Fintech Laws and Regulations 2023
Fintech Laws and Regulations 2023
Fintech Laws and Regulations 2023
3
Regulatory and insurance technology
Back to top
Given the speed of innovation and the evolving regulatory regime for
Fintech companies in Nigeria, financial institutions have resorted to
regulatory technology (“Regtech”) solutions to aid in regulatory
compliance. Requirements for more rigorous data protection and
privacy have led Fintech companies to, as part of their Regtech
offerings, provide blockchain, cybersecurity and other technology-
enabled services to enable banks and other financial institutions to
comply with data protection, risk-monitoring, reporting and Know Your
Customer (“KYCˮ) requirements.
The insurance space in Nigeria is dominated by traditional insurance
companies offering their services without the use of Insurance
Technology (“Insurtech”). The Census Report shows that only about
3% of Fintech companies provide Insurtech products and services.
However, in recent times, some start-ups, such as AutoGenius,
CompareIN, Insurpass and Casava, have emerged with technologies that
integrate the creation, distribution and administration of the insurance
business using mobile applications, thereby promoting ease of accessing
insurance products and services at competitive prices.
This has compelled key players in the insurance industry to rethink their
mode of operation. One such way includes partnerships. Carbon, a
Fintech company, has partnered with Axa Mansard (an insurance
company) to launch a range of healthcare benefits for its customers in
the wake of the COVID-19 pandemic lockdown in Nigeria. 4 Also, Aella
Credit, another Fintech company providing lending services, launched
its health insurance product AellaCare to provide health insurance for
financially excluded persons in Nigeria.5
It is expected that more of such partnerships will emerge in the coming
years as Fintech companies look to diversify from other “crowded” areas
of Fintech in Nigeria. The Insurtech companies are helping traditional
insurance companies package insurance products into the point-of-sale
of various digital platforms. Recently, FSD Africa and the National
Insurance Commission (“NAICOM”) announced their partnership that
launched BimaLab. BimaLab is an accelerator programme designed to
address gaps in the insurance industry. Through a series of awareness,
BimaLab seeks to nurture and promote insurtech start-ups to accelerate
development and facilitate the use of digital solutions for the insurance
sector.6
NAICOM recently issued the Insurance Web Aggregators Operational
Guidelines which became effective from February 1, 2022 (the
“Operational Guidelines”). The Operational Guidelines applies to
relevant participants carrying out insurance web aggregator services.
The Operational Guidelines covers the registration, supervisions, and
monitoring of web aggregators as insurance intermediary who maintain
websites for providing information on products of different insurers.
4
Regulatory bodies
Back to top
As at today, there is no single regulatory authority assigned to fintech in
Nigeria. The regulators of fintech in Nigeria cut across various other
sectors in Nigeria. The main regulatory bodies of the Fintech sector in
Nigeria include the CBN, the Nigerian Deposit Insurance Corporation
(“NDIC”), the SEC, the Nigerian Communications Commission
(“NCC”), the National Information Technology Agency (“NITDA”),
the National Insurance Commission (“NAICOM”), the Federal
Competition and Consumer Protection Commission (“FCCPC”), the
Corporate Affairs Commission (“CAC”), the Federal Inland Revenue
Service (“FIRS”), the Nigeria Data Protection Commission (“NDPC”)
and the National Office for Technology Acquisition and Promotion
(“NOTAP”). The extent of each regulator’s supervision will mostly
depend on the transactions or fintech services which the fintech
company is engaging in.
The CBN: The CBN has primary responsibility for regulating financial
services in Nigeria. The CBN is the principal regulator mandated to
issue licences to banks and other financial institutions by virtue of the
Banks and Other Financial Institutions Act, 2020 (“BOFIA”). Fintech
companies offering financial services to Nigerian consumers must
obtain the appropriate licences and comply with CBN’s applicable
guidelines.
The NDIC: The NDIC is responsible for insuring all deposit liabilities
of licensed banks and other deposit-receiving financial institutions in
Nigeria. Fintech companies that provide mobile banking services,
including deposit accounts such as checking and savings accounts for
Nigerian consumers, are required to be registered with the NDIC. This
is pursuant to section 15 of the NDIC Act, 2006.
The SEC: The SEC is the securities and capital markets regulator in
Nigeria pursuant to the Investments and Securities Act, 2007 (“ISA”).
Fintech companies desirous of raising capital from the capital market
must register their securities with the SEC and comply with the ISA
and the rules made thereunder. Further, in in May 2022, the SEC
established the Rules on Issuance, Offering Platforms and Custody of
Digital Assets (the “Rules on Digital Assets”). By the Rules on
Digital Assets, the SEC is empowered to regulate the Issuance of
digital assets as securities, the registration of digital assets offering
platforms, registration of digital asset custodians, virtual assets service
providers and digital assets exchange.
The CAC: The CAC is the regulatory body responsible for the
incorporation and statutory supervision of all companies in Nigeria.
The CAC makes regulations for the operation of Companies in Nigeria
an ensures compliance with the statutory requirement for companies in
Nigeria. Fintech companies (including banks) must be incorporated at
the CAC to carry on business in (as distinct from doing business with)
Nigeria except otherwise exempted from this requirement by the
Minister of Trade, Industry and Investment (see sections 78 and 80 of
CAMA 2020).
The NCC: The NCC is empowered by the Nigerian Communications
Act, 2003 to regulate the telecommunications industry in Nigeria.
Thus, Fintech companies offering services that involve the use of
mobile networks or mobile phones are subject to NCC’s regulatory
purview and must obtain operating licences from the NCC. For
instance, companies that operate mobile payments must be licensed by
the NCC pursuant to the Licence Framework for Value Added Service
(“VAS”). The NCC VAS regulation defines a VAS provider as a
person or organisation engaged in the provision of value-added
mobile/fixed services.
The NITDA and NDPC: The role of the NITDA pursuant to the
NITDA Act, 2007 is to develop, regulate and advise on Information
technology in Nigeria through regulatory standards, guidelines and
policies. Pursuant to its regulatory powers, the NITDA issued the
Nigerian Data Protection Regulations in 2019 (the “Regulations”) and
subsequently issued its Implementation Framework in 2020 (the
“Framework”). The Regulations and its Implementation Framework
aim to safeguard the rights of natural persons to data privacy and foster
the safe conduct of transactions involving the exchange of personal
data. However, in June 2023, the Nigeria Data Protection Act
(“NDPA”) was signed into law as the primary regulation on data
protection in Nigeria. The NDPA established the NDPC as a body
which will regulate the processing of personal data by data controllers
and data processors in Nigeria. Operationally, the NDPC regulates the
processing of personal data as contained in the regulations, the
Framework and the NDPA, while the NITDA regulates cloud
computing services or data centres used for storage and processing of
data in Nigeria. The NDPA and the NITDA regulation extends to
Fintech companies who are handling, processing, storing or
transferring the data of data subjects in Nigeria.
The NAICOM: The NAICOM was established by the NAICOM Act,
1997 with the responsibility for ensuring the administration,
regulation, and control of insurance business in Nigeria. Thus, where
an Insurtech company carries on insurance business, it will require a
licence from the NAICOM.
The FCCPC: The FCCPC was established by the Federal Competition
and Consumer Protection Act, 2018 (“FCCPA”). The FCCPA
prohibits anti-competitive practices in the Fintech space. The practices
covered include price-fixing market division and exclusive dealing
agreements that have anti-competitive effect. It is, however, worthy of
note that the regulatory oversight of the FCCPC will only extend to
Fintech companies that do not qualify as banks or other financial
institutions as defined by BOFIA. This is pursuant to the ever-rising
arguments on who has the ultimate powers to regulate the banks and
other financial institutions. While the FCCPA attempts to override
other laws in all matters regarding anti-competition and consumer
protection, the BOFIA specifically restricts the application of the
FCCPA and any products arising from the operations of banks and
other financial institutions. In this regard, the regulation of the CBN
pursuant to the BOFIA supersedes the regulation of the FCCPC in
matters pertaining to financial products and services.
The NOTAP: The NOTAP is an agency under the Federal Ministry of
Science and Technology in Nigeria established by the NOTAP Act
N68, LFN 2004. NOTAP is saddled with the responsibility of
regulating and promoting the acquisition, transfer, and domestication
of foreign technology in Nigeria. NOTAP’s regulation will apply to
Nigerian Fintech companies who engage in technology acquisition
activities and enter into technology transfer agreements in their
business with foreign entities.
The FIRS: The FIRS is the federal tax regulator in Nigeria. Fintech
companies are required to remit income tax, withholding tax, value-
added tax and stamp duties to the government through the FIRS. Pay-
as-you-earn taxes are remitted to the state (not federal) internal
revenue services for the location (the state) where the employee in
question works.
The NDPC: The NDPC is the data privacy regulator in Nigeria. They
are empowered by the Nigeria Data Protection Act, 2023 (“NDPA”) to
make regulations regarding the processing of data by data controllers
and processors in Nigeria. The NDPA extends to Nigerian Fintech
companies who are handling, processing, storing or transferring the
data of data subjects in Nigeria, The Fintech companies are required in
this regard to adhere to the provisions of the NDPA and the subsequent
regulations that may be made by the NDPC.
5
Key regulations and regulatory approaches
Back to top
There has been no single regulatory approach targeted at the Fintech
players in Nigeria. In the Nigerian Fintech space, what is obtainable is a
mix application of various statutes and regulations. CBN, as a major
regulator for Fintech in Nigeria, have made the following guidelines for
their operations: