Nigeria's virtual-asset sandbox is a test, not a licence

TechCabal reported on 12 August 2026 that the Central Bank of Nigeria had opened its regulatory sandbox to virtual-asset service providers. The development matters because it creates a supervised route for testing. It should not be rewritten as “the central bank licensed crypto firms.”

A sandbox and a licence answer different questions. The sandbox asks whether a defined product can operate with real or simulated users under limits while the regulator observes. A licence authorises a regulated activity under an established framework, subject to its scope and continuing conditions.

Read the admission document

A company announcement can say it has joined a sandbox. Ask for the regulator's public confirmation or the admission terms it is permitted to disclose. Identify the legal entity, product, test period and customer group. A brand may contain several companies with different permissions.

Admission can carry limits on users, transaction value, geography, counterparties and duration. It can require reporting, customer disclosure and specific safeguards. Activity outside those limits doesn't inherit the sandbox's status.

The test may be paused or ended. Graduation isn't automatic, and successful technical performance may still leave legal or policy questions. Customers and partners should not plan on permanent operation unless a separate authorisation supports it.

TechCabal's report is the current source for this article. MarketBrief will update the regulatory record when primary sandbox documents provide more detail.

Keep four boundaries separate

The first boundary is entity. Permission attaches to a named company, not every affiliate, founder or application using a similar name. Contracts and customer terms should identify that entity.

The second is activity. Custody, exchange, transfer, issuance and payment services can fall under different rules. Approval to test one activity does not cover the others.

The third is test population. A sandbox may admit invited users under a cap. Public availability of an app doesn't prove that every user is inside the approved test.

The fourth is time. Admission and reporting periods have dates. A product operating after expiry needs an extension or another legal basis.

These boundaries belong in partner diligence. Add evidence, source date and the employee who checked it. “Regulated” is too vague for the file.

A central-bank test may not settle every regulator's role

Virtual assets can touch payments, securities, consumer protection, data, tax, anti-money-laundering and exchange-control rules. More than one authority may have jurisdiction. Central-bank sandbox admission should not be treated as a securities or tax opinion.

Ask which activities require permission from another regulator and whether those permissions have been obtained. Review financial-intelligence registration and reporting obligations. Check whether customer money or assets must be segregated.

A bank providing an account to the participant makes its own risk decision. Sandbox status can inform that decision without compelling the bank to accept every flow. Firms should agree expected volumes, evidence and escalation before testing.

Cross-border activity adds destination rules. A Nigerian test condition cannot authorise a service in another country. Partners need a jurisdiction map for the actual transaction path.

Customer disclosure has to be plain

A test user should know that the product sits in a sandbox, which entity provides it, what limits apply, what can go wrong and how to complain. The disclosure should not imply that the regulator guarantees funds or endorses investment performance.

Explain custody and redemption. If a third party holds assets, name its role. If balances can lose value or become unavailable, say so without burying the risk in a generic market warning.

State what happens when the test ends. Can users withdraw, transfer or redeem? What deadline applies? Who handles an unresolved dispute after the participant exits?

Consent to participate in a test doesn't waive statutory rights. Terms should be reviewed under current Nigerian law by qualified counsel.

Partners need a test-specific control file

A merchant, bank or technology provider working with a sandbox participant should retain the admission evidence, contract, approved use case, volume limits, data flows and incident contacts. Configure controls to the permitted test rather than to the vendor's full product catalogue.

Monitor cumulative volume and user count if the partnership can affect a cap. Define who stops transactions near the limit. An after-the-fact report cannot repair activity outside the condition.

Data collected for regulatory evaluation needs a lawful basis, security and retention schedule. The regulator's interest in results doesn't remove customer privacy obligations.

Incident plans should name both the participant and partner roles. A cyber event, asset shortfall or customer-harm case may trigger notice to the central bank and other bodies. The admission terms determine some reporting; general law determines the rest.

Evidence that the test produced

A sandbox can help measure transaction completion, fraud controls, complaint handling, liquidity and the fit between a product and existing rules. Publishable results should state sample size, duration and limits. A bounded test cannot establish safety at national scale.

The regulator can use evidence to amend rules, request another test, permit a licence application or stop the model. The participant can discover that compliance cost changes its economics. Those are useful outcomes even when the product does not graduate.

Investors should value the information rather than treating admission as a permanent regulatory asset. Ask which uncertainty the test is designed to resolve and what approval remains afterward.

Nigeria's move opens a controlled door. The width, duration and room behind it will come from primary conditions and later decisions, not from the word “sandbox” in a headline.

Sources

• TechCabal, 12 August 2026: Nigeria's central bank opens regulatory sandbox to virtual asset firms