Four Registrations Come Before Any Licence

Businesses planning a licensed operation in Nigeria budget carefully for the sector licence and underestimate what has to happen first. Four federal registrations gate the application. They run in sequence rather than in parallel, and two of them create obligations that never close.

One: the company

Nothing starts without incorporation at the Corporate Affairs Commission under the Companies and Allied Matters Act 2020. A foreign investor cannot hold a Nigerian sector licence through an offshore vehicle; the licensee must be a Nigerian entity with a registered address. As LEADERSHIP has set out in its step-by-step guide to CAC registration, the portal has compressed this stage, and it is rarely the bottleneck.

Two: the owners

The Persons with Significant Control register, maintained by the Corporate Affairs Commission under the PSC Regulations 2022, is where applicants are most often caught out. Launched on 25 May 2023, it is Nigeria’s open central register of beneficial ownership, public and free to search.

Significant control means holding at least 5% of issued shares, interests or voting rights, directly or indirectly. It also means the right to appoint or remove a majority of directors, or the exercise of significant influence by any other route. Politically exposed persons must be disclosed, and so must their close associates.

The timing is tight and recurring. A person who becomes a controller has seven days to notify the company in writing; the company then has one month to notify the Commission. Disclosure is filed at incorporation, again at any change in control, and again with every annual return.

The sanctions are what make this a commercial rather than clerical matter. Non-disclosure attracts daily penalties against both the owner and each officer of the company, restriction of the owner’s interest, and imprisonment of up to two years. The company is shown as INACTIVE on the register, and the Commission will refuse post-registration applications and decline the Letter of Good Standing that most sector regulators ask for.

Three: the data

The Nigeria Data Protection Act 2023 requires data controllers and processors of major importance to register with the Nigeria Data Protection Commission. The Act leaves the threshold to the Commission to designate, and that line has moved more than once.

Registration is not the whole obligation. A controller of major importance must appoint a Data Protection Officer with genuine expertise in data protection law, not a nominated director with a spare title.

The reach here is wider than most applicants assume. In Emmanuel Harunna v. Nigeria Data Protection Commission (FHC/L/CS/1116/2024), the Federal High Court upheld the Commission’s power to require registration from point-of-sale agents — businesses that would not call themselves data companies.

The two registries are wired together: the ownership register withholds national identification numbers, full dates of birth and residential addresses, so that publishing ownership does not breach data protection rules.

Four: tax

A Taxpayer Identification Number from the Federal Inland Revenue Service, and VAT registration where turnover requires it, complete the federal set. State revenue services may add their own.

Then, the regulator

Only now does the sector application begin. Payment companies go to the Central Bank of Nigeria. Gaming operators go to a state authority, following the Supreme Court’s November 2024 ruling that lotteries and betting are matters for the states rather than the Federal Government.

Because these steps are serial, the binding constraint on a launch is usually time rather than capital. That is why entrants in software-heavy sectors tend to buy their operating platform instead of building one — a turnkey casino solution or a white-label payment stack removes months of development from a schedule already hostage to four registries.

Buying the platform does not shorten the queue. The licence attaches to the company, not the software, and whichever regulator issues it runs its fit-and-proper assessment against the ownership data already in the public register.

The obligations that do not close

Two of the four registrations are continuing rather than one-off, which catches established businesses more than new ones.

Ownership disclosure recurs at every annual return and on any change of control. A funding round that takes an investor past the 5% line is therefore a filing event with a seven-day and a one-month clock attached to it, and the company’s standing at the registry — including whether it can obtain a Letter of Good Standing — depends on meeting both.

Data protection is continuing too: the Data Protection Officer role does not lapse once registration is granted.

The sequence rewards businesses that settle ownership and data governance before they apply, because every regulator downstream reads both again. A change of control does not merely trigger a new filing; it resets a clock the sector regulator will check.