INTRODUCTION
Compliance does not end when a startup receives its certificate of incorporation. Nigerian startups must also understand which regulators apply to their business, when filings are due, and what penalties may follow if those obligations are missed. This week’s article highlights the key regulatory bodies founders should know before launch.
COMPLIANCE AND REGULATORY BODIES: WHO IS WATCHING YOUR STARTUP, AND WHY IT MATTERS
The first two articles in this series addressed how startups are formed and how internal agreements protect founders, employees, and contractors. This article moves outward. Once a startup is incorporated and its internal documentation is in order, it enters a broader regulatory environment governed by several federal agencies, each with its own registration requirements, filing deadlines, and penalties for noncompliance. Most instances of non-compliance are unintentional, arising from founders’ lack of awareness of the regulators applicable to their businesses or the mistaken assumption that incorporation with the Corporate Affairs Commission (CAC) is sufficient. This article highlights the key regulators Nigerian startups should be familiar with and outlines the requirements imposed by each.
- The Corporate Affairs Commission: Compliance Does Not End at Incorporation
The CAC remains relevant long after a certificate of incorporation is issued. Any change to a company’s structure, including a change in directorship, shareholding, or registered address, must be filed with and approved by the CAC. Annual returns must also be filed to keep the company in active status, with the first return due within eighteen (18) months of incorporation and subsequently every year thereafter. A company that fails to file risks being declared inactive and, eventually, struck off the register entirely.
- The Nigeria Revenue Service: Tax Registration and Filing Obligations
Every startup must engage with the Nigeria Revenue Service (NRS), formerly the Federal Inland Revenue Service (FIRS), which was formally rebranded under the Nigeria Revenue Service (NRS) (Establishment) Act, 2025 and is expected to become effective from January 2026. The NRS retains the functions of the FIRS and has an expanded mandate covering revenue accruing to the Federal Government of Nigeria.
A significant practical change for founders is that tax registration is now automatic. Under the Nigeria Tax Administration Act 2025, a company’s CAC Registration Number (RC Number) is automatically converted into a unique 13-digit Corporate Tax ID upon incorporation. There is no separate application. To retrieve that Tax ID, founders visit taxid.nrs.gov.ng, select the “Corporate” tab, enter the company’s RC Number, and the 13-digit Tax ID is displayed instantly. This ID is required for corporate banking, government contracts, and all statutory filings.
The filing obligations themselves remain unchanged. Company Income Tax returns must be filed within eighteen (18) months of incorporation, and subsequently within six (6) months of the financial year-end. Value Added Tax is due by the twenty-first day of the following month. Where the startup has employees, PAYE deductions are remitted monthly to the State Internal Revenue Service in the employee’s state of residence. For employees residing in the Federal Capital Territory, remittances are made to the FCT Internal Revenue Service. Federal tax registration, filing, and payment now run through the NRS platform, Rev360, accessible at selfservice.nrs.gov.ng.
- NITDA and the Nigeria Data Protection Commission: Data Is a Regulated Asset
Most startups today, particularly technology-enabled ones, collect and process personal data as a matter
of course. In Nigeria, two (2) agencies oversee this activity; The National Information Technology Development Agency regulates information technology more broadly, including cloud computing and data storage infrastructure, while the Nigeria Data Protection Commission (NDPC) regulates how personal data is processed by data controllers and processors under the Nigeria Data Protection Act 2023.
Startups that control or process personal data may be required to register with the NDPC and file annual data audit reports, depending on the nature and scale of their processing activities. For a startup collecting user data through an app, website, or onboarding form, data protection obligations can arise far earlier than most founders expect.
- Sector-Specific Regulators: CBN, SEC, NAFDAC, and Others
Beyond the agencies that apply to nearly every startup, a separate layer of regulation applies depending on the industry. There is no single regulator dedicated to technology or fintech in Nigeria; oversight is shared across the Central Bank of Nigeria (CBN), the Securities and Exchange Commission (SEC), the Nigerian Communications Commission (NCC), the National Insurance Commission (NIC), and other sector-specific regulators.
A startup raising capital through securities offerings must register with the SEC and comply with the Investments and Securities Act 2025. A startup processing payments may require a licence from the CBN. A startup selling food, drugs, or cosmetics must register its products with NAFDAC before going to market. A digital lending platform falls under the supervision of the Federal Competition and Consumer Protection Commission, which has previously delisted non-compliant applications from app stores.
Founders should identify the applicable sector-specific regulators before launch, and not after a warning letter arrives. Operating without a required licence routinely results in product delisting, fines, or suspension of operations.
- Labour-Related Compliance: NSITF and Pension Contributions
Once a startup begins to hire, two (2) further obligations arise. Employers must contribute one percent (1%) of their employees’ monthly payroll to the Nigeria Social Insurance Trust Fund (NSITF). Employers must also remit monthly pension contributions through an approved Pension Fund Administrator, currently set at eight percent (8%) for the employee and ten percent (10%) for the employer, within seven (7) days of salary payment. Non-compliance with NSITF contributions attracts a fine of at least two percent (2%) of the amount due, in addition to the outstanding sum itself.
- Corporate Governance: Statutory Meetings
Compliance is not limited to filings and registrations. The Corporate & Allied Matters Act (CAMA) 2020 also imposes governance obligations. A startup’s first Annual General Meeting must take place no later than eighteen (18) months after incorporation, with subsequent meetings held within fifteen (15) months of the last. The first board meeting should take place within six (6) months of incorporation. Investors conducting due diligence will routinely request board minutes and Annual General Meeting (AGM) records as evidence that a company is properly governed.
Key Takeaway:
Compliance is not a single event that happens at incorporation. It is an ongoing relationship with multiple regulators, each operating on its own timeline.
The practical starting point is straightforward: confirm CAC and NRS compliance first, since these apply to every startup without exception. Then map every sector-specific regulator that applies to the business model before launch. A startup that treats regulatory compliance as part of its operating rhythm, rather than as an afterthought, is one that investors, partners, and regulators alike will trust.
Author
Talodabioluwa Iseoluwa Sanni
Trainee Associate
Rosewood Legal
tsanni@rosewoodlegal.com
Co-author
Lateefat Omotomilola Hakeem-Bakare
Principal Partner
Rosewood Legal
lhakeem-bakare@rosewoodlegal.com
Published on Wednesday, July 22, 2026
References:
Companies and Allied Matters Act 2020.
Nigeria Revenue Service (Establishment) Act 2025.
Nigeria Tax Administration Act 2025.
Nigeria Data Protection Act 2023.
National Information Technology Development Agency Act 2007.
Goldsmiths Solicitors, ’11-Point Regulatory Compliance Checklist For Start-ups In Nigeria To Ensure Success’ <https://www.goldsmithsllp.com/regulatory-compliance-startups-nigeria/> accessed 13 July 2026.
Global Legal Insights, ‘Fintech Laws and Regulations 2025: Nigeria’ <https://www.globallegalinsights.com/practice-areas/fintech-laws-and-regulations/nigeria/> accessed 13 July 2026.
KPMG Nigeria, ‘The Nigeria Revenue Service (Establishment) Act, 2025’ <https://kpmg.com/ng/en/home/insights/2025/07/the-nigeria-revenue-service-establishment-act-2025.html> accessed 13 July 2026.
FCT Internal Revenue Service, ‘Nigerian Tax ID Portal Goes Live Effective January 1, 2026’ <https://fctirs.gov.ng/nigerian-tax-id-portal-goes-live/> accessed 13 July 2026.
Joint Revenue Board and Nigeria Revenue Service, Nigerian Tax ID Portal <https://taxid.nrs.gov.ng> accessed 13 July 2026.
TaxSpire, ‘NRS Rev360 Portal Guide: How to Use Nigeria’s New Tax Portal’ <https://blog.taxspire.com/nrs-rev360-portal-guide/> accessed 13 July 2026.