Africa Fintech Regulatory Atlas · Nigeria
Nigeria's AML law, data protection directive and CBN rules: the evidence fintechs must be able to show
Nigeria carries more overlapping fintech rules than most African markets. The Money Laundering (Prevention and Prohibition) Act 2022 (Gazette of 13 May 2022) repealed the 2011 Act (s. 29(1)) and reaches virtual asset service providers as well as banks (s. 30). The Central Bank of Nigeria adds its own regulations and a Guidance Note, the data protection commission adds a registration and annual audit regime, and a 24-hour clock appears in four different places.
This guide sets out who is in scope, what each rule requires, where two sources disagree, which details we could not confirm, and the evidence that shows each duty is met. Nigeria left the FATF list of jurisdictions under increased monitoring in October 2025 (FATF) and does not appear on the 19 June 2026 list (FATF).
Last reviewed: 15 October 2026 · Next review: 13 January 2027 · Written by Oluwafemi Ofobutu
Draft. This guide is a draft pending sign-off by a named reviewer. Treat the crosswalk and the evidence suggestions as working material until the sign-off is recorded here.
This guide is general information, not legal advice. The official text is the authority. Local legal interpretation should come from qualified counsel in Nigeria.
Verification status, 15 October 2026: all 102 statements in our claims ledger were checked against the source text before publication. 37 are re-checked automatically on every build; the other 65 cite sources our build servers cannot check automatically (sites that refuse automated requests, or scanned PDFs with no text layer), so the StackWeaver compliance research team re-checks those by hand. Where a rule sits in a document we could not read in full, or a source is a press report rather than the regulator's own text, the guide says so instead of guessing.
Executive summary
Sourced
- Nigeria is off the FATF list, and that changes little for you. The FATF welcomed Nigeria's progress and removed it from increased monitoring in October 2025 (FATF). Sponsor banks and the CBN still expect the full programme.
- A suspicious transaction goes to the NFIU immediately, with a written report within 24 hours. The Act requires an immediate report (s. 7(1)) and a written report within 24 hours (s. 7(2)). The CBN Guidance Note repeats the 24 hours and sets no monetary threshold (para. 5.2; para. 5.2). The NFIU adds that alerts should be examined within 72 hours before the filing clock starts (NFIU guidelines).
- One incident can start three clocks. A personal data breach goes to the data protection commission within 72 hours (NDPA s. 40(2)). A cyber-incident at a bank or payment service provider goes to the CBN within 24 hours (CBN framework). Cyber threats go to ngCERT within 72 hours (Cybercrimes Act s. 21).
- Fintechs are named as Ultra-High Level data controllers. Schedule 7 of the directive lists payment gateway service providers and fintechs in the Ultra-High Level class (Sched. 7), with a registration amount of N250,000 (Sched. 7) and annual audit returns due by 31 March (Art. 7(c)).
- The penalties for data protection failures now scale with revenue. For a controller of major importance the maximum is the greater of N10,000,000 and 2% of annual gross revenue (s. 48(4)). The commission has already used its powers: it fined MultiChoice Nigeria ₦766,242,500 (NAN report).
- Two cross-border reporting periods conflict. The Act says transfers above US$10,000 are reported within one day (s. 3(1)). The CBN Regulations say within 7 days (Reg. 40(2)). We would work to the stricter period.
- Automated monitoring is becoming mandatory on a timetable. Deposit money banks have 18 months and other institutions 24 months (TheCable; TheCable), with roadmaps due within three months (TheCable).
- Lending apps and virtual assets have their own new rules. The FCCPC's 2025 consumer lending regulations carry penalties of up to N100,000,000 or 1% of turnover (Reg. 27). The SEC reaches anyone who targets Nigerian investors with digital assets (SEC rules).
Who is in scope
Sourced, with our reading marked
The Act's duties fall on financial institutions and designated non-financial businesses and professions, and its definition of a financial institution includes virtual asset service providers (s. 30). The CBN Regulations apply to all financial institutions under the CBN's regulatory purview (Reg. 3), and the CBN directed institutions in June 2022 to note and immediately comply (CBN circular).
StackWeaver view · We would treat a licensed payment service provider, mobile money operator, switch, payment terminal service provider or remitter as inside both the Act and the CBN Regulations. Write the scoping decision against your licence category and have local counsel confirm it.
The Nigeria Data Protection Act applies to processing whether or not it is automated (s. 2(1)). It also reaches a controller or processor outside Nigeria that processes the personal data of a data subject in Nigeria (s. 2(2)(c)). A controller or processor of major importance is defined by the number of data subjects the commission prescribes or a class it designates (s. 65); the directive treats an organisation that keeps a filing system and processes personal data of more than 200 data subjects in six months as of major importance (Sched. 7).
Digital lenders sit under the FCCPC's regulations, which are made under the Federal Competition and Consumer Protection Act (FCCPC). Digital asset firms sit under the SEC (ISA 2025).
The regulators
Sourced
The Central Bank of Nigeria. The CBN issues the AML/CFT/CPF Regulations (Reg. 3), a Guidance Note (Guidance Note), the targeted financial sanctions guidelines (TFS guidelines), the cybersecurity framework (framework), the BVN rules (BVN addendum) and the payment licence categories (9 December 2020 circular). It sanctions breaches under its 2018 Administrative Sanctions Regulations (para. 9.3).
The Nigerian Financial Intelligence Unit. The NFIU is the "Unit" that receives suspicious transaction reports under the Act (s. 7(1)). It published its own reporting guidelines on 13 December 2024 (NFIU guidelines).
The Nigeria Data Protection Commission. The commission registers controllers and processors of major importance (s. 44(1)), receives breach notices (s. 40(2)) and hears complaints (s. 46(1)). Its directive of March 2025 sets the audit return and fee regime (GAID).
The FCCPC and the SEC. The FCCPC administers the consumer lending regulations (FCCPC) and the SEC the digital asset rules (SEC rules).
Obligations and the evidence that demonstrates them
Sourced obligations · evidence column is StackWeaver view
The table lists each obligation, its legal source, who it applies to, the evidence that shows it is met, and its deadline. The legal-source column links to the text we read; the evidence column is our practical suggestion. Where a source is a press report or a scanned copy, the claims ledger says so.
| Obligation | Legal source | Applies to | Evidence | Deadline |
|---|---|---|---|---|
| Report a suspicious transaction to the NFIU immediately, with a written report within 24 hours | Act s. 7(1)-(2); Guidance Note para. 5.2 | Financial institutions | STR register with timestamps; written report; NFIU acknowledgement | Immediately; written report within 24 hours |
| Examine and screen an alert before filing, and keep a written reason when it is closed as not suspicious | NFIU guidelines, reporting period | Reporting entities | Alert investigation file; closure note | Examination within 72 hours |
| Report cash transactions in excess of the thresholds — ₦5,000,000 for an individual, ₦10,000,000 for a body corporate | Guidance Note para. 5.1; Act s. 11(1) | Financial institutions | Cash transaction report log | Within 7 days of the transaction |
| Report cross-border transfers above US$10,000 | Act s. 3(1); Reg. 40(2) | Persons and money service businesses | Transfer report log; sender and receiver details | One day under the Act; 7 days under the Regulations |
| Undertake customer due diligence in the cases the Act lists | Act s. 4(2) | Financial institutions | KYC files; risk ratings; verification logs | At onboarding and on triggers |
| Obtain senior management approval before a relationship with a politically exposed person | Reg. 29(4); Guidance Note para. 4.2.2 | Financial institutions | PEP register; approval record | Before onboarding |
| Screen the entire customer base daily and on every list update; freeze within 24 hours; report to the Sanctions Committee within 24 hours | TFS guidelines | Financial institutions | Daily screening log; freeze record; committee report | Daily; 24 hours |
| Assess the money laundering and terrorism financing risk of new products before launch | Act s. 13(1); Reg. 31(2) | Financial institutions | Launch checklist with a risk step | Before launch |
| Designate a Chief Compliance Officer at management level | Reg. 13; Act s. 10; Guidance Note para. 2.8 | Financial institutions | Appointment letter; reporting line | In place |
| Train employees and test the programme independently, with an internal audit unit | Act s. 10; Reg. 15(1), 41(1) | Financial institutions | Training records; independent test report; audit plan | Regular |
| Keep transaction and due diligence records for at least five years | Act s. 8(1); Reg. 35(1); Guidance Note para. 9.2 | Financial institutions | Retention schedule; archive access test | Five years after completion or termination |
| Report a cyber-incident, successful or not, to the CBN | CBN cybersecurity framework para. 5 | Deposit money banks and payment service providers | Incident report in the CBN format; timeline | 24 hours after detection |
| Appoint a Chief Information Security Officer and run vulnerability assessments | CBN framework paras. 2.4.5, 3.7 | Deposit money banks and payment service providers | Appointment record; scan reports | In place; continuous |
| Register as a controller or processor of major importance and notify changes | NDPA s. 44(1), (3) | Controllers and processors of major importance | Registration certificate; change notices | Six months; changes within 60 days |
| File compliance audit returns and conduct the audit | GAID Arts. 7, 10 | Ultra-High and Extra-High Level | Audit report; filing receipt | 31 March each year; first audit within 15 months |
| Designate a Data Protection Officer and give the commission the contact details | NDPA s. 32(1); GAID Art. 11(2) | Controllers of major importance | Designation letter; published contact | In place |
| Rely on a lawful basis and record consent where consent is the basis | NDPA s. 25(1)(a) | Controllers | Record of processing; consent log | Before processing |
| Run a data privacy impact assessment before high-risk processing; bind processors by contract | NDPA ss. 28(1), 29(1) | Controllers | Assessment; processor agreements | Before processing |
| Notify the commission of a breach, and affected people where risk is high | NDPA s. 40(2)-(3) | Controllers | Breach register; notice drafts; timeline | 72 hours; immediately for data subjects |
| Transfer personal data abroad only on a lawful ground | NDPA s. 43(1) | Controllers and processors | Transfer register; consent or contract basis | Before transfer |
| Digital lenders: comply with the Data Protection Act and keep apps away from call logs, contacts and photos | FCCPC Reg. 21(a); Schedule B | Digital lenders | App permission review; registration file | At registration and ongoing |
Four of these deserve more detail because they catch teams that arrive from other markets. First, the suspicious transaction clock has three layers. The Act says report immediately, with a written report within 24 hours (s. 7(1); s. 7(2)). The NFIU says the 24 hours starts once the transaction is termed suspicious, after an examination of not more than 72 hours (NFIU guidelines). Alerts closed as not suspicious need a written reason on file (NFIU guidelines).
Second, cross-border transfers have two periods. The Act says one day (s. 3(1)) and the CBN Regulations say 7 days (Reg. 40(2)). We could not find a source that reconciles them, so the safe course is to report within the shorter period and ask your CBN relationship manager which one the examiners apply.
Third, your data protection class is probably the top one. Schedule 7 lists payment gateway service providers and fintechs as Ultra-High Level (Sched. 7). That class pays a registration amount of N250,000 (Sched. 7), and its annual audit return fee runs from N500,000 to N1,000,000 depending on the number of data subjects (Sched. 10). Filing late adds a penalty of 50% of the fee (Art. 10(9)).
Fourth, payment licences carry capital floors that depend on the category. The CBN circular of 9 December 2020 sets N2 Billion for switching and processing (PwC copy) and for mobile money operators (PwC copy), N250 Million for a payment service solution operator (PwC copy), N100 Million for a payment terminal service provider (PwC copy) and for a payment solution service provider (PwC copy), and N50 Million for a super agent (PwC copy). An applicant also needs a no objection letter from the Payment System Management Department (PwC copy). We could not confirm later changes, so check the CBN's current circular.
Timeline of key dates
Sourced
The CBN issues its circular categorising payment service providers · source
The Money Laundering (Prevention and Prohibition) Act 2022 is published in the Official Gazette · source
The CBN directs institutions to comply immediately with its AML/CFT/CPF Regulations · source
The CBN issues its targeted financial sanctions guidelines on proliferation financing · source
The NFIU issues its suspicious transaction reporting guidelines · source
The data protection commission issues the General Application and Implementation Directive · source
The commission fines MultiChoice Nigeria ₦766,242,500 · source
The FATF removes Nigeria from increased monitoring · source
The CBN circular on baseline standards for automated AML solutions · source
The BVN addendum provisions take effect · source
The FATF list of 19 June 2026 does not include Nigeria · source
Annual compliance audit returns are due for Ultra-High and Extra-High Level controllers · source
By our reading the 18-month and 24-month baseline deadlines fall around September 2027 and March 2028, counting from the circular's date. Confirm the start date and any extension with the CBN, because we could only read a press report of the circular.
Enforcement and penalties
Sourced penalty provisions, with our reading marked
Penalties come from several regimes, and they stack:
- Failing to report a suspicious transaction carries a fine of N1,000,000 for each day the offence continues (s. 7(10)). Warning the subject of a report carries a minimum jail term of 2 years and a fine of at least N10,000,000 (NFIU guidelines; s. 19(2)), and the fine for a body corporate is N25,000,000 (s. 19(2)(b)).
- Money laundering itself carries imprisonment of not less than four years and not more than fourteen years (s. 18(3)). Regulators can also impose administrative sanctions under the CBN's 2018 regulations (para. 9.3).
- For data protection, the commission can order a remedy, compensation or a penalty up to the greater of N10,000,000 and 2% of annual gross revenue for a controller of major importance (s. 48(4)), or N2,000,000 and 2% otherwise (s. 48(5)). A data subject can also sue for damages (s. 51).
- The commission has acted. It found that MultiChoice made an illegal cross-border transfer (NAN report) and described the processing as patently intrusive, unfair, unnecessary and disproportionate (NAN report).
- Digital lenders face an administrative penalty of up to N100,000,000 or 1% of turnover for a body corporate (Reg. 27), and up to N50,000,000 for a natural person (Reg. 27).
StackWeaver view · The data protection exposure is the one most fintechs underestimate, because the penalty scales with revenue and the commission has shown it will act on cross-border transfers. The commercial risk is as large: a sponsor bank that asks for your audit return filing receipt, your breach register and your STR log should find all three ready.
A practical 90-day plan
StackWeaver view
Start with the items that need a decision or a regulator's answer, because they take longest.
Days 1–14: scope, register and ask
Write the scoping memo: licence category, reporting entity status, controller or processor, data protection class. Confirm the commission registration. Ask the CBN about the cross-border reporting period.
Days 15–45: close the reporting and breach gaps
Build one incident runbook with three clocks: the commission, the CBN and ngCERT. Document the alert-to-report path, including the 72-hour examination. Set daily sanctions screening.
Days 46–75: governance and monitoring
Confirm the Chief Compliance Officer and the Data Protection Officer. Run the risk and privacy impact assessments. Write the baseline standards roadmap.
Days 76–90: prove it
Test the programme independently, run the training, and assemble the evidence pack: registration, audit return, STR log, breach register and screening log.
Common mistakes
StackWeaver view
- Setting a value threshold on suspicious transaction reports. The Guidance Note says there is no monetary threshold for suspicious transactions (para. 5.2).
- Starting the 24 hours late and writing nothing down. Alerts closed as not suspicious need a written reason (NFIU guidelines), and the examination has its own 72-hour limit.
- Moving data abroad on a contract alone. Transfers need one of the grounds the Act lists (s. 43(1)), and the commission has fined an illegal transfer (NAN report).
Nigeria evidence checklist
StackWeaver view, built on the sourced obligations above
| Area | Task | Owner | Evidence to keep |
|---|---|---|---|
| Scope | Write the scoping memo: licence category, reporting entity status, controller or processor, data protection class. | Legal / compliance | Memo citing your licence |
| Governance | Designate the Chief Compliance Officer at management level and keep the appointment record. | Management | Appointment letter |
| Governance | Designate the Data Protection Officer and communicate the contact details to the commission. | Management | Designation letter; commission filing |
| Risk | Complete and date the ML/TF risk assessment, and add a risk step to the new-product checklist. | Compliance | Assessment; launch checklist |
| Customers | Document due diligence, PEP approval and BVN use for each customer type. | Operations | KYC procedure; sample files |
| Sanctions | Run daily screening of the full customer base and log every freeze and report. | Compliance | Daily screening log |
| Monitoring | Document monitoring rules, review them on a schedule, and keep a written reason for every closed alert. | Compliance | Rule register; closure notes |
| Reporting | Keep the STR, cash and cross-border report logs with timestamps and acknowledgements. | Compliance | Report logs |
| Registration | Keep the commission registration current and file the annual audit return by 31 March. | DPO | Registration; filing receipt |
| Incidents | Maintain one incident runbook covering the commission, the CBN and ngCERT clocks. | Security | Runbook; breach register |
Control crosswalk: Nigeria obligations to SOC 2 and ISO 27001
Draft mapping, pending named reviewer sign-off. SWC numbers refer to StackWeaver's common controls; SOC 2 references are Trust Services Criteria and ISO references are ISO/IEC 27001:2022 Annex A controls. Use it to reuse evidence, not as a statement that one framework satisfies another.
| Nigeria obligation | StackWeaver control | SOC 2 | ISO 27001:2022 |
|---|---|---|---|
| Risk assessment (Act s. 13(1); Reg. 31(2)) | SWC-04 Risk assessment | CC3.1, CC3.4 | A.5.7, A.8.25 |
| Chief Compliance Officer (Reg. 13; Act s. 10) | SWC-02 Named accountable roles; SWC-03 Board and management oversight | CC1.3, CC2.1 | A.5.2, A.5.4 |
| Customer due diligence (Act s. 4) | SWC-30 Customer due diligence and risk rating | CC3.2 | A.5.19 |
| PEP approval (Reg. 29(4)) | SWC-31 Enhanced due diligence and PEPs | CC3.2 | A.5.19 |
| Sanctions screening (TFS guidelines) | SWC-32 Sanctions and watchlist screening | CC3.2 | A.5.19 |
| Transaction monitoring (NFIU guidelines) | SWC-33 Transaction monitoring | CC7.2 | A.8.16 |
| Suspicious and cash reports (Act ss. 7, 11) | SWC-34 Suspicious and threshold transaction reporting | CC7.2, CC7.3 | A.5.24, A.5.25 |
| Record keeping (Act s. 8; Reg. 35) | SWC-35 Record keeping | CC5.3 | A.5.33 |
| Independent testing (Reg. 15(1)) | SWC-36 Independent testing of the compliance programme | CC4.1 | A.5.35 |
| Training (Act s. 10; Reg. 41) | SWC-05 Training and awareness | CC1.4 | A.6.3 |
| Registration and annual returns (NDPA s. 44; GAID) | SWC-29 Regulatory registration and filings | CC2.3 | A.5.31 |
| GAID compliance audit (GAID Art. 10) | SWC-36 Independent testing of the compliance programme | CC4.1 | A.5.35 |
| Lawful basis and consent (NDPA s. 25) | SWC-23 Lawful basis and consent | P2.1, P3.1 | A.5.34 |
| Impact assessment (NDPA s. 28) | SWC-27 Data protection impact assessment | CC3.2 | A.5.34 |
| Breach notification (NDPA s. 40; CBN framework) | SWC-22 Incident response and breach notification | CC7.3, CC7.4 | A.5.24, A.5.26 |
| Cross-border transfers (NDPA s. 43) | SWC-28 Cross-border transfer safeguards | CC9.2 | A.5.14, A.5.23 |
| Processor agreements (NDPA s. 29) | SWC-07 Third-party and processor management | CC9.2 | A.5.19, A.5.20 |
| Cross-border transfer reporting (Act s. 3(1); Reg. 40(2)) | SWC-34 Suspicious and threshold transaction reporting | CC7.2, CC7.3 | A.5.24, A.5.25 |
| Cyber-incident reporting to CBN (CBN cybersecurity framework para. 5) | SWC-22 Incident response and breach notification | CC7.3, CC7.4 | A.5.24, A.5.26 |
| CISO appointment (CBN cybersecurity framework para. 2.4.5) | SWC-02 Named accountable roles; SWC-03 Board and management oversight | CC1.3, CC2.1 | A.5.2, A.5.4 |
| Vulnerability assessments (CBN cybersecurity framework para. 3.7) | SWC-14 Vulnerability management | CC4.1 | A.8.8 |
| Data Protection Officer designation (NDPA s. 32(1); GAID Art. 11(2)) | SWC-02 Named accountable roles | CC1.3 | A.5.2 |
A SOC 2 or ISO 27001 programme covers much of the security, logging and incident evidence, but neither covers suspicious transaction reporting, sanctions freezes, or registration with the data protection commission. Those need AML-specific and registration evidence. Our Ghana guide and Kenya guide cover two other African markets.
Frequently asked questions
Is Nigeria on the FATF grey list?
No. The FATF removed Nigeria from increased monitoring in October 2025, and Nigeria does not appear on the list of 19 June 2026. That does not remove your obligations: the 2022 Act, the CBN Regulations and the data protection regime all apply in full, and sponsor banks still ask for your evidence.
How fast must a suspicious transaction be reported?
The Act requires an immediate report to the NFIU and a written report within 24 hours of the transaction. The CBN Guidance Note repeats 24 hours. The NFIU guidelines add that the examination of an alert before filing should take not later than 72 hours, so record when suspicion was formed.
Is there a minimum value for reporting a suspicious transaction?
No. The CBN Guidance Note says no monetary threshold applies to suspicious transactions, so a small amount can still require a report. Cash transaction reports are different: they apply at N5,000,000 for individuals and N10,000,000 for corporate bodies, and go to the NFIU within 7 days.
What breach notices does a fintech have to send?
Three can apply to one incident. A personal data breach goes to the data protection commission within 72 hours. A cyber-incident at a bank or payment service provider goes to the CBN within 24 hours. Cyber threats go to ngCERT immediately and within 72 hours. Run one runbook covering all three.
Does my fintech have to register with the data protection commission?
Very likely. The directive lists payment gateway service providers and fintechs as Ultra-High Level controllers, with a registration amount of N250,000. It also treats a firm that processes personal data of more than 200 data subjects in six months as of major importance. Confirm your class with counsel.
When are the annual audit returns due?
Ultra-High and Extra-High Level controllers file their compliance audit returns by 31 March each year. A controller established after 12 June 2023 files its first return not later than 15 months after establishment. Filing late adds a penalty of 50% of the filing fee, so diarise the date.
What is the maximum data protection fine?
For a controller or processor of major importance, the maximum penalty is the greater of N10,000,000 and 2% of annual gross revenue in the preceding financial year. For others it is the greater of N2,000,000 and 2%. The commission has already fined MultiChoice Nigeria ₦766,242,500 for an illegal cross-border transfer.
What are the new baseline standards for automated AML systems?
A CBN circular of 10 March 2026 requires banks, mobile money operators, international money transfer operators and payment service providers to deploy automated AML solutions. Deposit money banks have 18 months and other institutions 24 months, with roadmaps due within three months. We read a press report, not the CBN document.
How StackWeaver helps
StackWeaver gives your compliance team and compliance officer one workspace to request, collect and review the evidence each obligation above needs, with every file fingerprinted and every review decision recorded. Reviewed evidence can be exported as an Evidence Package that your counsel, an auditor or a partner firm can check offline. We are remote-first; we work with local counsel and advisory partners, and our Evidence Readiness Assessment is a readiness review, not an audit, and the starting point if you want help building the evidence pack.
Next steps
Advisory, audit or legal firm in Nigeria? Partner with us
Firms that advise fintechs in Nigeria can run client evidence in StackWeaver workspaces and keep their own advice and audit work. Tell us about your practice and we will be in touch.
Partner with usSources and method
We cite the Money Laundering (Prevention and Prohibition) Act 2022 as printed in the Official Gazette; the NFIU's suspicious transaction guidelines; the Nigeria Data Protection Act 2023 and the Commission's directive; the CBN's Guidance Note, sanctions guidelines and 2018 cybersecurity framework; the FCCPC's lending regulations; and the SEC's 2025 Act and digital asset rules. The CBN's 2022 Regulations are a scanned image with no text layer, so those entries are marked for manual review. The FATF lists are cited through the Internet Archive, because the FATF site blocks automated access.
Four items rest on secondary sources: the baseline standards (a press report), the BVN addendum (an alert service copy), the payment licence capital figures (an advisory firm's copy of the 2020 circular) and the Cybercrimes Act duty (a law firm's note). We left out rules we could not read in full, including the CBN's 2024 cybersecurity framework in final form, open banking, and any draft fintech licensing bill. Check them with local counsel.
Every statement of law on this page is recorded in a public claims ledger with its source, section, retrieval date and the exact supporting words, and our build checks each source before publication. Facts are labelled “Sourced”; opinions and recommendations are labelled “StackWeaver view”, as our editorial policyexplains. AI tools helped research and draft this guide; a named person at StackWeaver is accountable for it, and every legal statement was checked against the source text. It has not yet been signed off by a named reviewer.
Spotted an error? Email [email protected]. Preparing evidence for a regulator or a bank? See the Evidence Readiness Assessment. More countries are in the Africa Fintech Regulatory Atlas. Neighbouring guides: Ghana, Kenya, South Africa.