CBN Fintech and Payment Services Licensing in Nigeria: The Complete Regulatory Guide (2026)

The Legal Framework: BOFIA 2020 and the CBN Payment Systems Guidelines

The regulatory foundation for all Nigerian fintech and payment companies is the Banks and Other Financial Institutions Act 2020 (BOFIA 2020), which replaced the BOFIA 1991. The 2020 Act is significant for the fintech sector for three reasons: it formally recognised Payment Service Providers (PSPs) as a distinct category of Other Financial Institutions (OFIs); it gave the CBN express statutory authority to licence, supervise, and sanction PSPs; and it made operating a payment service without CBN authorisation a criminal offence.

The operational framework sits within the CBN’s Guidelines on Operations of Electronic Payment Channels in Nigeria, the Payments System Vision 2025, the CBN Regulatory Framework for Mobile Payment Services, and a series of circulars — most significantly the December 2020 circular that created the current four-category PSP licensing structure and clarified the rules around fund custody, holding company structures, and MEMART requirements.

The Four PSP Licence Categories and What Each Permits

The CBN’s December 2020 circular established four PSP licence categories, each covering distinct activities within Nigeria’s payments ecosystem. Choosing the correct category is the most consequential decision in any fintech licensing process — the category determines what you can and cannot do, how much capital you need, and what your MEMART must say.

The Holding Company Rule

One of the most important structural rules in the CBN’s 2020 circular is that Switching companies and MMOs cannot be combined under the same entity. A fintech group that wants to operate both services must establish them as legally separate subsidiaries under a holding company. The holding company structure itself requires careful legal planning — the MEMART of the holding company, the subsidiary structure, and the inter-company arrangements must all be CBN-compliant before the group begins operations.

Capital Requirements, Fees and Financial Obligations

The escrow deposit is a refundable amount paid into the CBN PSP Share Capital Deposit Account during the pendency of the application — it is returned to the applicant with accrued interest once the licence is approved. It is not a fee that is lost. However, the paid-up share capital must remain in the company as working capital — it cannot be withdrawn after the licence is granted.

The Licensing Process: From Application to Final Licence

The CBN licensing process for all PSP categories follows a two-stage structure: Approval-in-Principle (AIP) followed by Final Licence. Realistic timelines range from six to twelve months for straightforward applications with complete documentation, to eighteen months or longer for complex structures or applications that require resubmission.

Stage 1 — Pre-Application Preparation

Before submitting any documents to the CBN, the applicant must: incorporate the company with the CAC with an authorised share capital that matches the licence category requirement; draft and register the MEMART with objects clauses that exactly match the permitted activities for the chosen licence category; deposit the escrow amount into the CBN PSP Share Capital Deposit Account; obtain a Tax Identification Number and three years’ tax clearance certificates (or from the date of incorporation if less than three years old); and establish the minimum board structure of at least five directors who meet the CBN’s fit and proper criteria.

Stage 2 — AIP Application Submission

The AIP application is submitted to the Director, Payments System Management Department, Central Bank of Nigeria, Abuja. The application package must include: the written application letter; Certificate of Incorporation from the CAC; certified true copies of the MEMART; evidence of capital deposit in the CBN escrow account; a comprehensive five-year business plan with financial projections; an IT infrastructure and security framework including PCI-DSS compliance documentation; an AML/CFT policy and KYC procedures; a risk management and internal control framework; CVs and personal questionnaires for all directors and key management personnel; organisational chart and staffing plan; evidence of technical partnerships with banks or card schemes where applicable; and for some applicants, evidence of CBN Regulatory Sandbox participation or pilot transaction testing.

Stage 3 — AIP Review and Physical Inspection

The CBN reviews the application documentation and, if satisfied, issues an Approval-in-Principle. Following AIP, the CBN conducts a physical inspection of the applicant’s offices and technical infrastructure. The inspection assesses whether the IT systems, security standards, and operational environment match what was described in the application. Deficiencies identified at inspection must be remediated before the Final Licence is issued.

Stage 4 — Final Licence

After a successful physical inspection and payment of the licensing fee, the CBN issues the Final Licence. For PSSP and PTSP applicants, the Final Licence process typically takes two to three months from AIP. For MMO and Switching applicants, the timeline is longer due to the higher capital requirements and more complex operational review.

MEMART Requirements: Why Your Objects Clause Can Kill Your Application

The CBN’s 2020 circular introduced a requirement that became one of the most common sources of application rejection: the Memorandum and Articles of Association (MEMART) of every PSP must contain objects clauses that precisely reflect — and do not exceed — the permitted activities for the licence category being applied for.

This requirement has two critical implications. First, a company that was incorporated before the 2020 circular with broad objects clauses covering multiple financial activities must amend its MEMART before applying for a PSP licence. Second, a company that wants to add a new category of payment service in the future must first amend its MEMART and potentially apply for an upgraded or additional licence before expanding its activities.

The CBN Regulatory Sandbox: Testing Before You License

The CBN Regulatory Sandbox Framework (2021) allows fintech innovators to test new products and services in a supervised environment for up to six months without holding a full licence. The sandbox is designed for genuinely innovative products that do not fit neatly within existing licence categories — it is not a route to avoid or delay licensing for products that clearly fall within an existing category.

Sandbox participation does not automatically convert into a full licence. Conversion from sandbox to full licence has remained low because the compliance and capital requirements for a full licence apply at the point of conversion. However, sandbox participation can provide valuable regulatory intelligence — understanding how the CBN evaluates the product — and can demonstrate regulatory engagement that supports a subsequent licence application.

Post-Licence Compliance Obligations

Obtaining a CBN licence is not the end of the regulatory journey — it is the beginning of ongoing compliance obligations that, if neglected, result in fines, suspension, or revocation. PSP licence holders must maintain the following on an ongoing basis:

• Minimum capital maintenance. The paid-up share capital must be maintained at all times. Any reduction below the minimum triggers a regulatory breach.
• Annual returns and financial statements. Audited financial statements must be submitted to the CBN annually.
• Periodic CBN inspections. The CBN conducts routine and special purpose examinations of licensed PSPs. Cooperation with inspection teams is mandatory.
• AML/CFT compliance. Ongoing compliance with the CBN’s AML/CFT Regulations and NFIU guidelines is required. Transaction monitoring systems must be active and effective.
• PCI-DSS certification renewal. Payment Card Industry Data Security Standard certification must be maintained and renewed annually.
• NDPA data protection compliance. Licensed PSPs process significant volumes of personal data and are almost certainly DCPMIs under the NDPA. NDPC registration, DPO appointment, and annual compliance audit filing are required alongside CBN compliance. For a full guide to NDPA compliance obligations, see our NDPA Corporate Compliance Playbook.
• CBN prior approval for new products and partnerships. Fintechs operating within the payments system must obtain CBN clearance before collaborating on new products or services with other payment businesses, banks, or financial institutions.

Common Mistakes That Delay or Kill CBN Licence Applications

• Choosing the wrong licence category. A payment gateway founder who incorporates as an MMO because they want to “keep options open” faces a ₦2 billion capital requirement for a business that only needs ₦250 million. Conversely, a founder who applies for a PSSP licence but builds a wallet product finds that PSSP does not permit fund custody — the product cannot launch legally under that licence. Category selection must precede incorporation, not follow it.
• Drafting the MEMART without CBN-specific legal advice. Standard Nigerian company formation agents draft generic MEMART objects clauses. These almost never meet the CBN’s precise requirements for PSP licensing and are a leading cause of AIP rejection. The MEMART must be drafted specifically for the licence category being sought, by a lawyer familiar with the CBN’s payment systems framework.
• Submitting an incomplete AIP package. Missing documents — a gap in director CVs, an absent technical partnership agreement, an incomplete risk management framework — result in the application being returned without review. The CBN does not process partial applications. Every required document must be present before submission.
• Underestimating the physical inspection. Many applicants invest heavily in their application documents but neglect the operational reality that the CBN’s inspection team will walk into. If the office is understaffed, the IT infrastructure does not match what was described, or the security standards are not demonstrably in place, the inspection will fail and the Final Licence will be delayed.
• Treating the licence as the end of the compliance journey. PSPs that obtain their licence and then deprioritise ongoing compliance — missing annual returns, failing to renew PCI-DSS certification, or allowing AML monitoring to become inactive — face enforcement actions that can be as severe as the penalties for unlicensed operation. Licence maintenance is an operational function, not a legal formality.