Introduction
Following the statutory recognition of digital and virtual assets under the Investments and Securities Act, 2025 (“ISA 2025”), the Securities and Exchange Commission (“SEC” or the “Commission”) has continued to develop a more comprehensive regulatory architecture for activities involving digital and virtual assets. The SEC’s exposure draft of the “Rules on Digital and Virtual Assets Operations, Custody and Markets” (“Draft Rules”) represents an important step in that process.
The Draft Rules, which were released by the SEC on August 20, 2026, with a two-week window for stakeholders to send in their comments and recommendations, go considerably beyond the regulation of traditional virtual asset service providers (“VASPs”) to address a wider range of activities and business models, including Digital Asset Exchanges (“DAXs”), Digital Asset Custodians (“DACs”), Digital Asset Platform Operators (“DAPOs”), Digital Asset Offering Platforms (“DAOPs”), Real-World Asset Tokenisation Platforms (“RATOPs”), stablecoins and asset-referenced tokens, digital-asset offerings, security tokens, peer-to-peer (“P2P”) trading, bridging, staking, automated market makers and decentralised finance (“DeFi”). This expansion is significant for businesses, financial institutions, investors and other stakeholders considering participation in Nigeria’s emerging digital asset economy.
The Draft Rules seek to strengthen investor protection, market integrity, financial-crime controls, cybersecurity, operational resilience and client-asset protection. They also reflect an important regulatory shift – digital assets are no longer being considered merely as an emerging technology issue but increasingly as part of the architecture of Nigeria’s capital market.
At the same time, the breadth and technical complexity of the proposed framework raise important questions concerning regulatory perimeter, proportionality, capital requirements, custody, stablecoins, tokenisation, DeFi, transition arrangements and regulatory coordination. The quality of the final framework will therefore depend not only on the rules themselves, but also on whether they provide sufficient certainty for legitimate market participants while preserving the Commission’s ability to respond effectively to evolving risks.
The consultation period was notably brief, given the breadth and technical complexity of the draft framework. Meaningful responses to rules of this nature typically require operators to model capital and fee impacts, assess technology and custody changes and coordinate with foreign affiliates, advisers and other regulators. Given the significance of the proposed framework for Nigeria’s digital asset market, the Commission may wish to consider a further round of consultation on a revised draft, or the publication of a response statement explaining how stakeholder comments have been addressed, before the rules are finalised. This would enhance the legitimacy and quality of the final framework and reduce the risk of avoidable post-implementation amendments.
Against this background, this article highlights some of the principal issues arising from the Draft Rules and their implications for the development of Nigeria’s digital asset market
Defining the regulatory perimeter – how far should the rules reach?
One of the most important questions concerns the territorial scope of the Draft Rules. The proposed framework applies to digital and virtual asset activities constituting investments and securities business in Nigeria and extends to persons who operate in Nigeria, provide services to persons resident in Nigeria, or target Nigerian investors or the Nigerian market, including through digital channels.
In a sense, the wide territorial application is understandable as digital asset businesses can operate across jurisdictions without maintaining a conventional physical presence in the markets they serve. Thus, a regulatory framework that focuses exclusively on physical establishment could create opportunities for regulatory arbitrage.
However, a broad formulation may also create uncertainty for legitimate foreign operators whose activities have only an incidental connection with Nigeria. For example, the mere fact that a person resident in Nigeria accesses an offshore platform does not necessarily mean that the platform has deliberately entered or targeted the Nigerian market.
A more predictable approach would therefore identify objective factors demonstrating an intentional commercial nexus with Nigeria. These could include deliberate marketing to Nigerian residents, Nigerian-specific promotional campaigns, Naira-denominated services, local agents or representatives, a Nigerian-facing interface, or sustained commercial activity directed at Nigerian customers.
The final framework should also distinguish between active targeting of the Nigerian market and circumstances involving reverse solicitation or purely passive accessibility, subject to applicable anti-money laundering, combating the financing of terrorism and combating proliferation financing (“AML/CFT/CPF”) requirements.
For international investors and technology businesses, this distinction is particularly important because regulatory certainty is itself an important component of investment attractiveness.
From regulatory incubation to full registration – the transition question
The SEC’s Accelerated Regulatory Incubation Programme (“ARIP”) is an important component of Nigeria’s evolving digital-asset regulatory architecture. ARIP provides a controlled environment within which digital-asset and other innovative businesses can operate under enhanced regulatory supervision while the Commission assesses their business models and compliance readiness. The SEC describes ARIP as a mechanism for fast-tracking VASPs and other digital investment service providers towards the appropriate regulatory regime.
However, the Draft Rules raise an important transition issue for businesses that are already operating under the Commission’s existing framework. Existing operators may need to restructure their registrations, meet materially different capital requirements, establish separate custody arrangements, modify technology infrastructure, renegotiate outsourcing arrangements and implement new reporting and governance requirements.
A transition regime should therefore provide sufficient time for orderly migration. Among other things, the framework could provide for: continued validity of existing registrations during the transition period; clear mapping of existing approvals to the new registration categories; phased compliance with new capital requirements; grandfathering of existing approvals where reasonably practicable; a clear process for obtaining approval for additional regulated functions; and mechanisms to avoid unnecessary duplication of application or registration fees.
This would enable the Commission to achieve the policy objectives of the new framework without unnecessarily disrupting businesses that have already invested in building compliant operations within Nigeria.
Proportionality matters – capital requirements should follow risk
The Draft Rules propose significant minimum capital requirements for different categories of digital asset operators. These include proposed minimum capital of ₦2 billion for DAXs and DACs, ₦500 million for DAPOs and DAOPs, ₦500 million for RATOPs and ₦200 million for VASPs.
The underlying objective is sound. Adequate financial resources are essential to market resilience, investor protection and the ability of regulated entities to absorb operational and other losses. Indeed, the SEC’s broader 2026 capital reforms expressly emphasise aligning capital requirements with the scope, complexity and risk exposure of regulated activities. The same principle is particularly important in the digital asset sector because the risk profiles of businesses operating under the same broad regulatory category may differ substantially.
A non-custodial advisory business, for example, does not necessarily present the same risk profile as a platform holding substantial client assets. Similarly, a technology provider may have materially different risks from a DAX or a custodian.
A more risk-sensitive framework could therefore consider factors such as the nature of the regulated function; custody and client-asset exposure; transaction volumes; operational and technology risk; systemic importance; leverage and market exposure; number of clients; and whether the entity holds proprietary assets, client assets, or both.
Tiered capital requirements could allow the Commission to maintain stronger prudential safeguards for higher-risk activities while avoiding unnecessary barriers to entry for lower-risk businesses. This is particularly important as Nigeria aims to encourage innovation alongside effective regulation.
Additionally, the figures in the Draft Rules do not align fully with the SEC’s revised minimum capital framework issued in January 2026, which prescribes, among other things, ₦1 billion for DAOPs and RATOPs, ₦500 million for Digital Asset Intermediaries (“DAIs”) and ₦300 million for Ancillary Virtual Asset Service Providers (“AVASPs”), with compliance required by June 30, 2027. The Draft Rules therefore appear to reduce the capital applicable to DAOPs and RATOPs and to replace the more granular DAI and AVASP categories with a single ₦200 million VASP category.
This inconsistency creates uncertainty for market participants, many of whom are already planning or executing recapitalisation exercises against the January 2026 framework. The final Rules should therefore clarify whether the capital requirements in the Draft Rules are intended to supersede the January 2026 framework; how existing DAI and AVASP classifications will map to the new registration categories; and which compliance deadline applies. Absent such clarification, operators face the risk of conflicting obligations and of capital planning decisions being overtaken by subsequent regulatory change.
Custody – beyond the cold wallet debate
Custody is one of the most important areas of the proposed framework because digital assets introduce risks that differ materially from those associated with conventional securities custody. The Draft Rules contain extensive requirements relating to wallet management, cryptographic keys, segregation of client assets, access controls, multi-signature arrangements, audits and other safeguards.
One notable requirement concerns cold storage. While cold storage can reduce certain forms of cyber risk, a fixed percentage requirement may not necessarily be appropriate for every asset, client or custody model.
Liquidity requirements, blockchain settlement characteristics, withdrawal patterns, institutional versus retail clients, cybersecurity architecture and the use of multi-signature or multi-party computation arrangements may all affect the appropriate custody model.
A more technology-neutral approach would therefore establish a risk-based minimum standard for cold storage, while allowing the Commission to impose higher requirements where the circumstances warrant. The underlying regulatory objective should be secure custody, rather than adherence to a particular technological architecture.
Proof of reserves is only part of the picture
The Draft Rules contemplate periodic proof-of-reserves or equivalent attestations for entities holding client assets. Proof of reserves can provide useful transparency. However, reserves alone do not necessarily establish that an operator is solvent or that all customer claims have been accurately recorded.
A stronger framework would therefore combine proof of reserves with proof of liabilities and reconciliation. Such a framework could address client asset balances; proprietary assets; liabilities; encumbrances; omnibus wallets; off-chain ledger balances; related-party exposures; and reconciliation of each client’s entitlement against relevant wallet or custody balances.
Independent assurance would further enhance the credibility of the process. For institutional investors in particular, certainty regarding the legal and financial status of client assets may ultimately be as important as the technological security of the wallets in which those assets are held.
Client assets and insolvency – the legal characterisation matters
The Draft Rules appropriately seek to protect client assets from claims by creditors and from the insolvency of a DAC. However, regulatory language alone may not be sufficient to establish proprietary rights that are enforceable against third-party creditors in an insolvency scenario.
The final framework should therefore be supported by clear legal structures and documentation capable of producing the intended outcome under Nigerian law. Depending on the custody model, this could include recognised trust, nominee, escrow or other appropriate structures, supported by clear contractual arrangements and client-level records.
Custody agreements should also clearly establish ownership or beneficial interests; segregation arrangements; the custodian’s duties; treatment of assets upon insolvency; enforcement rights; treatment of omnibus wallets; and procedures for returning client assets.
The objective should be to ensure that the protection contemplated by the regulatory framework translates into enforceable legal rights when those rights are most needed.
Stablecoins – where regulatory jurisdictions intersect
Stablecoins present perhaps one of the clearest examples of why regulatory coordination will be critical to the success of Nigeria’s digital asset framework.
The Draft Rules address stablecoin issuance, offering, admission, trading, custody, reserve management, redemption, recognition and use in capital market activities. At the same time, stablecoins may intersect with activities traditionally associated with banking, payments, foreign exchange, remittances, stored value and electronic money.
The Draft Rules recognise this intersection and indicate that recognition of a foreign stablecoin does not authorise activities falling within the regulatory jurisdiction of the Central Bank of Nigeria (“CBN”) or another competent authority. This is an important principle.
However, for market participants, the practical question is how the boundaries between the respective regulatory regimes will operate.
Businesses need clarity on matters such as: which regulator has primary jurisdiction over a particular activity; when a stablecoin constitutes a capital market product; when its use constitutes a payment or banking activity; what approvals or no-objection requirements apply; how foreign stablecoins may be recognised; and how settlement involving stablecoins will interact with existing financial market infrastructure.
A coordinated SEC–CBN framework would therefore be particularly valuable and should be considered in finalising the proposed rules.
Stablecoin reserves require transparent calibration
The Draft Rules introduce detailed reserve, collateral, liquidity and stress-testing requirements for stablecoins. The framework contemplates, among other things, reserve assets being unencumbered and segregated, redemption arrangements, daily reconciliation, independent reserve attestations and liquidity safeguards. The Draft Rules also contemplate a 120% liquidity coverage ratio and specified stress scenarios. These measures reflect the importance of redemption and liquidity risk in stablecoin arrangements.
However, reserve requirements should be calibrated according to the characteristics of the underlying asset, the redemption model, the composition of reserves and the actual risk profile of the instrument. A transparent methodology is therefore important.
The framework should make clear how reserve ratios, collateral haircuts, liquidity requirements and stress tests interact and how these requirements may be adjusted as market conditions and stablecoin structures evolve. This would provide both stronger protection and greater predictability for issuers and investors
Tokenisation – opportunity depends on legal certainty
The proposed framework for RATOPs is particularly significant. Tokenisation could facilitate new models for fractional ownership, investment, capital formation and access to previously illiquid assets. But technological representation does not, by itself, resolve the legal nature of the underlying asset.
For investors, the critical questions include: what exactly does the token represent; what legal rights does the token holder acquire; who holds the underlying asset; how are those rights enforced; and what happens if the issuer, trustee, nominee or platform becomes insolvent?
The final framework should therefore ensure that tokenised interests are supported by clear legal rights, enforceable documentation, appropriate custody arrangements and transparent disclosure of the relationship between the token and its underlying asset. This is crucial for institutional investors who will require confidence not only in the technology but also in the enforceability of the underlying investment rights.
DeFi – regulation should focus on substance rather than labels
The Draft Rules take an important approach to decentralized finance by recognising that an activity should not be treated as fully decentralized merely because it is described as such or is implemented through smart contracts, distributed governance or open-source software. A functional approach is appropriate.
The central question should be whether an identifiable person or group exercises sufficient control, governance, commercial influence or economic benefit to justify regulatory treatment.
However, concepts such as “influence”, concentration of governance tokens or other forms of control should be sufficiently defined or accompanied by objective factors.
Without appropriate thresholds, the regulatory perimeter could unintentionally capture persons whose involvement is fundamentally technological or passive, including: open-source developers; infrastructure providers; validators; liquidity providers; or passive governance-token holders.
The final Rules would benefit from illustrative criteria that distinguish meaningful control or commercial facilitation from technical participation or passive economic exposure. This would help the Commission regulate genuine regulatory risks without inadvertently discouraging technological development.
P2P markets – safeguards rather than a single technological model
Peer-to-peer trading presents another area where regulation must balance control with technological neutrality. The Draft Rules rightly contemplate safeguards relating to Know-Your-Customer (KYC), escrow, monitoring and settlement.
However, requiring P2P activity to operate within a particular controlled technological environment may prove difficult where the underlying business model is inherently decentralised or where alternative technological arrangements can achieve equivalent safeguards.
The regulatory focus could instead be on minimum controls covering identity verification; transaction monitoring; sanctions screening; escrow arrangements; fraud prevention; dispute resolution; transaction records; and traceability.
The objective should be to regulate the risk and function, rather than prescribe one technological architecture.
Security tokens should connect clearly with existing capital market rules
Where a token constitutes a security, investment contract, unit in a collective investment scheme, debenture, note or another capital market instrument, its regulatory treatment should align with established Nigerian securities law principles. This includes considerations relating to public offerings; private placements; prospectus or offer document requirements; minimum subscriptions; allotment and refunds; continuing disclosure; market conduct; and investor protection.
A clear securities offering perimeter would be particularly valuable because tokenisation should not create an unintended parallel capital market regime simply because the underlying instrument is represented digitally. The technology may be new, but the underlying legal and economic rights may not be.
Retail investment limits should reflect product and investor risk
The Draft Rules contemplate investment limits and a cooling-off period for retail investors.
While this is an important regulatory objective, fixed monetary thresholds may not adequately differentiate between different products and risk profiles. A highly speculative token, an asset-backed token, a regulated security token, a stablecoin and a tokenised government security may present materially different risk characteristics.
A more flexible framework could consider investor category; product risk; investor income or net worth; offering size; minimum subscription; suitability assessment; product characteristics; and the level of disclosure applicable to the offering.
Similarly, a regulatory cooling-off right may be appropriate for specified primary retail offerings but may create uncertainty if applied indiscriminately to secondary market transactions or rapidly fluctuating market instruments.
The final Rules should therefore clearly identify the transactions to which cooling-off rights apply.
Bridging and interoperability – regulation should follow risk
Cross-chain bridges and interoperability protocols are becoming increasingly important to digital asset infrastructure. They can also introduce significant operational, cybersecurity, liquidity and counterparty risks.
The regulatory framework should therefore focus on the functions being performed and the risks created rather than on the underlying technology alone.
Questions such as who controls the bridge, who holds or controls assets during the transfer process, whether assets are wrapped or otherwise represented, who bears the risk of a failed transaction and what happens in the event of a security compromise are likely to be more important than the particular protocol architecture. This is another area where technology-neutral regulation will be critical.
Regulatory access and data – proportionality is important
The Draft Rules contemplate the Commission requiring regulated entities to provide API-based or other electronic access to operational, transactional, financial, risk, wallet, custody and compliance information. Regulatory technology can significantly improve supervision of digital asset markets.
However, direct electronic access to systems also introduces cybersecurity, privacy, operational and data-governance considerations.
Regulatory access should therefore be risk-based; proportionate; subject to appropriate cybersecurity safeguards; clearly defined in scope; limited to information reasonably required for supervision; and supported by appropriate protocols for access, authentication, retention and audit.
This will be particularly important as digital-asset operators increasingly integrate sophisticated technological infrastructure with traditional financial systems.
The proposed National Digital Assets Confiscation Wallet
The proposal for a National Digital Assets Confiscation Wallet is an innovative feature of the Draft Rules. The proposed wallet would provide an infrastructure for the receipt, custody, preservation or transfer of digital or virtual assets subject to lawful freezing, seizure, preservation, confiscation, forfeiture or recovery orders.
However, given the sensitivity of such assets, the final framework should provide detailed safeguards around: the legal authority for transfer; custody arrangements; access controls; segregation; audit trails; valuation; treatment of forks, airdrops and staking rewards; treatment pending final forfeiture; return of assets following discharge of an order; and accountability for loss or unauthorised movement.
These matters should be expressly tied to a lawful court order or other legally valid authority, as appropriate. The credibility of such a system will ultimately depend on the strength of its governance, controls and accountability mechanisms.
Wind-down and resolution should form part of the framework
The Draft Rules rightly require regulated entities seeking to cease operations to submit an orderly wind-down plan addressing matters such as client assets, outstanding obligations, client notification and records.
However, given the nature of digital assets, wind-down should be viewed as more than a corporate exit process. A comprehensive resolution framework should contemplate transfer of client assets; continuity of access to wallets and records; treatment of private keys; transfer of client relationships; cross-border recovery; treatment of assets held with third parties; preservation of transaction records; and arrangements for distressed or failed operators.
For a market seeking greater institutional participation, confidence that assets can be recovered or transferred in an orderly manner is an important component of market infrastructure.
Supervisory fees should be predictable and avoid double counting
The Draft Rules propose supervisory fees based on “adjusted turnover”, with different rates applicable to DAXs and other regulated entities and lower rates during ARIP. The rules already recognise the need to exclude certain transactions, including internal transfers, non-economic movements and custody-only movements.
The final methodology should nevertheless be sufficiently detailed to avoid uncertainty or double counting. This is important where a single economic transaction may pass through several regulated functions – for example, a VASP, DAX, custodian and settlement provider. The framework should therefore expressly address intra-group transactions; intra-platform movements; technical infrastructure transactions; custody-only transfers; proprietary transactions; market-making; stablecoin minting and redemption; staking; lending; cross-chain transfers; and transactions involving the same client or beneficial owner.
A transparent methodology would make supervisory costs more predictable and support better business planning.
The broader issue – regulatory coordination
Many of the issues arising from the Draft Rules point to a broader consideration: digital assets do not fit neatly within traditional regulatory boundaries. A single transaction may involve securities regulation, payments, banking, foreign exchange, taxation, AML/CFT/CPF obligations, data protection, technology and corporate law. The successful implementation of the digital asset framework will therefore require effective coordination between the SEC and other relevant authorities, particularly where regulatory jurisdictions intersect.
For market participants, the objective should be a regulatory environment in which obtaining SEC approval does not create uncertainty about whether another approval is subsequently required for the same business activity. Clear inter-agency protocols, regulatory guidance and coordinated approvals could materially improve certainty for investors and operators.
Conclusion
The Draft Rules mark a significant development in Nigeria’s digital asset regulatory journey and demonstrate a clear intention to move beyond broad recognition and establish detailed requirements covering market operators, custodians, exchanges, tokenisation platforms, stablecoins, digital-asset offerings and emerging technologies such as DeFi and P2P markets.
The regulatory environment is evolving rapidly, and businesses operating or intending to operate within Nigeria’s digital asset ecosystem will need to assess not only their licensing position but also their governance, capital, custody, technology, compliance and contractual arrangements against the emerging framework.
The next stage is to ensure that the final framework is sufficiently clear, proportionate, technology-neutral and commercially workable – the framework must provide the certainty, flexibility and safeguards necessary for the market to develop sustainably.
The Grey Matter Concept is an initiative of the law firm, Banwo & Ighodalo.
DISCLAIMER: This article is only intended to provide general information on the subject matter and does not by itself create a client/attorney relationship between readers and our Law Firm or serve as legal advice. We are available to provide specialist legal advice on the readers’ specific circumstances when they arise.
