The most consequential regulatory signal Nigeria's fintech sector received this week came not from the Central Bank, not from the Securities and Exchange Commission, and not from any new bill on the National Assembly floor. It came from two EFCC arraignments involving a combined N897 million in alleged fraud — neither of which names a fintech company, a crypto exchange, or a digital payment platform as a defendant.
That omission is the story.
The EFCC moved this week to re-arraign three senior National Assembly officers accused of diverting N337 million in public funds between 2017 and 2019 Source: Premium Times, while separately arraigning two individuals and a firm for an alleged N560 million theft in Lagos Source: Premium Times. Both cases track the EFCC's traditional profile: public-sector diversion and corporate fraud involving conventional financial instruments. No wallets. No smart contracts. No digital ledgers.
This is not coincidental — it is structural. Nigeria's enforcement architecture was built for a pre-digital economy, and it has not caught up. The EFCC pursues what it can prosecute cleanly. And the practical consequence is that the digital finance layer — mobile money, crypto, peer-to-peer lending, BNPL platforms — operates in a space where enforcement ambiguity functions as an unofficial tolerance policy.
Who Benefits, Who Is Exposed
In the short run, digital asset operators and informal fintech intermediaries in Lagos, Abuja, and Port Harcourt benefit from enforcement inertia. Platforms that might technically breach existing money transmission rules face no credible prosecution risk precisely because the EFCC's evidentiary playbook is not calibrated for blockchain forensics or digital custody chains. Nigerian crypto founders know this. It is partly why Lagos remains one of the continent's most active informal crypto markets despite CBN restrictions that were only partially walked back in 2023.
But enforcement gaps are not the same as legal protection. The risk is not that regulators crack down — the risk is that they eventually do, suddenly, without transition frameworks, and with the full severity of laws that were never designed for the sector they are now being applied to. Kenya's OKX delisting crisis and Ghana's fintech licensing crackdown in 2023 both followed exactly this pattern: years of tolerance, then abrupt institutional correction with no runway for compliance.
The State Police Wildcard
There is a further complication emerging from the National Assembly this week. The Senate Leader confirmed that state police legislation is expected to reach a vote imminently. The question this raises for Nigeria's tech sector is whether state-level law enforcement mandates will include cybercrime jurisdiction — and if so, whether 36 state police forces, each with distinct political leadership, will apply digital enforcement standards differently. That kind of jurisdictional fragmentation would transform Nigeria's already inconsistent digital regulatory environment into something far harder to navigate for fintech operators, platform companies, and infrastructure providers building national-scale products.
The African Regulatory Pattern
Nigeria is not alone in this dynamic. Across Francophone West Africa, BCEAO's e-money framework governs licensed operators in Senegal, Côte d'Ivoire, and Mali — but enforcement against unlicensed digital intermediaries remains patchy at best. In East Africa, Kenya's Capital Markets Authority and the Central Bank have moved more decisively against crypto platforms, but informal P2P markets in Nairobi and Mombasa operate largely outside either institution's reach. South Africa's FSCA began requiring crypto asset service providers to register in 2023, but enforcement against non-compliant platforms remains selective.
The continent-wide pattern is the same: formal law enforcement institutions pursue the fraud typologies they were built for, while the digital finance layer scales in the gaps between mandates.
The Recommendation
African regulators — Nigeria's CBN and EFCC most immediately, but also Ghana's Bank of Ghana, Kenya's CBK, and the FSCA — must treat enforcement silence as a policy statement, because markets are reading it as one. The choice is not between strict regulation and permissiveness. It is between deliberate frameworks with transition periods and sudden corrections that punish the compliant and the non-compliant alike. Fintech founders building in Lagos, Accra, Nairobi, and Johannesburg deserve to know which world they are operating in. Right now, nobody is telling them.