Nigeria

The Nigeria Data Protection Act 2023 is a key privacy legislation enacted on June 12, 2023, that ensures the protection of citizens' data by establishing the Nigeria Data Protection Commission as the primary regulatory authority. Citizens are provided the right to govern their personal data, such as requesting access to or removal of the same. Data controllers are required to process data securely, report data breaches within 72 hours, and face heavy fines of up to two percent of their total annual gross revenue.

Money Laundering (Prevention and Prohibition) Act 2022 is one of the notable anti-money laundering laws which were put into effect on May 12, 2022. This Act acts as a barrier to the flow of money obtained through unlawful means. People are not allowed to engage in transactions above ₦5,000,000, and companies are only allowed to have transactions up to ₦10,000,000. This Act regulates virtual currencies and cryptocurrency companies. This law is strictly enforced in Nigeria and comes with penalties of ₦25 million per company and very heavy prison sentences for individuals.

The BOFIA (Banks and Other Financial Institutions Act) 2020 is Nigeria's main banking law, passed into effect on 12th November, 2020, to improve its financial sector through regulation by the Central Bank of Nigeria (CBN). This Act provides for the regulation of digital banking operations, the creation of a dedicated Credit Tribunal to swiftly settle non-performing debts, and more power to the CBN to close down or dissolve banks without government assistance. The law is fully functional and strictly enforced, and provides for heavy penalties for misuse of power and illegal banking activities, which attract a fine of at least ₦50,000,000 and imprisonment for a maximum of 5 years.

The Companies and Allied Matters Act (CAMA) 2020 is the primary corporate statute of Nigeria, enacted into law on August 7, 2020, to update corporate activities under the jurisdiction of the Corporate Affairs Commission (CAC). The Act succeeds the defunct 1990 statute and makes significant modifications to make business easy to conduct through provisions including one-person companies, electronic transmission of shares, virtual general meetings, among others. The act is fully functional and strictly enforced, requiring the disclosure of beneficial owners for increased transparency and, at the same time, making life easy for small businesses by exempting them from annual audits and company secretary obligations.

The CBN Risk-Based Cybersecurity Framework and Guidelines are a legally binding subsidiary legislation enacted through the powers vested in it via BOFIA 2020, which seeks to put in place the minimum cybersecurity requirements for financial institutions in Nigeria. While the initiative was initially launched on January 1, 2019, for large commercial banks before being expanded to other financial institutions, the framework operates within the ambit of a highly revamped 10-point framework, which took effect on July 1, 2024. This framework compels the banks and fintechs to have an independent Chief Information Security Officer (CISO) as well as undertake vulnerability assessments and have real-time threat intelligence. Under the tight leash of the CBN, firms are expected to submit data through the automated Cybersecurity Self-Assessment Tool (CSAT) by February 28 each year or suffer very stern enforcement measures like million-naira administrative fines and loss of operating license.

The Investments and Securities Act (ISA) 2025 is the key legislative piece of capital markets legislation in Nigeria, enacted on March 18, 2025, with the objective of protecting investors and maintaining the integrity of financial markets through the regulatory body, the Securities and Exchange Commission (SEC) [ISA 2025]. An entire replacement of the previous legislative structure of 2007, the act is quite contemporary as it recognizes digital assets, cryptocurrencies, tokenized securities, and NFTs under the purview of the SEC and criminalizes Ponzi scheme activities using strict asset-freezing fines. The act is currently functional and vigorously enforceable by giving the SEC more power to subpoena and audit digital transaction records, along with an obligation for capital markets to have higher capital requirements by June 30, 2027.