Distinguishing between custody risk, transaction-processing risk and balance-sheet risk would allow proportional capital and compliance requirements for early-stage firms.
Fourth, sandbox participation should carry defined safe harbour protections, including clear timelines and non-retroactivity guarantees for activities conducted within approved testing parameters.
Fifth, experimental regulatory rules issued through circulars or guidelines could incorporate sunset clauses requiring periodic review and public consultation before renewal.
Finally, the creation of a statutory National FinTech Regulatory Council comprising the CBN, SEC, FCCPC, NCC, the Nigeria Data Protection Commission and the Ministry of Finance would provide an institutional platform for coordinated policy guidance and enforcement strategy.
Nigeria does not lack regulatory authority in the FinTech sector. It lacks a framework that aligns that authority across institutions.
FinTech licensing now sits at the intersection of financial stability, capital market development, telecommunications infrastructure, consumer protection and data governance. Each regulator plays a legitimate role. The next phase of regulatory evolution must focus on coherence.
Clarity is not a concession to industry. It is a reinforcement of regulatory strength. Where institutional coordination improves, investor confidence strengthens and innovation scales within predictable boundaries.
In the long run, capital follows regulatory architecture.
The Termination Clause: The Most Mispriced Risk in Nigerian Contracts
Adedamola Ayodele
Principal Partner, Adedamola Ayodele & Co.
Speak With Our
FREE INITIAL CONSULTATION