The Governance Test Hiding Inside a Registration Form

The Governance Test Hiding Inside a Registration Form

Why Boards Preparing for Nigeria's Digital Asset Rules Could Be Solving the Wrong Problem| September 2026

The Registration Myth

Most boards approaching a new regulatory registration see it as an administrative milestone, another form to complete once the business case is approved. Nigeria’s proposed rules for digital and virtual asset operations make that approach difficult to sustain.

Within the broader registration requirements is a condition that changes the picture entirely: applicants must demonstrate that they have a functioning risk and governance framework covering compliance, risk management, internal audit, technology, cybersecurity and operational resilience. And this requirement comes before the rules specific to digital assets even come into play. Governance capability is not simply a condition of getting the licence. It is the licence.

The Regulatory Position

The SEC Nigeria published its Proposed Rules on Digital and Virtual Asset Operations, Custody and Markets for consultation on 20 August 2026. The consultation period ended on 3 September 2026. Under Part 2 of the proposed rules, governance and risk arrangements must be appropriate to the organisation’s size, complexity, business model and risk profile, and acceptable to the Commission.

The challenge is that there is no published maturity benchmark or scoring system explaining exactly what “acceptable” looks like at each registration level. This means applicants may need to demonstrate that their governance arrangements work in practice, rather than simply meet a fixed checklist.

What This Means for Boards

This is where the difference between having policies and having effective governance becomes important. A board that can show consistent risk oversight through its meeting records provides stronger evidence than one that approved a set of policies just before submitting an application. The same applies to internal audit, incident response and operational resilience. It is more credible to show that these processes have been used and tested than to simply point to a document saying they exist.

Good governance takes time to demonstrate. Evidence builds through regular board oversight, testing, reviews, audits and documented decisions. It cannot easily be created in the final weeks before a registration deadline. Boards should therefore treat registration readiness as a governance exercise, not just a filing exercise.

What Boards Should Do Now

• —Assess the current position: Look at whether the governance framework actually works in practice, not just whether the required documents exist.
• —Confirm the relevant registration category: Identify which category applies to the organisation’s current or planned digital asset activities and understand what governance expectations may apply.
• —Assign clear ownership: Every identified gap should have an owner, a timeline and a clear route to resolution.
• —Start building evidence: Test incident response arrangements, conduct internal audits, document board-level risk oversight and keep evidence of how governance processes operate.

Conclusion

The key question for boards is no longer simply, “Do we have the documents required for registration?” It is, “Can we demonstrate that our governance actually works?”

For digital asset businesses preparing for regulation, that distinction matters. The strongest applicants will be those that start building the evidence of effective governance before they need to submit it, rather than trying to create it when the application is already due.

Prepared as part of CCC Advisory’s regulatory insights and advisory work.

© CCC Advisory. All rights reserved.