CBN Regulatory Sandbox Cohort 2 — Technical Guide for Nigerian Fintech Builders

The Central Bank of Nigeria (CBN) has launched the second cohort of its Regulatory Sandbox for unlicensed Nigerian fintech startups. This technical guide explains what this means for Nigerian fintech builders. The sandbox provides supervised testing with real users under CBN oversight, lasting 6-12 months, with a readiness assessment for full licence application as the outcome. Unlicensed startups with working MVPs are now eligible.

There are two tracks: VASP (Virtual Asset Service Providers) and NON_VASP. VASP is for stablecoin settlement, crypto on/off-ramps, crypto wallets, and digital asset payments. Compliance requirements include AML/CFT, blockchain analytics, Travel Rule, and cold storage custody. NON_VASP is for open banking, payment initiation, fraud detection, financial inclusion, and RegTech. Compliance requirements include NDPA compliance, API security, fraud controls, complaints handling.

To determine eligibility, startups must not have disqualifiers such as no working MVP, outstanding regulatory actions, or no meaningful innovation. Missing compliance elements include AML policy, sanctions screening, CDD, consumer protection, cybersecurity, incident response, data protection, and a named compliance officer. The compliance gap score is calculated based on the number of missing compliance elements.

The guide advises fintech builders not to add digital asset features just to qualify for the VASP track, as it adds significant technical complexity.