Nigeria processed $92.1 billion in cryptocurrency transactions in the twelve months to June 2025 — nearly triple South Africa’s volume and the largest total on the African continent. When President Bola Tinubu unveiled Nigeria’s new virtual asset regulatory framework in December 2025, the decision he made was as consequential as the framework itself: Nigeria would not pass a new law. Instead, it would build a coordination architecture across existing regulators and rely on statutes already on the books.
For African crypto companies, that choice has immediate practical implications. Understanding what Nigeria’s Virtual Asset Regulatory Authority (VARA) framework actually requires — and what it does not — is now a compliance priority for any firm with Nigerian users, counterparties, or operations.
What the VARA Framework Actually Is
The VARA framework is not a single regulator and it is not a new law. It is a coordination model built on top of two statutes that were already passed in 2025: the Investment and Securities Act (ISA 2025), which gave the Securities and Exchange Commission formal authority over digital assets classified as securities, and the Nigeria Tax Administration Act (NTAA 2025), which embedded crypto transactions into Nigeria’s personal income and capital gains tax framework.
At the centre of the framework sits the Virtual Asset Regulatory Council (VARC), a strategic coordination body co-chaired by the Central Bank of Nigeria (CBN) and the Nigeria Revenue Service (NRS). The VARC’s mandate is to ensure that the three agencies with overlapping jurisdiction over virtual assets — the CBN, NRS, and SEC — do not create conflicting rules, duplicate licensing requirements, or issue contradictory enforcement actions. This is a harder problem than it appears. Before VARC, a Nigerian crypto exchange faced the possibility of satisfying the SEC’s requirements while inadvertently violating CBN foreign exchange rules, or meeting CBN standards while having no clear pathway for tax reporting to the NRS.
The VARC is supported by the Virtual Asset Regulatory Office (VARO), which serves as the operational interface between the market and the regulatory structure. VARO is the front door: firms with questions about whether they need to register, which agency governs their particular product, or how to begin the compliance process go to VARO first. The office is designed to prevent the paralysis that hits companies when no single regulator will claim responsibility for supervising their business model.
Three Obligations That Are Active Now
Whatever the policy architecture looks like on paper, three compliance obligations are already in force for Nigerian virtual asset businesses.
The first is tax reporting. Under Section 25 of the NTAA 2025, virtual asset service providers are legally required to submit monthly, transaction-level reports to the Federal Inland Revenue Service (FIRS). The reports must be detailed — not aggregate figures, but individual transaction data. The penalty structure is not light: a first-month default attracts a fine of ₦10 million (approximately $6,200 at current rates), with ₦1 million for each subsequent month of non-compliance. For smaller exchanges and OTC desks, these fines can accumulate quickly. For a firm that has been operating informally and has twelve months of unreported transactions, the back-reporting obligation is substantial.
The second obligation is securities registration. Under ISA 2025, any digital asset that functions as an investment instrument — a token offering returns to holders, grants governance rights, or is marketed as an investment — is legally a security in Nigeria. Trading, issuing, or managing securities without SEC registration is a criminal offence under the Act. The SEC’s Accelerated Regulatory Incubation Program (ARIP) provides a supervised pathway for firms that have been operating without full registration: they can apply to ARIP, come under SEC oversight during an incubation period, and move toward formal licensing without immediately facing enforcement. ARIP is available now; firms that continue operating informally rather than applying are accumulating regulatory risk.
The third obligation is AML/CFT compliance. The CBN’s existing anti-money laundering and counter-financing of terrorism framework applies to virtual asset businesses operating payment infrastructure or providing services that move funds. Under the VARA coordination model, the CBN retains authority over payment-function virtual assets — stablecoins, payment tokens, any digital asset used primarily as a medium of exchange. These businesses face the same KYC, transaction monitoring, and suspicious activity reporting requirements as licensed fintechs. The CBN has been explicit that the VARA framework does not create a compliance holiday.
Why Nigeria Chose Not to Legislate
The decision to avoid a standalone crypto law was deliberate and argued on its merits in the VARA White Paper. Tinubu’s stated position — “proportionate, evidence-based, and aligned with global standards” — reflects a genuine concern that rushing to legislate would produce poorly calibrated rules that burden participants without improving market integrity.
This concern is not unfounded. Ghana’s Virtual Asset Service Providers Act 2025 is a comprehensive statute, but the process of drafting and passing it took years, and the sandbox that followed its passage is only now, in March 2026, producing the first supervised operators. Nigeria’s argument is that by deploying existing statutory powers immediately through coordination rather than waiting for new legislation, the market gets regulatory clarity faster. The downside is that the clarity is partial: coordination frameworks are more vulnerable to gaps, contradictions, and enforcement inconsistency than unified statutes.
The contrast with peer markets is instructive. Ghana has a law and a sandbox but no licensed firms yet. Rwanda passed its Virtual Assets Law and is running a dual-track framework for crypto and CBDC simultaneously. Kenya’s VASP Bill has not yet been signed into law. Nigeria — with the largest market — has opted for the fastest path to operational oversight, at the cost of the legal finality that a new statute would provide.
What the Framework Means for Non-Nigerian Firms
Nigeria’s VARA model has implications beyond its borders. Sub-Saharan Africa’s total crypto transaction flows exceeded $200 billion, and Nigeria accounts for a disproportionate share. Any exchange with Nigerian users — regardless of where it is incorporated — is effectively operating in Nigeria’s market and is potentially within scope of Nigerian regulatory requirements.
The NTAA 2025 reporting obligations, in particular, do not contain a territorial carve-out for foreign-incorporated platforms. A firm incorporated in Mauritius but processing Nigerian-user transactions may face a FIRS reporting requirement. The exact extraterritorial reach of these obligations has not yet been tested in enforcement, but the text of the legislation does not rule it out. Firms with significant Nigerian user bases should be seeking Nigerian legal advice on their NTAA exposure as a priority.
The VARC structure also signals something important about where Nigeria’s regulatory thinking is heading: toward convergence of tax, payment, and securities oversight into a coordinated policy approach. The three-phase implementation roadmap in the White Paper — Foundations, Market Protections, Supervisory Infrastructure — ends with real-time telemetry systems that allow regulators to monitor virtual asset activity continuously. When that infrastructure is built, the question of whether a foreign firm’s Nigerian-user transactions are being monitored will have a clearer answer.
What Comes Next
Nigeria’s VARA framework is an architecture, not a finished building. The VARC is in place, the VARO is operational, and the statutory foundation exists. What is still absent is the detailed operating guidance — capital requirements, technology standards, client asset protection rules — that would allow a firm to know with certainty whether it is fully compliant.
The White Paper describes a consultation process for these detailed rules, and the current period is intended to be one of registration and visibility rather than immediate enforcement. That window will close. Firms that use the current period to register with ARIP, align their FIRS reporting, and document their CBN compliance position will be significantly better placed than those that wait for the final rules before acting.
For Africa’s crypto market, Nigeria’s model is a live experiment in whether regulatory coordination can substitute for new legislation. The $92.1 billion in annual transactions at stake suggests the experiment is worth watching closely.
UphivaBETAR
