CBN Opens Virtual Asset Sandbox as Nigeria Tightens Crypto Oversight

Nigeria is moving from broad promises about regulating cryptocurrency to something much more practical: putting virtual asset businesses under closer regulatory observation before they are allowed to operate at scale.

The Central Bank of Nigeria is proceeding with a new regulatory sandbox for virtual assets, giving eligible firms a controlled environment in which to test products, services and blockchain based solutions under regulatory supervision. The move comes as the Federal Government attempts to close long standing gaps between the agencies responsible for financial, securities, intelligence and tax oversight of the crypto market.

For the compliance teams inside crypto businesses, the significance is greater than the word “sandbox” might suggest.

A sandbox is not a licence to operate without rules. It is a supervised testing environment. The CBN’s existing sandbox framework allows the regulator to admit eligible innovators, issue approval for entry, oversee their systems and operations, monitor compliance and determine whether a product can proceed towards wider deployment.

The virtual asset component adds another layer.

Nigeria’s crypto market has grown into a complicated regulatory space involving exchanges, wallets, payment platforms, custodians, stablecoins and other blockchain based services. Some activities may fall within securities regulation, while others touch payments, settlement, custody or financial crime controls.

The Federal Government has now attempted to bring some order to that overlap.

In July, President Bola Tinubu signed the Presidential Executive Order on Virtual Assets Coordination, 2026. The Order established a Virtual Asset Council chaired by the CBN, with the Nigeria Revenue Service and Securities and Exchange Commission serving as vice chairs. The Nigerian Financial Intelligence Unit and Office of the National Security Adviser are also represented.

The Council is intended to coordinate agencies rather than replace them. That distinction matters.

The Executive Order does not create a new crypto regulator or transfer the statutory powers of existing institutions. Instead, responsibility is linked to the nature of the activity. Securities related activities remain within the SEC’s remit, while payment, settlement, custody and related services involving non security virtual assets are to be registered with the CBN. Cases that do not fit neatly into one category can be referred to the Council.

The sandbox is therefore arriving as part of a much larger compliance architecture. It is also not Nigeria’s first experience with regulatory sandboxes.

The CBN issued its Framework for Regulatory Sandbox Operations in 2021, allowing licensed institutions, fintechs, innovators and researchers to test innovative products and services in a controlled environment. The Bank subsequently admitted its first cohort, after receiving more than 1,000 applications when the initial application window closed in February 2023.

What is different now is the policy environment around virtual assets.

The CBN has already begun moving towards more active AML, counter terrorism financing and counter proliferation financing supervision of selected virtual asset service providers. A supervisory pilot launched in March 2026 is designed to examine how VASPs identify and manage financial crime risks and how effectively their controls operate in practice.

That suggests the new sandbox should not be viewed simply as a place where developers can demonstrate that a blockchain product works.

The regulator is increasingly interested in whether the business around that technology can be controlled.

For a crypto exchange, that means customer identification cannot be an afterthought. Transaction monitoring cannot sit separately from the product. Suspicious transaction reporting, sanctions screening, record keeping and financial crime risk assessment have to be built into the operating model.

The same applies to wallets and custody services.

The technology may make it possible to transfer value almost instantly, but the compliance obligation does not disappear because the transaction is recorded on a blockchain.

Stablecoins present an even more interesting problem.

A token designed to maintain a stable value against a fiat currency can look like a payment instrument, an investment product or something in between, depending on how it is structured and used. Its issuer may therefore face questions around custody, reserves, redemption, settlement, consumer protection, liquidity and financial stability.

That is precisely where a sandbox can be useful to a regulator.

Instead of waiting for a new product to become widely used before discovering its risks, the CBN can observe the business model while it is still relatively contained.

But supervision inside a sandbox is not the same thing as regulatory approval for the wider market. That distinction will matter to participating firms.

Nigeria’s existing sandbox framework makes clear that participants are subject to conditions and oversight. The CBN can issue approval in principle for deployment only where the participant meets the Bank’s licensing requirements.

For companies, this creates an important compliance test.

A firm entering the sandbox cannot afford to treat regulatory requirements as paperwork to be completed after the product is built. The compliance architecture has to develop alongside the product.

That includes governance.

Who is responsible for compliance? Who owns the AML programme? Who approves changes to the product? How are customer complaints handled? What happens when suspicious activity is detected? How are customer assets protected? What happens if the technology fails? What happens if the firm exits the sandbox?

Those are not theoretical questions. The CBN’s sandbox framework requires participants leaving the programme to address issues including customer notification, redress where relevant, disposal of confidential and personal information and reporting back to the Bank after the test.

The regulatory exit is therefore part of the compliance design too.

There is also a wider data protection issue.

Virtual asset businesses can collect significant amounts of customer information. A compliance framework that requires more identity verification and transaction monitoring also creates more sensitive data that must be protected.

Nigeria’s regulators are increasingly interested in this intersection between financial crime controls, technology and data governance. The CBN’s broader payments supervision framework already includes information security requirements, while its 2026 fintech policy work has called for stronger standards around data protection, risk management and responsible innovation.

For crypto businesses, the message is becoming clearer.

Innovation is still welcome.

But the days when innovation was used as an argument against supervision are becoming harder to sustain.

The government’s new coordination framework explicitly identifies money laundering, terrorism financing, cybersecurity, data privacy, fraud and revenue risks as problems created by gaps in the previous regulatory structure.

The sandbox is intended to address some of those risks before products reach the wider market.

That is potentially good news for legitimate operators.

A regulated testing route gives compliant businesses something they have often lacked: a clearer way to engage the regulator before committing heavily to a product whose legal status may be uncertain.

It could also make life considerably harder for operators that have relied on regulatory ambiguity.

The important question now is how the system works in practice.

A sandbox can produce better regulation if the lessons from testing are converted into clear rules. It can also become another bureaucratic gate if admission, supervision and licensing are slow or unpredictable.

The CBN itself has recognised the importance of turning sandbox experience into formal regulatory playbooks and proportionate rules. Its recent fintech report describes a “test then codify” approach, under which lessons from innovation pilots should inform clearer regulatory requirements.

That may be the most important test of the new virtual asset sandbox.

Nigeria does not simply need more regulation around crypto. It needs regulation that can distinguish between a legitimate innovation, a manageable risk and a product that should not reach consumers at all.

The sandbox gives regulators a chance to make those distinctions before the market makes them for them.

For VASPs, stablecoin providers, wallet operators and custodians, the compliance message is straightforward.

The test is no longer only whether the technology works. The regulator increasingly wants to know whether the business can be trusted to operate it.