-1323.png){kind=logo}
.jpg)
Introduction
The July 2026 edition of the Regulatory Digest tracks consequential regulatory and policy developments across Nigeria's digital economy, spanning banking, capital markets, telecommunications, data protection, competition, and virtual assets. The month was dominated by Nigeria's evolving virtual asset governance architecture, anchored by President Tinubu's Executive Order establishing a Virtual Asset Council, alongside parallel action from the CBN, SEC, FCCPC, and NITDA reflecting a broader push toward coordinated, functionally split oversight of digital finance.
Beyond crypto, this regulatory digest captures the CBN's continued financial sector clean-up through microfinance bank licence revocations and new FX and resolution guidance, as well as NITDA's digital identity handover to NIMC and ongoing digital skills initiatives. It also covers renewed FCCPC enforcement of digital lending rules following a court victory, the Senate hearing on social media localisation requirements, and telecom infrastructure-sharing reforms under the NCC's “Dig Once” policy. Finally, the digest widens its lens across the continent, contrasting Kenya's newly gazetted licensing regime for virtual asset service providers with Ethiopia's hardened blanket ban, illustrating the divergent regulatory paths shaping crypto's future in East Africa.
A quick summary...
Executive Order on Virtual Assets Coordination
President Bola Ahmed Tinubu signed the Presidential Executive Order on Virtual Assets Coordination, 2026, establishing a coordinated framework for regulating virtual assets in Nigeria. The Executive Order creates a Virtual Asset Council to harmonise regulatory oversight, establishes a Virtual Asset Office, and provides for the development of a regulatory sandbox for virtual asset and blockchain solutions.
It also announces that the Nigerian Revenue Service (NRS) will issue a tax policy for the virtual assets sector, while the Federal Government is finalising a Virtual Assets White Paper to outline Nigeria's long-term policy direction. In addition, the Council has been directed to develop a Harmonised Implementation Framework within 30 days to guide implementation across participating agencies.
By anchoring the new Virtual Asset Council at the CBN and giving the SEC and the NRS vice-chair roles, the framework effectively formalises the functional split already in practice: securities-classified assets remain with the SEC, while payment, custody, and settlement activities remain the CBN's domain. The inclusion of the NFIU and ONSA signals that financial crime and national security concerns will now be baked into everyday supervisory coordination, not treated as separate enforcement silos.
For crypto businesses, the practical shift to watch is the shared supervisory technology platform, which will likely mean more consistent reporting obligations across regulators rather than parallel, inconsistent demands. The 30-day deadline for a harmonised implementation framework is the real test. It will determine whether this coordination model produces workable rules quickly or simply adds a new layer of inter-agency process to navigate.
Guidance on FX Purchases by BDCs Through Authorised Dealer Banks
The CBN released the Guidance on the Purchase of Foreign Exchange by Bureau De Change Operators Through Authorised Dealer Banks in the Nigerian Foreign Exchange Market (NFEM) (the “Guidance”). The Guidance is intended to operationalise the framework permitting eligible Bureau De Change (BDC) operators to access foreign exchange directly through Authorised Dealer Banks (ADBs), thereby enhancing liquidity and improving efficiency in the retail FX market.
The Guidance operationalises BDC access to FX from Authorised Dealer Banks via the NFEM, introducing a centralised FXBT portal for real-time tracking. The key rules include: mandatory KYC/CDD, a two-hour bank response window, a USD 150,000 weekly cap per BDC, and a 24-hour deadline to resell unutilised balances. Settlement must run through registered accounts only, with third-party disbursement banned. Existing BDC-bank relationships continue, but all deals must now follow these modalities.
By banning exclusivity and centralising data through FXBT, the CBN converts an informal BDC-bank dynamic into a monitored, standardised system. The 24-hour resale rule and weekly cap are the sharpest levers, aimed at curbing FX hoarding and parallel-market diversion, though they will squeeze BDC treasury flexibility. Enforcement extends beyond BDCs to complicit banks and law enforcement referrals, signalling this segment is now treated as a genuine AML risk area. Compliance teams should prioritise portal registration, KYC refresh, and settlement account setup immediately, as there's no transition period.
Trends and Insight
CBN Revokes Operating Licenses of 46 Microfinance Banks
The Central Bank of Nigeria (CBN) revoked the operating licenses of 46 (forty-six) Microfinance Banks with effect from July 1, 2026, pursuant to its powers under the Banks and Other Financial Institutions Act (BOFIA), 2020. The regulatory action follows the affected institutions' failure to satisfy core operational conditions, including preserving solvency, closing operations without CBN’s approval, and failing to commence operations within 12 (twelve) months of licence approval.
The exercise reflects the apex bank's ongoing commitment to enforcing regulatory compliance, purging insolvent or inactive institutions, and safeguarding the overall stability of the financial sector.
CBN Published an Interpretative Guidance On The Practical Operation Of Sections 34(2)(B) and 40(2) Of The Banks and Other Financial Institutions Act, 2020
The CBN issued interpretative and operational guidance on the practical application of Sections 34(2)(b) and 40(2) of the Banks and Other Financial Institutions Act (BOFIA), 2020. The guidance is intended to eliminate legal and operational uncertainty regarding financial contracts involving failing or resolution-affected financial institutions by establishing a clear maximum duration for the suspension of payment obligations and termination rights. Key provisions include:
The circular takes immediate effect, providing binding operational clarity for all banks, financial institutions, and trading counterparties operating within the Nigerian financial system.
SEC Admits Nine Digital Asset Firms into Accelerated Regulatory Incubation Programme
The Securities and Exchange Commission (SEC) has cleared nine entities for admission into its Accelerated Regulatory Incubation Programme (ARIP), reinforcing its commitment to fostering responsible innovation that deepens Nigeria’s capital market while safeguarding investor interests.
The admitted entities comprise financial technology organisations and two additional organisations cleared under a subsequent circular. These entities will receive Approval-in-Principle (AIP) from the Commission, permitting them to operate within the Programme's defined scope, subject to specified regulatory conditions. The framework seeks to establish controlled sandbox testing for novel business models and preserve market integrity prior to full public deployment.
FMCIDE Is Set to Harmonise the Regulation of Internet Platforms and Online Intermediaries
The Federal Ministry of Communications, Innovation and Digital Economy directed the establishment of a harmonised approach to the regulation of internet platforms and online intermediaries. This directive was issued after a meeting with the Nigerian Communications Commission, the National Information Technology Development Agency (NITDA), and the Nigeria Data Protection Commission (NDPC).
This represents an important governance development as it signals the Federal Government’s intention to adopt a coordinated approach to regulating digital platforms, artificial intelligence, online intermediaries, telecommunications, and data governance.
NITDA hands over Public Key Infrastructure to NIMC
On July 17, 2026, the official handover of the PKI was executed in compliance with the new NIMC Act to create a modern digital identity system in Nigeria. The handover represented the transfer of the technology needed to securely verify Nigerians' identities from NITDA, which had conducted intensive foundational work on it, to NIMC, which is taking over its execution. The NIMC mentioned that while the legislation did the foundational work, the new system will enable seamless interoperability, improved security, and greater efficiency across both public- and private-sector platforms. The new NIMC Act shifts Nigeria toward a single-identity ecosystem, hence gradually making local data residency a non-negotiable reality.
NITDA Launches National Software Quality Assurance Framework with Intention to License Technology Firms
NITDA intends to license technology firms to conduct independent software testing and certification. This move is anchored on its newly launched National Software Quality Assurance Framework, which folds three instruments: the National Software Development Guideline, National Software Testing Guideline, and Software Testing Organisations Licensing Guideline, into a single national standard. The framework introduces a risk-based classification system, with Class A covering high-risk critical infrastructure such as core banking switches, national identity platforms, and electricity grid control systems, Class B covering moderate-risk enterprise platforms, and Class C covering lower-risk internal applications. From the second quarter of 2027, certification under this framework becomes mandatory for government software projects to obtain IT Project Clearance, and NITDA has signalled that an Expression of Interest for prospective licensed testing organisations will follow shortly.
This move marks a shift from guideline-based oversight to a licensing-and-accreditation regime, echoing how Nigeria's financial and telecoms regulators already gate market entry through certification. For the ecosystem, it opens a new regulated services market for indigenous QA and testing firms, and NITDA expects it to encourage local firms to pursue internationally recognised certifications and create high-skilled technology jobs, while raising the compliance bar for vendors serving government and other regulated organisations, likely favouring better-resourced firms in the early accreditation window.
Read alongside Nigeria's parallel moves on AI policy, sovereign cloud, and interoperable digital identity, this framework adds another layer to a broader national digital-trust architecture, one where advisory and compliance-support firms will increasingly be needed to help software vendors and public agencies interpret classification requirements and prepare for accreditation.
FCCPC Resumes Digital Lending Regulation
The Federal Competition and Consumer Protection Commission (FCCPC) has resumed implementation and enforcement of the Digital, Electronic, Online or Non-Traditional Consumer Lending (DEON) Regulations, 2025, after the Federal High Court judgment upheld their validity, dismissing a challenge by the Wireless Application Service Providers Association of Nigeria (WASPAN) that had questioned the FCCPC's authority to issue and implement the rules. The rules aim to promote responsible lending, curb unfair and exploitative practices, and strengthen consumer protection across Nigeria's digital lending market.
The ruling hands the FCCPC a clear legal mandate to resume oversight of a fast-growing but historically loosely-policed sector: digital/app-based lenders, after months of regulatory limbo. For industry players, it signals renewed compliance pressure around fair-lending practices, debt-collection conduct, and transparency, likely accelerating consolidation as smaller or non-compliant apps face scrutiny they'd paused during the suspension. It also sets a legal precedent that reinforces FCCPC's authority over fintech and telco-adjacent lending platforms, discouraging future industry challenges to its jurisdiction and giving investors and compliant lenders greater regulatory certainty in which to operate.
Senate ICT and Cyber Security Committee Holds Public Hearing on NDPA (Amendment) Bill Compelling Social Media Companies to Open a Nigerian Office
On July 23, 2026, the Senate ICT and Cyber Security Committee held a hearing on the NDPA (Amendment) bill, which would require social media platforms to open physical offices in Nigeria. Senator Ned Nwoko's case rested on lost tax revenue, a security incident involving ransom demands on TikTok, and precedent from countries like the UK and India. While media coverage framed the hearing as showing broad support, the institutional weight in the room ran the other way.
NITDA, the NDPC, the Ministry of Justice, and the Nigerian Bar Association all opposed the bill as drafted, mainly arguing that it duplicates and conflicts with the existing NDP Act, which already has extraterritorial application. They also argued that it adds cost without enforcement power. The recurring alternative across these submissions was a lighter-touch "local representative" model instead of mandatory offices. This may likely be the more realistic outcome if the bill advances.
The major implication of passing the bill with its current physical-office mandate is that it risks raising compliance costs and imposing reciprocal burdens on Nigerian startups abroad, without adding any regulatory capability beyond what the NDP Act already provides.
NCC Advances “Dig Once” Policy as it Engages Stakeholders on Cost-Based Framework for Duct Sharing
The Nigerian Communications Commission (NCC) collaboratively implements the “Dig Once” Policy. The forum underscored the Commission’s commitment to a transparent and inclusive regulatory process to accommodate infrastructure providers, network operators, public institutions, and consumers.
For the telecommunications ecosystem, this framework signals a major cut in broadband deployment, one of the largest cost drivers. Therefore, this lowers expansion costs for telcos while its collaborative nature proffers an opportunity for broadband deployment in underserved areas.
Federal Ministry of Industry, Trade and Investment (FMITI) Hosts the AfCFTA Digital Trade Forum 2026.
The Federal Ministry of Industry, Trade and Investment (FMITI) hosted the 2026 AfCFTA Digital Forum themed “Digital Trade for a Connected African Market.” The event brought together policymakers and innovators to accelerate implementation of the AfCFTA Digital Trade Protocol. The Federal Minister of Industry, Trade and Investment reaffirmed Nigeria’s commitment as a co-champion of the Digital Trade Protocol and highlighted national reforms to align with the digital trade ecosystem.
This commitment signals momentum towards cross-border data flows, creating an enabling environment for businesses to trade seamlessly across borders using digital platforms, free from regulatory and trade barriers. However, this outward-facing commitment sits in tension with an inward regulatory trend: Nigeria’s simultaneous advancement of data localisation requirements, from the NIMC Act's shift toward a single-identity ecosystem anchored in local data residency, to the CBN circular requiring the localisation of transaction data. For businesses, this creates a dual compliance reality: continental trade facilitation on one hand, and hardening domestic data sovereignty rules on the other.
This means that the practical ease of cross-border digital trade promised by the Protocol may be constrained by the very data localisation obligations Nigeria is layering onto its digital economy at the same time.
Kenya Finalises the Virtual Assets Service Providers Regulation 2026
Kenya gazetted the Virtual Asset Service Providers (VASP) Regulations, 2026, finalising the country's legal framework for licensing and supervising cryptocurrency exchanges, wallet providers, stablecoin issuers, and other digital asset businesses. This Regulation complements the VASP Act of 2025. Firms serving Kenyan customers, including those without a physical presence in the country, must obtain licences, meet governance and capital requirements, implement anti-money-laundering and cybersecurity controls, safeguard customer assets, and comply with reporting and consumer protection obligations.
Oversight is split: the Central Bank of Kenya (CBK) will supervise virtual asset-to-fiat conversion services and stablecoin issuers, while the Capital Market Authority (CMA) will regulate exchanges, token issuance platforms, ICOs, and tokenisation activities. The rules followed a four-month public consultation; with the framework now gazetted, firms can begin applying for licences.
The most consequential feature is its extraterritorial reach. It captures foreign providers that merely target Kenyan users or profit from Kenya, with no local presence required, effectively forcing global exchanges to formalise or exit. The dual CBK/CMA structure mirrors how many jurisdictions split monetary versus market oversight. The real test now is licensing uptake and whether compliance costs consolidate the market around well-capitalised incumbents.
Ethiopia Tightens Virtual Assets Ban
The National Bank of Ethiopia (NBE) issued a notice on July 23, broadening its restrictions on cryptocurrencies and other virtual assets. The notice clarifies that the ban covers not only digital coins but also exchanges, transfers, custody services, and related intermediaries, building on the earlier February 2026 action against peer-to-peer crypto transactions. This move directly contrasts with Kenya's approach: instead of licensing crypto activity, Ethiopia is tightening a blanket ban, even reaching self-custody wallets. The implication is a widening regional divergence: Kenya is formalising a market already worth billions, while Ethiopia risks pushing its crypto activity further underground or offshore.
This divergence is likely to push Ethiopian crypto users and capital toward informal cross-border channels and Kenyan-licensed platforms, reinforcing Nairobi's position as East Africa's de facto regulated crypto hub while leaving Ethiopia's digital asset activity largely unmonitored and harder to tax or police.
Taken together, July's developments point to a Nigerian regulatory environment that is maturing rapidly, moving from reactive stopgaps toward more deliberate, coordinated frameworks, as seen in the Virtual Asset Council's harmonisation mandate and the CBN's tightened FX and resolution guidance. At the same time, enforcement muscle is visibly strengthening: the CBN's licence revocations, the FCCPC's resumed lending oversight, and heightened AML expectations for BDCs all signal that regulators are prepared to act on existing rules rather than merely issue them.
The recurring tension across these updates is between formalisation and cost, as smaller operators, whether microfinance banks, BDCs, or digital lenders, face rising compliance burdens even as the frameworks aim to build market confidence and attract investment. Regionally, Kenya and Ethiopia's opposite approaches to virtual assets underscore that Africa's digital asset governance remains fragmented, with real implications for where crypto capital, talent, and platforms choose to locate.
Looking ahead, the true test for these frameworks- Nigeria's Virtual Asset Council, Kenya's VASP licensing regime, and the NDPA amendment debate alike- will be implementation: whether the 30-day harmonisation deadline, licensing uptake, and legislative compromises translate into workable rules rather than an added layer of process.
