Nigeria: technology regulation at a glance

Framework: Investments and Securities Act (ISA) 2025 (Section 357 classifies virtual/digital assets as securities) administered by the Securities and Exchange Commission (SEC); CBN Guidelines on Operations of Bank Accounts for VASPs (Dec 2023); SEC Rules on Issuance, Offering Platforms and Custody of Digital Assets (2022, as amended 2024/2025); SEC Accelerated Regulatory Incubation Programme (ARIP, June 2024).

Crypto is legal in Nigeria and now sits under a dedicated statutory regime. The ISA 2025, signed by President Tinubu on 31 March 2025, expressly classifies virtual and digital assets as securities and empowers the SEC to license and supervise VASPs, digital asset exchanges (DAX), custodians, offering platforms and stablecoin issuers. The CBN reversed its 2021 banking ban in December 2023, so licensed operators can now access bank accounts, while a phased licensing rollout continues via the ARIP sandbox alongside a new crypto-specific tax regime under the Nigeria Tax Act.

Framework: National Artificial Intelligence Strategy (NAIS, 2024) led by the Federal Ministry of Communications, Innovation & Digital Economy (FMCIDE) and NITDA/NCAIR; no AI-specific statute yet in force, with several comprehensive AI bills advancing in the National Assembly. Personal-data aspects of AI are governed by the binding Nigeria Data Protection Act 2023 (enforced by the NDPC).

Nigeria currently has no enacted AI-specific law. Its central instrument is the non-binding National Artificial Intelligence Strategy (2024), while the only binding rules touching AI come from the Nigeria Data Protection Act 2023 (automated decision-making/profiling). Multiple comprehensive AI bills, most notably the National Digital Economy and E-Governance Bill and the National AI Commission (Establishment) Bill, are moving through the legislature, positioning Nigeria toward a risk-based regulatory regime.

Framework: Nigeria Data Protection Act (NDPA) 2023, supervised by the Nigeria Data Protection Commission (NDPC), operationalized by the General Application and Implementation Directive (GAID) 2025.

Nigeria has a comprehensive, GDPR-style data-protection regime under the Nigeria Data Protection Act 2023, which has been in force since 12 June 2023 and repealed the earlier Nigeria Data Protection Regulation (NDPR) 2019. The Act establishes the Nigeria Data Protection Commission (NDPC) as the independent supervisory and enforcement authority, and its detailed implementation rules were issued through the General Application and Implementation Directive (GAID) 2025, which took full effect on 19 September 2025.

Framework: Central Bank of Nigeria (CBN) under the CBN Act 2007 and BOFIA 2020, operationalized through the 2020 'Circular on New License Categorizations for the Nigerian Payments System' and supporting guidelines; digital consumer lending/BNPL additionally regulated by the Federal Competition and Consumer Protection Commission (FCCPC).

Nigeria operates a clear, mature licensing regime for digital payments administered by the CBN, which categorizes payment-system operators into Switching & Processing, Mobile Money Operations (MMOs), Payment Solution Services (PSSP/PTSP/Super-Agent), and Payment Service Banks, each with defined permissible activities and capital requirements. Real-time payments run on NIBSS Instant Payments (NIP), one of the world's largest instant-payment rails. An open-banking regulatory framework and operational guidelines have been issued but full go-live has been repeatedly delayed into 2026, and digital lending/BNPL is now governed by the FCCPC's 2025 DEON Regulations.

Framework: Nigeria Visa Policy 2025 (NVP 2025) administered by the Nigeria Immigration Service (NIS) under the Immigration Act 2015; residence governed by CERPAC and the new Temporary/Permanent Residence Visa categories.

Nigeria has no dedicated digital-nomad or remote-work visa. Under the NVP 2025 (effective 1 May 2025, e-Visa launched via evisa.immigration.gov.ng), foreign relocators access residency through other routes: a Short Visit e-Visa (up to 90 days, not for work), a Temporary Residence Visa tied to employment/study (up to 2 years, with CERPAC), and a Permanent Residence Visa for investors, retirees and highly-skilled individuals. Remote work for foreign clients while on a visit visa sits in a legal grey area and is not an authorised pathway.

Framework: No single omnibus online-safety statute. Online content/safety is governed by a layered, co-regulatory regime: the NCC Internet Code of Practice 2026 (Nigerian Communications Commission), the NITDA Code of Practice for Interactive Computer Service Platforms/Internet Intermediaries 2022 (National Information Technology Development Agency), and the criminal Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act 2024.

Nigeria regulates online content and safety through several overlapping instruments rather than one comprehensive online-safety law. The NITDA Code (2022) and the more recent NCC Internet Code of Practice 2026 impose content-moderation, takedown, transparency and child-protection obligations on platforms and internet access providers via a co-regulatory model, while the amended Cybercrimes Act 2024 criminalises categories of online speech. The regime is real and tightening, but is built from subsidiary codes and a cybercrime statute, and several provisions raise free-expression concerns.

Framework: Cybercrimes (Prohibition, Prevention, etc.) Act 2015, as amended by the Cybercrimes (Amendment) Act 2024, operationalized through the National Cybersecurity Policy and Strategy 2021, the Office of the National Security Adviser (ONSA) Directorate of Cybersecurity, and the Nigerian Computer Emergency Response Team (ngCERT). Sector-specific rules supplement it, notably the Central Bank of Nigeria's risk-based cybersecurity framework and breach-notification duties under the Nigeria Data Protection Act 2023.

Nigeria has a dedicated, comprehensive cybersecurity statute, the Cybercrimes (Prohibition, Prevention, etc.) Act 2015, amended in 2024, covering offences, protection of critical national information infrastructure, incident reporting, and a cybersecurity levy/fund. It is reinforced by the National Cybersecurity Policy and Strategy 2021 and a national coordination body (ngCERT under ONSA). Sectoral overlays, especially the Central Bank's risk-based framework for banks and financial institutions, impose stricter incident-reporting duties.

Framework: Companies and Allied Matters Act (CAMA) 2020 administered by the Corporate Affairs Commission (CAC); foreign-investment overlay under the Nigerian Investment Promotion Commission (NIPC) Act and the Immigration Act (business permit / expatriate quota via the Ministry of Interior).

Nigeria permits up to 100% foreign equity ownership in most sectors and company incorporation with the CAC is now largely online, but foreign-owned companies face additional layered requirements: a ₦100 million minimum issued share capital, mandatory NIPC business registration, a business permit, and expatriate quotas. The legal openness to foreign ownership is offset by a meaningful capital threshold and multiple sequential agency steps, making the overall process moderate rather than easy for foreigners.