The Nigerian Regulator Map: CBN, SEC, NFIU, NITDA, EFCC — Who Governs Your Product

A Nigerian fintech founder who cannot name their primary regulator is building blind. Not because regulators are obscure — but because overlapping mandates make it genuinely confusing. Payments touch CBN. Tokenised offerings touch SEC. AML touches NFIU. Data touches NITDA. Enforcement can involve EFCC.

The Founder's Guide regulator map is the first document serious founders pin to their compliance wall.

The five regulators every fintech founder must know

SEC Nigeria — Securities and Digital Assets

Mandate: Registration and supervision of capital market operators, including digital asset service providers under ISA 2025 and SEC Digital Asset Rules.

You need SEC if your product: facilitates trading of digital assets, issues tokens to investors, provides custody of client assets, or operates as a digital asset intermediary.

Key categories: DAX (exchange), DAOP (offering platform), DAC (custodian), DAI (intermediary), AVASP (ancillary services).

CBN — Payments and Banking

Mandate: Monetary policy, payment systems supervision, banking regulation, and naira-denominated financial services.

You need CBN if your product: processes naira payments, operates on/off-ramps, issues or facilitates e-money, or partners with deposit money banks for VASP accounts.

Key guidance: CBN VASP Guidelines 2023 (bank account operation for virtual asset service providers), payment system regulations under BOFIA 2020.

NFIU — AML/CFT and Financial Intelligence

Mandate: Anti-money laundering supervision, suspicious transaction reporting, and financial intelligence for all reporting entities — including VASPs.

You need NFIU if your product: handles customer funds, processes transactions, or operates as a virtual asset service provider.

Key requirements: goAML registration, STR/CTR filing, AML/CFT compliance framework, MLRO appointment.

NITDA — Data and Technology Policy

Mandate: Information technology development, blockchain policy coordination, and data protection enforcement under NDPA 2023.

You need NITDA if your product: processes personal data at scale, operates AI systems, or falls under Nigeria's data protection framework.

EFCC — Enforcement

Mandate: Investigation and prosecution of economic and financial crimes.

You encounter EFCC if: AML controls fail, fraud is alleged, or enforcement action escalates beyond regulatory remediation.

The overlap problem

Many Nigerian fintech products sit at intersections:

• Crypto exchange with naira ramps → SEC (trading) + CBN (payments) + NFIU (AML)
• Tokenised real estate → SEC (securities offering) + NFIU (AML) + possibly CBN
• Wallet with yield features → SEC (investment product) + NFIU (AML)

Dual-licence requirements are common, not exceptional. Planning for one regulator while ignoring another is how founders receive letters from two directions simultaneously.

How to use the map

1. Classify your product by function
2. Identify primary regulator (usually SEC or CBN for fintechs)
3. Identify secondary regulators (almost always NFIU; often NITDA)
4. Document the map in your compliance files and investor materials
5. Engage proactively with each relevant regulator

How Klarify helps

• Product Classifier — identifies primary and secondary regulators for your product
• Regulator CRM — pre-loaded profiles for all seven Nigerian regulators with contacts and mandates
• FounderCounsel — ask "who regulates my product?" with cited answers
• Compliance Roadmap — regulator engagement tasks in Phase 3 and Phase 4

This is regulatory information and operational guidance — not legal advice. Regulator mapping for your specific product should be confirmed with qualified counsel.

---

This article adapts themes from Chapter 6 of The Founder's Guide to Building in Regulated Markets (Chuta, 2026). Klarify provides regulatory information, not legal advice. For advice specific to your situation, consult a qualified practitioner.