Digital Lenders in Nigeria: FCCPC Registration Under the DEON Regulations, and Your AML Duties (2026)

Short answer: Digital lenders and loan apps in Nigeria must be registered with the Federal Competition and Consumer Protection Commission (FCCPC) under the Digital, Electronic, Online, or Non-Traditional Consumer Lending Regulations, 2025 (the DEON Regulations) and the DEON Guidelines, 2025. The FCCPC application asks for beneficial owners, sources of funds and a director declaration of compliance with the Central Bank of Nigeria's (CBN's) AML/CFT rules, and breaches cost a company up to ₦100 million or 1% of turnover. The Federal High Court upheld the Regulations on 20 July 2026. FCCPC registration is a conduct licence, not an AML licence: suspicious transaction reports and the rest of the AML regime come from the Money Laundering (Prevention and Prohibition) Act, 2022 (MLPPA) and the CBN.

This guide is for founders, compliance officers and legal teams at Nigerian digital lenders, loan apps, fintechs that lend, and the partners that power them. It is a practical guide, not legal advice: the Regulations, the Guidelines, the MLPPA and your regulators' instructions are the authoritative texts, and some questions below need your counsel.

---

Two regimes for one lender

The Regulations say so themselves: they are "in addition to, and not a substitute for compliance requirements under other laws". The FCCPC describes the split the same way: the CBN handles financial supervision, the Nigerian Communications Commission telecoms and the Nigeria Data Protection Commission (NDPC) data privacy, while the FCCPC "focuses on fair market conduct and consumer protection".

---

Who the DEON rules cover

The Regulations were made on 21 July 2025 under sections 17, 18 and 163 of the Federal Competition and Consumer Protection Act, 2018, and the FCCPC says they took effect that day. They cover unsecured consumer lending of cash, airtime, data, cashback, services or barter, when it happens "by digital, electronic, online, or non-traditional means". They reach the partners, vendors and service providers that share in the revenue, and any operation that runs across state lines. The Guidelines, in force from 18 November 2025, extend the rules to cross-border lending offered to consumers in Nigeria.

Outside the Guidelines: financial institutions licensed and regulated by the CBN, loans between employers and employees, and registered cooperative societies. Microfinance banks are a grey area. The Regulations tell them to apply for a waiver while still filing the forms, the Guidelines ask CBN licensees to notify the FCCPC before offering consumer lending other than money loans, and the FCCPC's FAQ says the rules include microfinance institutions. If you hold a CBN licence, check with the FCCPC whether you need a waiver or a notification.

---

Registering with the FCCPC

Lenders already operating had 90 days from commencement to apply for and receive the FCCPC's approval. Today the rule is simple: "in the case of a digital lender, the Lender must be duly registered and licensed by the Commission" (regulation 25(4)). A regulated company that lends through an unregulated partner needs a Consumer Lending Services Agreement approved by the FCCPC before it starts.

The application file (regulation 12 and Schedule 3):

• the Consumer Lending Services Agreement, Forms 001 and 002, and proof of fees;
• any licence from a sector regulator, and the company's CAC documents;
• directors, key management and shareholders, "including detailed information of the ultimate beneficiaries or beneficial owners";
• evidence of financial capacity and source of funds, such as three years' audited accounts;
• standard loan terms;
• an NDPC Audit Trust mark, and a compliance audit and privacy impact assessment from a registered data protection compliance organisation.

The FCCPC aims to decide within 30 days of a complete file.

Approval runs to 31 December of the third calendar year after it is issued, and renewal is due by 31 March of the following year.

---

The AML checks inside the application

The FCCPC is not an AML supervisor, but its forms carry AML content:

• Beneficial owners. The shareholder list must reach the ultimate beneficial owners.
• Sources of funds. Form 001 asks where the capital comes from, the identity and nature of business of each source, and the nationality of individuals. It also asks for every operational bank account and anyone who "owns, controls, or has material influence over the business".
• A director declaration (Form 002) that "the capital to be invested in my/our business has no origin or flow that is in violation of any law or proceeds of any illegal activity", and that "our processes and operations comply with the Central Bank of Nigeria Guidelines on Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT)".
• An AML/CFT policy for the pilot programme. A new lending product can run for 90 days, renewable once, if total exposure stays within ₦1,000,000 and 100 customers; the application must include an "Anti-money laundering/counter terrorism financing policy".

Signing that declaration is easy. Backing it, if the FCCPC or a bank asks, means having the customer due diligence, screening, monitoring and reporting the declaration describes.

The FCCPC's investigations explain the emphasis. In April 2022 its joint task force reported finding "complex web of ownership or corporate relationships with mostly foreign/offshore companies and promoters" and questions about "sources of operational capital, and methods of repatriating business proceeds".

---

Conduct rules that shape your systems

Penalties (regulation 27): fines, suspension, delisting or revocation of approval. An individual faces up to ₦50 million. A company faces up to ₦100 million or 1% of the previous year's turnover, whichever is greater, and its directors can be disqualified for up to five years. The FCCPC can also direct app stores to delist any lending app run in breach.

---

From the 2022 framework to the July 2026 judgment

The suspension also covered the 30 June 2026 expiry of deemed licences, and came as operators under transitional arrangements faced an April 2026 deadline. No FCCPC notice since the judgment sets new dates, so confirm your own status with the FCCPC.

The FCCPC publishes its register of approved lenders, conditional approvals, a watchlist, delisted apps and waivers for CBN-licensed companies. On 3 March 2026 it listed 525 approved digital lending companies, 35 conditional approvals, 112 apps on the watchlist, 54 delisted apps and 33 waivers. Check the live register before you partner with, fund or process payments for a lender.

---

Where a lender sits under the AML laws

The MLPPA 2022. Its definition of "financial institution" includes a "finance company" and "such other business as the Central Bank or other appropriate regulatory authorities may designate", and its definition of "transaction" includes "lending" (section 30). Its list of designated non-financial businesses and professions (DNFBPs) contains no lending category.

SCUML. The Special Control Unit against Money Laundering registers and supervises DNFBPs. Its 2024 regulations and its registration portal list no lending sector, so a lender is not a SCUML registrant on that basis.

The CBN. BOFIA requires a CBN licence for finance company business, whether it is done digitally or not. The CBN's AML/CFT/CPF Regulations, 2022 apply to all financial institutions under the CBN's regulatory purview and define a financial institution by its activities, lending included, whether done digitally or not. They cover customer due diligence, politically exposed persons, new technologies and non-face-to-face business, records and suspicious transaction reporting.

The open question. No text we have read says whether a lender registered with the FCCPC but holding no CBN licence is a "financial institution" under the MLPPA, or who supervises its AML compliance. Put that question to your counsel; the FCCPC's own forms already assume you comply with the CBN's AML/CFT rules.

---

Reporting to the NFIU

Lenders that are financial institutions under the MLPPA, such as CBN-licensed finance companies and microfinance banks, report to the NFIU:

• Suspicious transactions: immediately, with the written report and the action taken within 24 hours (section 7), whatever the amount.
• Currency transactions: any single transaction, lodgment or transfer above ₦5,000,000 for an individual or ₦10,000,000 for a company, within seven days (section 11).
• Where: STRs and currency transaction reports on the NFIU's goAML portal; nil and PEP returns on RapidAML for CBN-regulated entities. The NFIU's STR guidelines list loan records among the supporting documents.

See our guides to NFIU goAML registration, suspicious transaction reports and currency transaction reports, and our MLPPA 2022 explainer.

---

How the FCCPC has enforced

• 2021–2022: a joint task force with the CBN, NITDA, the ICPC and others executed search and seizure orders on digital lenders, froze accounts and ordered Google and Apple to withdraw apps (March 2022). Lenders seeking leniency signed declarations to stop contacting borrowers' contact lists and to stop abusive language.
• August 2022: payment companies were ordered to stop serving lenders under investigation or operating without approval.
• July–August 2023: two approved lenders permanently delisted for distributing unregistered app downloads, non-registrants put on a watchlist, and Google ordered to remove 18 named apps.
• 2021, data protection: NITDA, then the data protection regulator, fined a loan app ₦10,000,000 for messaging borrowers' contacts and sharing data through embedded trackers.
• January 2026: conditional approvals withdrawn and operators removed from the register (above).

---

Compliance checklist

1. Confirm your licence position: FCCPC approval, a CBN licence, a state money-lending licence, or a waiver.
2. Check that your apps and every partner and service provider appear on the FCCPC's live register.
3. Keep your beneficial-ownership and source-of-funds records current; they back the declarations in Forms 001 and 002.
4. Write the AML/CFT policy your declaration describes: due diligence, PEPs, sanctions screening, monitoring and reporting.
5. Ask counsel whether you are a financial institution under the MLPPA. If you are, register on goAML and set up 24-hour STR and seven-day currency transaction reporting.
6. Build the conduct rules into the product: opt-in only, disclosure before the transaction, no contacts or photos access, 24- to 48-hour complaint handling.
7. Keep records for five years, ready to produce within 48 hours, and diarise the biannual reports and the 31 March annual return.

---

Frequently asked questions

What are the FCCPC DEON Regulations?

The Digital, Electronic, Online, or Non-Traditional Consumer Lending Regulations, 2025, made by the FCCPC on 21 July 2025. They require digital lenders to register with the FCCPC and set rules on disclosure, consent, data, complaints, records and penalties. The DEON Guidelines, in force from 18 November 2025, add detail and repealed the 2022 interim framework.

Are the DEON Regulations still in force after the court case?

Yes. A Federal High Court order of 15 April 2026 suspended their enforcement, but on 20 July 2026 the court dismissed the challenge and upheld the Regulations, and the FCCPC resumed enforcement.

How much does FCCPC registration cost for a digital lender?

A ₦100,000 application fee, then ₦1,000,000 on approval for a digital money lender, covering two apps, ₦500,000 for each further app up to five, and a ₦500,000 annual levy.

What is the penalty for operating a loan app without FCCPC approval?

Sanctions include fines, suspension, delisting and revocation. A company can be fined up to ₦100 million or 1% of the previous year's turnover, whichever is greater, an individual up to ₦50 million, and directors can be disqualified for up to five years. The FCCPC can also have unapproved apps removed from app stores.

Do digital lenders have to register with SCUML?

Not as lenders: neither the MLPPA's list of designated non-financial businesses nor SCUML's 2024 regulations and registration portal include a lending category. A lender's AML position depends on whether it is a financial institution under the MLPPA, which for CBN-licensed lenders it is.

Does FCCPC registration cover AML compliance?

No. The FCCPC regulates conduct and consumer protection. Its forms ask for beneficial owners, sources of funds and a declaration of compliance with the CBN's AML/CFT rules, but suspicious transaction reporting, due diligence and records come from the MLPPA and the CBN.

---

See how Creodata's AML compliance software in Nigeria handles screening, monitoring and NFIU reporting for lenders: book a demo.