- within Finance and Banking, Criminal Law and Strategy topic(s)
The Central Bank of Nigeria (“CBN”) has opened applications for Cohort 2.0 of its Regulatory Sandbox Programme (the “Sandbox”). Applications are expected to run from 12th August to 31st August 2026. Cohort 2.0 introduces two dedicated tracks: (a) the Virtual Asset Service Provider (“VASP”) Track, which focuses on virtual assets, stablecoins, payments, settlements, custody, wallet and related financial infrastructure solutions; and (b) the Data-Enabled Financial Services (“Non-VASP”) Track which covers innovations such as Open Banking, account aggregation, payment initiation, fraud prevention and data-driven financial services.
The Sandbox provides a controlled environment in which eligible innovators can conduct live testing with customers or counterparties under CBN’s supervision. The Sandbox is intended not only to facilitate responsible innovation, but also to generate evidence that will assist the CBN in determining the appropriate long-term regulatory treatment of emerging products and business models.
Who can apply?
The Sandbox is not restricted to existing CBN licensees. Eligible applicants include CBN-regulated institutions, VASPs, fintech and technology companies, Nigerian incorporated entities and foreign entities proposing innovations capable of lawful deployment in Nigeria. The applicant must, however, demonstrate that its proposed innovation is sufficiently developed and ready for controlled live testing. This means that an applicant should have a functioning minimum viable product (“MVP”) or production-ready solution, appropriate technical infrastructure and defined testing objectives. The CBN also expects applicants to demonstrate adequate governance, financial, operational and technical capacity, together with appropriate risk- management, cybersecurity, data protection, consumer protection and AML/CFT/CPF arrangements.
The CBN’s Sandbox User Guide, issued by the CBN as a guide to applicants, further indicates that applicants can create a company and product profile and test the integration of relevant reporting APIs before submitting a Sandbox application.
Mode of Application
Applications are to be submitted through the CBN Regulatory Sandbox Portal. Applicants are required to register on the Portal, create an applicant profile and provide information on the applicant, proposed innovation, business model, testing plan, target market, expected outcomes and proposed post-Sandbox regulatory pathway. Applicants must also upload the required supporting documents, including corporate and governance information, product and technology documentation, risk and control frameworks, consumer protection, cybersecurity, data protection and AML/CFT/CPF documentation, testing plans and evidence of financial, technical and operational capacity. The completed application must be submitted through the Portal by the application deadline.
What can be tested under the VASP Track?
The VASP Track covers a broad range of virtual asset and stablecoin activities. These include fiat-backed stablecoin payment and settlement solutions, stablecoin issuance models, virtual asset payment solutions, digital wallets, custody solutions, token-based payment products, fiat on-ramp and off-ramp services, exchanges using stablecoins or payment tokens, and payment and settlement infrastructure. The CBN may also admit other related innovations that fall within the objectives of the Sandbox.
For solutions involving stablecoins, custody, wallets, token issuance or similar structures, applicants must provide the relevant governance, technology, reserve management, disclosure, consumer protection and risk-control information required by the application process.
What can be tested under the Non-VASP Track?
The Non-VASP Track is intended for innovations that use secure digital infrastructure and permission-based data sharing to improve access, efficiency, risk management, transparency and consumer outcomes within Nigeria’s financial system. Eligible innovations may include Open Banking-enabled data exchange, account aggregation, payment initiation services, fraud prevention and real-time risk analytics, credit decision-making and affordability assessment tools, credit monitoring and recovery tools, digital identity and customer onboarding solutions, compliance and regulatory technology, financial data infrastructure and other data- enabled financial services that fall within the scope and objectives of the Sandbox.
What does the CBN expect from Participants?
Applicants are expected to demonstrate that the principal legal, financial, operational, technological, cybersecurity and consumer risks associated with the proposed innovation have been identified and appropriately mitigated. This includes appropriate arrangements for customer identification and onboarding, customer consent and disclosures, complaints handling, customer exit rights, cybersecurity, data protection, operational resilience, fraud prevention, transaction monitoring, incident management, safeguarding of customer funds or assets where applicable, record keeping and regulatory reporting.
The Sandbox also permits reliance on third-party providers, provided that the relevant arrangements and associated risks are appropriately managed.
Effects of Admission into the Sandbox
Admission into the Sandbox does not constitute a licence, authorisation or approval to operate generally. Participants may conduct testing only within the parameters set out in the Sandbox Testing Agreement that each participant is required to execute and any additional directions issued by the CBN. These parameters may include limits on customers, transactions, exposure, geography or products, as well as specific reporting, safeguarding, consumer protection and risk-management requirements.
Participants must also promptly report to the CBN material incidents, including cybersecurity incidents, fraud, data breaches, operational failures, regulatory breaches and actual or potential consumer harm.
What Happens upon the Conclusion of Participation in the Sandbox
The Sandbox is intended to provide a pathway towards an appropriate long-term regulatory position for the CBN and the participants. Following testing, the CBN may allow the innovation to proceed under an existing regulatory framework, require an application for a licence or authorisation, require further supervised development, impose supervisory arrangements, coordinate with another competent regulatory authority, or require the activity to be discontinued. Successful completion of testing by the participants does not automatically confer a licence or approval to operate. Participants must also submit an exit and transition plan addressing their proposed long-term operating and regulatory model, outstanding risks and remediation measures, arrangements for customers and counterparties, and the orderly scaling, suspension, transfer or termination of the tested activity.
Conclusion
The introduction of Cohort 2.0 provides an important opportunity for businesses developing stablecoins, virtual assets and data-enabled financial solutions to engage directly with the CBN and test their models within a defined regulatory environment. For businesses whose products combine virtual asset elements with payment, technology or commercial services, it is important from the outset carry out a careful consideration of the scope of the activity to be tested, the entity participating in the Sandbox, the allocation of operational and compliance responsibilities, and the intended post-Sandbox regulatory model.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]