Nigeria NG

Nigeria's Bureau de Change sector became the focal point of a rare convergence between unilateral and domestic sanctions architecture this cycle. On 22 June 2026 the US Treasury's Office of Foreign Assets Control designated a Lagos-based Bureau de Change operator, three allied firms, three individuals and six entities for financing ISWAP and ISIS-linked terrorist networks. Four days earlier, on 18 June 2026, Nigeria's own Sanctions Committee, NIGSAC, had designated six individuals and three BDC companies for financing the same ISWAP threat, following an earlier April 2026 list naming forty-eight individuals and twelve entities linked to ISWAP, Ansaru and IPOB.

The near-simultaneous timing and overlapping subject matter of these two actions is analytically more significant than either designation examined alone. Sanctions-architecture analysis typically emphasises points of divergence between unilateral US listings and the autonomous or domestic listing regimes of other jurisdictions; here, the opposite pattern holds. OFAC and NIGSAC appear to be targeting the same underlying BDC-centred terrorism-financing network, and the evidence supports reading this convergence as indicative of a durable, structural vulnerability in Nigeria's Bureau de Change sector rather than an isolated incident.

This finding sits alongside, and is reinforced by, a separate enabler-layer disclosure this cycle in which Nigerian banks, fintechs and microfinance institutions were found to have failed know-your-customer and customer-due-diligence controls in a scheme enabling roughly 18.1 billion naira in laundering, a portion of which was converted to crypto assets. Read together, these two findings describe a Nigerian financial system in which both licensed Bureau de Change operators and mainstream regulated institutions have each, independently, been identified as conduits for illicit value movement within the same reporting period.

No divergence between US and Nigerian sanctions treatment of this specific corridor was identified in the evidence reaching this cycle. The architecture-over-incident reading is that Nigeria's BDC sector, rather than any single sanctioned entity, is the structural node requiring sustained monitoring.

Outlook

The immediate question for the coming cycle is whether the convergence between OFAC and NIGSAC designations extends to further BDC entities beyond those already named, and whether Nigerian authorities pursue asset-freezing or prosecutorial follow-through domestically to match the US unilateral action. This is an illustrative orientation for monitoring purposes, not a prediction of specific regulatory action.

Nigeria's own beneficial-ownership regime reached a milestone this cycle distinct from, though structurally comparable to, the European Union's parallel transparency architecture. The Corporate Affairs Commission announced full operationalisation of Nigeria's public Beneficial Ownership Register in February 2026, built on the Companies and Allied Matters Act 2020's five-percent persons-with-significant-control disclosure threshold, and positioned by the Commission as supporting know-your-customer processes, financial-crime prevention and cross-border due diligence. This is a genuine structural improvement to Nigeria's corporate-transparency baseline, though the accuracy and completeness of the self-reported ownership data entered into the register has not been independently verified in the evidence available this cycle, and no primary Corporate Affairs Commission publication was retrieved to corroborate the trade-press reporting this finding rests on.

As standing structural context against which this and every other jurisdiction's beneficial-ownership signal should be read: the European Union's AML Package comprises three distinct instruments rather than a single directive, the directly-applicable AML Regulation (Regulation (EU) 2024/1624), the sixth AML Directive requiring per-Member-State transposition, and the AMLA Regulation (Regulation (EU) 2024/1620) establishing the Anti-Money Laundering Authority. The AMLA's direct- and indirect-supervision perimeter is progressively shifting AML supervision of cross-border obliged entities from purely national authorities toward a hybrid EU-level regime. Nigeria sits entirely outside this perimeter; the AMLA architecture is not the primary subject matter for Nigeria's own transparency reforms, but it is the durable global backdrop against which Nigeria's CAMA-based, nationally-administered register should be understood as a parallel and independent transparency track rather than a converging one. No AMLA horizon anchor specific to Nigeria was present in this cycle's research, and this paragraph is accordingly drawn from standing architectural context rather than a cycle-specific Nigeria-EU interaction.

Outlook

The material open question is data quality: a self-reported register without independent verification carries meaningfully different assurance value than a register subject to audit or cross-checking against tax or banking records, and no evidence this cycle addressed how the Corporate Affairs Commission intends to verify submitted beneficial-ownership data going forward.

The enabler-layer finding this cycle sits inside Nigeria's own regulated financial sector rather than in an offshore or professional-services facilitator network. Nigeria's Economic and Financial Crimes Commission disclosed on 22 January 2026 that a new-generation bank, six fintech companies and several microfinance banks failed to meet know-your-customer and customer-due-diligence requirements, a control failure that enabled an estimated 18.1 billion naira to be laundered, with a material portion of the proceeds converted into crypto assets.

Read through the enabler-jurisdiction lens, this finding is significant less for its monetary quantum than for what it identifies structurally: a cluster of regulated, licensed institutions, spanning traditional banking, fintech and microfinance, sharing a common control-environment weakness at the customer-onboarding and ongoing-due-diligence stage. This is the domestic analogue of the professional-facilitator or enabler-jurisdiction pattern more commonly discussed in a cross-border context; here the enabling function is performed by regulated Nigerian financial institutions rather than by foreign company-formation agents or trust-and-corporate-service providers. The crypto-conversion element of the disclosed scheme also connects this finding to Nigeria's broader digital-asset governance picture.

No indication of enforcement action, penalty, or remediation timeline against the named institution types was present in the evidence reaching this cycle; the EFCC disclosure describes the control failure itself rather than its regulatory consequence.

Outlook

Whether the Central Bank of Nigeria's broader 2026 payments and fintech rulebook, including its mandatory real-time transaction-monitoring requirement, directly addresses the specific KYC and CDD lapses described in the EFCC disclosure is the key connective question for the coming cycle; the evidence reaching this cycle does not establish that link explicitly.

Two developments this cycle bear on Nigeria's conflict-finance and extractive-industry integrity picture, at markedly different scales. The smaller-scale but more legally concrete development is NIGSAC's 18 June 2026 designation of six individuals and three Bureau de Change companies for financing ISWAP, following an earlier April 2026 designation of forty-eight individuals and twelve entities linked to ISWAP, Ansaru and IPOB. This domestic terrorism-finance designation activity is addressed in full in this cycle's sanctions-architecture coverage; from a conflict-finance perspective, it confirms that non-state armed groups operating in Nigeria continue to draw on domestic financial-sector channels, with the Bureau de Change sector recurring as the identified conduit.

The far larger-scale development is the Nigerian Senate's ad-hoc Committee on Crude Oil Theft interim report, which found between 200 and 300 billion dollars in unaccounted crude-oil proceeds across the 2015 to 2023 period, including an 81 billion dollar discrepancy between the Nigerian National Petroleum Corporation and the Central Bank of Nigeria specifically for 2016 to 2017. The committee's findings are explicitly tied to suspended Petroleum Industry Act oversight functions as an enabling factor, alongside Operation Delta Safe's destruction of 101 illegal refineries in the first quarter of 2026. The scale of this figure, measured in the hundreds of billions of dollars against a designation action measured in a handful of entities, illustrates the core analytical imbalance this domain exists to correct: enforcement volume and reporting attention concentrate on discrete, nameable terrorism-finance designations, while a conflict-finance and extractive-integrity gap several orders of magnitude larger receives comparatively less operational follow-through in the evidence available.

No indication of asset recovery, prosecutorial referral, or structural Petroleum Industry Act reform addressing the oversight gap was present in this cycle's research; the underlying forensic-audit document was not independently retrieved, with reporting resting on secondary coverage of the committee's hearings.

Outlook

Whether the Senate committee's interim findings translate into a published forensic-audit report, a restoration of Petroleum Industry Act oversight functions, or referral for prosecution or asset recovery is the central question for the coming cycle.

Nigeria's crypto-asset governance framework moved onto a statutory footing this cycle. The Investments and Securities Act 2025, signed 29 March 2025 and gazetted 2 May 2025, repeals the Investments and Securities Act 2007 and grants the Securities and Exchange Commission binding statutory authority to register and regulate virtual-asset service providers, replacing the prior approach conducted on an ad hoc basis through Central Bank of Nigeria circulars. The Commission's Accelerated Regulatory Incubation Program admitted further virtual-asset service providers, including named platforms, in July 2026, indicating the new licensing pathway is operationally active rather than purely legislative.

This is a structural improvement to Nigeria's crypto-integrity framework in the sense that a binding statute now sits behind VASP oversight where previously only administrative circulars did; however, no primary Securities and Exchange Commission or Investments and Securities Act 2025 gazette text was independently retrieved this cycle, and the evidence base rests on vendor and trade-guide reporting rather than the primary instrument itself. The crypto-conversion element identified separately in this cycle's enabler-layer laundering disclosure, in which a portion of an 18.1 billion naira laundering scheme was converted into crypto assets, underscores why a binding VASP licensing framework, rather than an informal circular regime, is analytically significant.

Outlook

Whether the Securities and Exchange Commission uses its new Investments and Securities Act 2025 authority to impose AML/CFT-specific obligations directly on registered virtual-asset service providers, and whether that framework is tested against the kind of crypto-conversion laundering pattern disclosed elsewhere this cycle, are the key developments to monitor.

The Central Bank of Nigeria issued the most significant compliance-technology and payments market-structure intervention in Nigeria's regulatory history between March and June 2026. The package includes market-concentration caps preventing any institution exceeding twenty-five percent consumer-issuing market share from simultaneously holding more than fifteen percent merchant-acquiring share, with divestiture or restructuring required by 31 December 2026; revised cash-withdrawal caps; and, most directly relevant to compliance technology, a mandatory real-time transaction-monitoring requirement carrying potential fintech liability for authorised-push-payment fraud. The hard 31 December 2026 divestiture deadline is a concrete near-term test of both industry compliance capacity and Central Bank enforcement capacity.

Running in parallel, the Nigeria Data Protection Commission entered a materially more active enforcement phase in 2026, collecting approximately 7.2 billion naira and concluding more than 240 investigations with eleven major enforcement actions in its third 2026 enforcement phase, including an April 2026 investigation into an alleged data breach at Remita Payment Services and Sterling Bank. Although data-protection enforcement sits adjacent to rather than inside the AML/CTF compliance-technology perimeter proper, the near-simultaneous emergence of a mandatory real-time transaction-monitoring regime and an actively enforcing data-protection authority together describe a Nigerian compliance-technology environment moving, in this cycle, from largely advisory posture toward binding technical and governance obligations.

No evidence reaching this cycle described the specific technical standards, vendor ecosystem, or supervisory-technology tools the Central Bank's real-time monitoring mandate will require regulated institutions to adopt; this remains an open implementation question.

Outlook

The 31 December 2026 divestiture deadline and the phased rollout of mandatory real-time transaction monitoring are the two concrete dates to track into the next cycle, alongside whether the Nigeria Data Protection Commission's Remita/Sterling Bank investigation concludes with a public enforcement outcome.