Legal And Regulatory Compliance In Nigeria’s Financial Technology Sector: Navigating Licensing, Consumer Protection, And Cybersecurity Obligations

Contributor: Solomon Ekpe

Introduction

Financial technology (fintech) has transformed the Nigerian financial-services market. Digital payment platforms, mobile-money services, electronic wallets, payment gateways, digital lenders, agency-banking platforms and other technology-enabled products have widened access to financial services and reduced dependence on physical banking infrastructure. The same innovation, however, has created a regulatory environment in which a product’s legal character matters more than the label its provider adopts.

The Central Bank of Nigeria (CBN) remains the principal regulator where a fintech business performs banking, payment or other financial activities within the CBN’s statutory perimeter. That role is not exclusive. Depending on the service offered, a fintech operator may also fall under the jurisdiction of the Federal Competition and Consumer Protection Commission (FCCPC), the Nigeria Data Protection Commission (NDPC), the Securities and Exchange Commission (SEC), or another sector regulator. Nigeria therefore regulates fintech functionally rather than through a single comprehensive “Fintech Act”.^[1][2]

This fragmented but activity-based structure makes regulatory classification the first compliance question for a fintech business. Incorporation with the Corporate Affairs Commission does not, by itself, authorise a company to provide a regulated financial service. A business must identify the legal nature of each proposed service, obtain the appropriate licence or approval, and design its operations around continuing regulatory obligations.^[3]

This article examines three areas that most directly determine the legality and sustainability of fintech operations in Nigeria: licensing and authorisation, consumer protection, and cybersecurity. It also addresses data-protection obligations because privacy and information security are inseparable from consumer-facing digital finance. The article argues that compliance should be embedded in product design, governance and operational controls from inception rather than treated as a post-launch response to regulatory intervention.

The Regulatory Architecture For Financial Technology Businesses In Nigeria

Nigeria’s fintech regime spans statutes, regulations, guidelines, and supervisory institutions. The applicable rules depend on what the business actually does. A platform that merely supplies software infrastructure may face a different regulatory perimeter from one that receives customer funds, processes payments, grants credit, provides investment services or operates a digital-asset platform.

For banking, specialised banking and other financial-institution activities, the Central Bank of Nigeria Act 2007 and the Banks and Other Financial Institutions Act 2020 (BOFIA) provide the principal statutory foundation. BOFIA expressly includes payment service providers within the business of other financial institutions and makes clear that regulated activities do not escape supervision merely because they are conducted digitally, virtually or electronically. Detailed payment-system frameworks, circulars and licensing requirements supplement the CBN’s supervisory powers.^[4][5]

The wider regulatory perimeter is equally important. The FCCPC administers the general competition and consumer-protection regime under the Federal Competition and Consumer Protection Act 2018 (FCCPA). The NDPC supervises compliance with the Nigeria Data Protection Act 2023 (NDPA). Where a fintech product falls within capital-market regulation, the SEC exercises authority under the Investments and Securities Act 2025 and its rules, including rules applicable to fintech and digital-asset activities. This overlap makes a regulatory-perimeter assessment essential before market entry and whenever a business materially changes its product or delivery model.^[6]

Licensing And Authorisation Requirements

Licensing is a threshold compliance obligation. Section 57 of BOFIA prohibits any person from carrying on specialised banking or the business of another financial institution, including payment services, without the licence required by the Act. The provision is deliberately technology-neutral: it extends to designated financial businesses whether conducted physically, digitally, virtually, or electronically. A fintech company cannot therefore avoid licensing by describing itself as a technology platform where, in substance, it performs a regulated financial activity.^[7]

The CBN’s New Licence Categorisation for the Nigerian Payments System streamlines payment-service licensing into four broad categories: Switching and Processing, Mobile Money Operations, Payment Solution Services, and the Regulatory Sandbox. Separate frameworks govern other activities, including Payment Service Banks, agent banking and open banking. The relevant licence depends on the functions to be performed; for example, the 2020 categorisation expressly provides that only mobile-money operators within that framework may hold customer funds.^[8][9]

Obtaining a licence is not the end of the compliance process. A licensed fintech remains subject to the conditions of its authorisation, applicable capital requirements, governance and reporting obligations, risk-management standards, audit requirements and subsequent regulatory directions. The CBN also retains supervisory and examination powers over specialised banks and other financial institutions. A fintech that introduces a materially different product, expands into another regulated activity or restructures its operating model should therefore reassess whether its existing authorisation remains sufficient.^[10]

The same functional approach applies outside the CBN perimeter. A business that offers investment products, securities-based services or regulated digital-asset services may require SEC registration or approval under the capital-market regime. The practical lesson is that fintech licensing should map to the substance of the service rather than the company’s marketing description. Failing to make that assessment early can expose a business to enforcement, penalties, product disruption, and reputational damage.^[11]

Consumer Protection Obligations

Consumer protection is central to fintech compliance because digital financial services are delivered rapidly, remotely and often through standard-form electronic contracts. Consumers may face failed transactions, unauthorised debits, opaque charges, misleading advertisements, unfair contract terms, aggressive debt-recovery practices and inadequate complaint-resolution mechanisms. The CBN Consumer Protection Framework addresses disclosure, transparency, fair treatment, protection of consumer assets and privacy, complaints handling and redress for institutions within the CBN’s supervisory scope.^[12]

Fintech operators should therefore provide clear information about charges, interest, transaction limits, risks, material terms and complaint procedures before a customer is bound. Product interfaces should not obscure important information or obtain consent through deceptive design. For digital lenders, responsible lending and lawful debt recovery are particularly important because using contact lists, public shaming, or coercive communications can engage both consumer-protection and data-protection rules.

The FCCPA adds a general consumer-protection layer. Although section 65(1) of BOFIA excludes specified banking and financial activities from the FCCPA, the relationship between the two statutes has generated litigation. In United Bank for Africa Plc v Federal Competition and Consumer Protection Commission, the Federal High Court, Abuja, held on 22 April 2026 that the FCCPC could investigate consumer complaints involving banks and other financial institutions, relying in part on the FCCPC’s statutory consumer-protection mandate and section 104 of the FCCPA. The decision is significant because it treats sector supervision by the CBN and general consumer protection by the FCCPC as able to operate alongside each other.^[13]

Digital lending now attracts more specific regulation. The Digital, Electronic, Online or Non-Traditional Consumer Lending Regulations 2025 (DEON Regulations) establish requirements relating to registration, transparency, responsible conduct, data privacy, fair lending and redress for covered digital and non-traditional lenders. The Federal High Court temporarily suspended their implementation after an interim order in April 2026. However, in ^[14]Wireless Application Service Providers Association of Nigeria Ltd/Gte v Federal Competition and Consumer Protection Commission, the Federal High Court, Lagos, dismissed the challenge on 20 July 2026, upheld the validity of the Regulations and discharged the restraining order. The FCCPC consequently resumed implementation and enforcement.^[15]

The current position therefore requires fintech lenders to treat consumer protection as an operational control, not merely a disclosure exercise. Product design, pricing, advertising, collections, complaint management and customer communications should be tested against both sector-specific requirements and the wider consumer-protection framework.

Data Protection And Privacy Compliance

Fintech businesses routinely process identity data, transaction histories, device information, credit information and other personal data. The NDPA therefore forms a core part of fintech compliance. It requires personal data to be processed lawfully, fairly, and transparently, for specified purposes, and in a manner consistent with data-minimisation, accuracy, storage-limitation, and accountability principles. A fintech should identify a lawful basis for each material processing activity and should not collect personal data merely because its technology makes such collection possible.^[16]

High-risk processing requires additional scrutiny. Section 28 of the NDPA requires a data privacy impact assessment where the nature, scope, context or purpose of processing is likely to create a high risk to the rights and freedoms of data subjects. This is particularly relevant to products that use extensive behavioural profiling, biometrics, automated credit scoring or large-scale data analytics. Privacy assessment should therefore occur during product development, not after deployment.^[17]

Security is also a statutory data-protection obligation. Section 39 requires data controllers and processors to implement appropriate technical and organisational measures to protect the security, integrity and confidentiality of personal data. Section 40 requires a data controller to notify the NDPC within 72 hours of becoming aware of a personal-data breach that is likely to create a risk to individuals, and to communicate high-risk breaches to affected data subjects. These obligations make incident response a legal governance issue rather than a purely technical function.^[18]

Outsourcing does not eliminate responsibility. Fintech businesses that rely on cloud providers, analytics vendors, payment processors or other technology partners should allocate data-protection duties contractually and conduct appropriate vendor due diligence. Cross-border transfers of personal data must also comply with the transfer conditions in the NDPA. The NDPC’s General Application and Implementation Directive 2025 provides additional implementation guidance for organisations subject to the Act.^[19][20]

Cybersecurity Obligations

Cybersecurity is inseparable from fintech regulation because financial platforms combine valuable customer data with direct or indirect access to money. A successful compromise can produce financial loss, identity theft, service disruption, regulatory investigation and loss of customer confidence. Nigerian law therefore approaches cybersecurity through overlapping financial-sector, cybercrime and data-protection obligations.

Section 68 of BOFIA empowers the CBN to issue cybersecurity regulations and guidelines to banks, specialised banks and other financial institutions and requires regulated institutions to comply with those instruments. The CBN’s Nigerian Payments System Risk and Information Security Management Framework also establishes risk and information-security expectations for payment-system participants. A fintech within the payments ecosystem should therefore maintain controls proportionate to its services, risk profile and access to customer funds or payment infrastructure.^[21][22]

The Cybercrimes (Prohibition, Prevention, etc.) Act 2015, as amended in 2024, adds specific statutory duties. Section 37 requires financial institutions to undertake customer-identification measures for electronic financial transactions. It provides that, where a financial institution makes an unauthorised debit, it must, upon written notification by the customer, provide clear legal authorisation for the debit or reverse it within 72 hours. The provision should not be read as making a financial institution automatically liable for every loss associated with digital fraud; its application depends on the statutory conditions and the facts of the transaction.^[23]

The 2024 amendment also revised section 38 so that service providers must keep and protect specified traffic data and subscriber information for two years in accordance with the NDPA and applicable regulatory requirements. The amendment is important because it expressly links cybercrime-related data retention to data-protection obligations. Retention for security or law-enforcement purposes does not displace the duty to protect personal data.^[24]

A coherent cybersecurity programme should therefore combine authentication controls, encryption, access management, transaction monitoring, vulnerability management, secure software-development practices, vendor-risk management, incident response and business-continuity arrangements. The legal standard is not satisfied by having a written policy that is disconnected from actual systems. Controls should be tested, updated and integrated with consumer redress and data-breach procedures, particularly because a serious incident may simultaneously trigger obligations under CBN rules, BOFIA, the Cybercrimes Act and the NDPA.^[25]

Conclusion

Nigeria’s fintech sector operates within a layered regulatory environment rather than under a single statute. That structure allows regulators to respond to the different functions performed by technology-enabled financial businesses, but it also creates compliance risks where a business treats regulation as a series of isolated requirements.

Licensing determines whether a fintech may lawfully enter and remain in a regulated market. Consumer-protection rules govern the fairness, transparency and accountability of its relationship with customers. Data-protection and cybersecurity obligations address the integrity of the information and systems on which digital finance depends. These obligations intersect in practice: a product cannot be genuinely compliant if it is properly licensed but uses unfair consumer practices, or if it protects customers contractually while failing to secure their personal and financial data.

The appropriate compliance model is therefore preventive and integrated. Fintech operators should conduct regulatory-perimeter assessments before launch, maintain ongoing licence compliance, build consumer protection and privacy into product design, and operate risk-based cybersecurity controls that can respond to evolving threats. Regulators should, in turn, continue to improve coordination where their mandates overlap. Such an approach can preserve innovation and financial inclusion without sacrificing consumer welfare, data protection or the stability and integrity of Nigeria’s financial system.

Reference

1. Federal Competition and Consumer Protection Act 2018, ss 17, 104; Nigeria Data Protection Act 2023, ss 4-6; Investments and Securities Act 2025. ↑
2. Central Bank of Nigeria Act 2007, ss 2(d), 47; Banks and Other Financial Institutions Act 2020, ss 57, 60. ↑
3. Banks and Other Financial Institutions Act 2020, s 57(1)-(2). ↑
4. Central Bank of Nigeria, ‘Payment Service Providers’ <https://www.cbn.gov.ng/PaymentsSystem/PSPs.html> accessed 28 September 2026. ↑
5. Ibid s 57(2)(i)-(j). ↑
6. Investments and Securities Act 2025; Securities and Exchange Commission, ‘SEC Rules for FinTechs’ (25 May 2025) <https://sec.gov.ng/our-mandate/regulation/rules-and-regulations/sec-rules-for-fintechs/> accessed 28 September 2026. ↑
7. Banks and Other Financial Institutions Act 2020, s 57(1)-(2). ↑
8. Ibid 1; Central Bank of Nigeria, ‘Payment Service Providers’ <https://www.cbn.gov.ng/PaymentsSystem/PSPs.html> accessed 28 September 2026. ↑
9. Central Bank of Nigeria, ‘New Licence Categorisations for the Nigerian Payments System’ (Circular PSM/CIR/GEN/CIR/01/22, 9 December 2020) <https://www.cbn.gov.ng/out/2020/ccd/categorization%20of%20psps.pdf> accessed 28 September 2026. ↑
10. Banks and Other Financial Institutions Act 2020, s 60. ↑
11. Investments and Securities Act 2025; Securities and Exchange Commission, ‘Rules on Issuance, Offering Platforms and Custody of Digital Assets’ (11 May 2022) <https://sec.gov.ng/wp-content/uploads/2022/05/Rules-on-Issuance-Offering-and-Custody-of-Digital-Assets.pdf> accessed 28 September 2026. ↑
12. Central Bank of Nigeria, Consumer Protection Framework for Banks and Other Financial Institutions Regulated by the CBN (2016) paras 2.2-2.7 <https://www.cbn.gov.ng/out/2016/cfpd/consumer%20protection%20framework%20%28final%29.pdf> accessed 28 September 2026. ↑
13. United Bank for Africa Plc v Federal Competition and Consumer Protection Commission, Suit No FHC/ABJ/CS/1972/2025 (Federal High Court, Abuja, 22 April 2026) (unreported); Federal Competition and Consumer Protection Commission, ‘Banks Answerable to FCCPC, Court Rules’ (22 April 2026) <https://fccpc.gov.ng/banks-answerable-to-fccpc-court-rules/> accessed 28 September 2026. ↑
14. Federal Competition and Consumer Protection Commission, Digital, Electronic, Online or Non-Traditional Consumer Lending Regulations 2025; FCCPC, ‘Digital Lending: FCCPC Tackles Abuses, Issues Landmark Regulations’ (3 September 2025) <https://fccpc.gov.ng/digital-lending-fccpc-tackles-abuses-issues-landmark-regulations/> accessed 28 September 2026. ↑
15. Wireless Application Service Providers Association of Nigeria Ltd/Gte v Federal Competition and Consumer Protection Commission, Suit No FHC/L/CS/760/2026 (Federal High Court, Lagos, 20 July 2026) (unreported); FCCPC, ‘FCCPC Resumes Digital Lending Regulation’ (20 July 2026) <https://fccpc.gov.ng/fccpc-resumes-digital-lending-regulation/> accessed 28 September 2026. ↑
16. Nigeria Data Protection Act 2023, ss 24-25. ↑
17. Ibid s 28. ↑
18. Ibid ss 39-40. ↑
19. Nigeria Data Protection Commission, General Application and Implementation Directive 2025 <https://ndpc.gov.ng/wp-content/uploads/2025/03/NDP-ACT-GAID-2025-MARCH-20TH.pdf> accessed 28 September 2026. ↑
20. Ibid ss 41-43. ↑
21. Central Bank of Nigeria, Nigerian Payments System Risk and Information Security Management Framework (2020), listed at <https://www.cbn.gov.ng/PaymentsSystem/PSPs.html> accessed 28 September 2026. ↑
22. Banks and Other Financial Institutions Act 2020, s 68. ↑
23. Cybercrimes (Prohibition, Prevention, etc) Act 2015, s 37, as amended by the Cybercrimes (Prohibition, Prevention, etc) (Amendment) Act 2024. ↑
24. Cybercrimes (Prohibition, Prevention, etc) Act 2015, s 38, as substituted by s 9 of the Cybercrimes (Prohibition, Prevention, etc) (Amendment) Act 2024. ↑
25. Nigeria Data Protection Act 2023, ss 39-40; Banks and Other Financial Institutions Act 2020, s 68. ↑