Blog

  • Why Your Business Must Comply with the Nigeria Data Protection Act in 2026

    Why Your Business Must Comply with the Nigeria Data Protection Act in 2026

    Data is no longer just an operational asset; it is the lifeblood of modern business. From banks processing millions of transactions to hospitals safeguarding patient records, retailers analyzing customer behavior, and manufacturers managing employee information, every organization touches personal data daily. With this power comes profound responsibility: safeguarding data is no longer optional; it is a strategic imperative.

    In Nigeria’s evolving data protection landscape, organizations that treat data security as a core governance priority will not only mitigate legal risk but also build trust, resilience, and lasting competitive advantage. Yet, despite the growing awareness of cyber threats, many organizations still approach data protection as a compliance checkbox rather than a strategic business function. This mindset is increasingly dangerous.

    As regulatory scrutiny intensifies and cybercriminals target sensitive business and customer data, the cost of inaction extends far beyond fines, it threatens reputation, customer confidence, and ultimately, market relevance. Forward-thinking leaders recognize that robust data governance is more than IT security; it is an essential component of corporate strategy, risk management, and stakeholder trust.

    By embedding data protection into every operational layer, organizations can transform a legal obligation into a strategic differentiator that drives long-term value.

    Nigeria’s Data Protection Framework: What Changed

    The Nigeria Data Protection Act (NDPA) 2023 marked a turning point in how Nigeria regulates personal data. Signed into law in June 2023, the NDPA established the Nigeria Data Protection Commission (NDPC) as an independent regulatory authority with significant enforcement powers.

    The real transformation came with the General Application and Implementation Directive (GAID) 2025, which took effect on September 19, 2025. GAID 2025 replaced the old NDPR 2019 framework with detailed, actionable requirements that leave no room for interpretation. For the first time, Nigerian organizations have clear compliance obligations for data protection rather than broad principles.

    Non-compliance carries serious consequences which could be fines of up to 2% of annual gross revenue or ₦10 million (whichever is greater), public listing on the NDPC’s non-compliance register, reputational damage, and potential loss of business opportunities. Beyond penalties, strong data protection practices create competitive advantages, enhance operational efficiency, and build customer trust.

    Read more: Why NDPA Compliance is Essential for Your Company’s Survival

    Understanding the GAID Classification System

    GAID 2025 introduced a tiered classification that determines your compliance obligations for Data Processors/Controllers:

    • Ultra-High Level (UHL): includes strategic sectors like banking, telecommunications, insurance, oil and gas, fintech, and payment gateways. These entities handle massive volumes of sensitive data of over 5000 data subjects with significant economic impact.
    • Extra-High Level (EHL): covers large-scale processors that process over 1000 data subjects including major government bodies and significant commercial enterprises processing substantial personal data.
    • Ordinary-High Level (OHL): encompasses smaller operations like educational institutions, community banks, and other entities processing personal data of over 200 data subjects.

    Your classification determines registration requirements, audit obligations, and reporting frequencies. UHL and EHL entities must register once with NDPC and file annual Compliance Audit Returns (CAR) through licensed Data Protection Compliance Organizations (DPCOs). OHL entities renew registration annually but are exempt from annual CAR filing.

    Read more: The Road to Trust: How GAID 2025 Will Shape Nigeria’s Digital Economy

    The Seven Principles Governing Personal Data

    The NDPA 2023 establishes seven foundational principles for all personal data processing:

    • Lawfulness, Fairness, and Transparency – Process data with valid legal basis (consent, contract, legal obligation, or legitimate interests) and communicate practices clearly through accessible privacy policies.
    • Purpose Limitation – Collect data for specific, explicit purposes and avoid using it for incompatible secondary purposes without fresh consent.
    • Data Minimization – Collect only data necessary for stated purposes, implementing role-based access controls and regularly reviewing holdings to eliminate redundancies.
    • Accuracy – Maintain current, accurate information with validation mechanisms, update processes, and conduct regular quality audits.
    • Storage Limitation – Retain data only as long as necessary, with defined retention schedules and automated deletion processes.
    • Integrity and Confidentiality – Implement robust technical security (encryption, access controls, network security) and organizational measures (policies, training, incident response plans).
    • Accountability – Demonstrate compliance through comprehensive documentation, audits, and governance structures including compliance schedules and audit returns.

    Key Compliance Requirements

    • Data Protection Officer (DPO) – Organizations that are Data Controllers/ Processors must appoint qualified DPOs who report to senior management, serve as contact points for data subjects, and actively participate in data processing decisions. Organizations can engage external DPO services to fulfill this requirement cost effectively.
    • Data Protection Impact Assessments (DPIAs) – Mandatory before implementing high-risk processing activities like systematic profiling, large-scale sensitive data processing, systematic monitoring, or deploying new technologies. GAID provides standardized templates and may require NDPC review.
    • Technical Security Measures – Organizations must implement encryption (AES-256 for data at rest, TLS 1.2+ for transit), multi-factor authentication, role-based access controls, network segmentation, regular vulnerability assessments, and comprehensive backup and recovery capabilities.
    • Privacy by Design – Data protection must be integrated into systems from inception, with maximum privacy settings applied by default and privacy reviews conducted during design phases.
    • Data Subject Rights – Organizations must establish processes to handle individual rights including access requests (respond within one month), rectification of inaccurate data, erasure when data is no longer necessary, data portability in machine-readable formats, and objection to processing.
    • Breach Management – Organizations must notify the NDPC within 72 hours when breaches pose risk to data subjects, provide detailed information about the incident, and notify affected individuals directly when breaches pose high risks.
    • Cross-Border Transfers – Transferring data outside Nigeria requires appropriate safeguards including adequacy decisions, standard contractual clauses, binding corporate rules, or informed consent. All transfers must be documented.

    Read more: Compliance as a Tool for Risk Management: Safeguarding Your Business in an Evolving Landscape

    Why Data Protection Applies to Every Sector

    Data protection is not just for technology companies or digital businesses. It applies to all organizations handling personal data:

    • Financial services organizations face enhanced requirements for BVN and financial data security, strong customer authentication, extended retention obligations, and anti-money laundering compliance.
    • Healthcare companies must provide heightened protection for health information, secure electronic medical records, obtain proper consent for research, and address telemedicine privacy.
    • Manufacturing and Retail companies handle employee data, customer loyalty programs, supplier information, and CCTV records which require data protection compliance.
    • Educational Institutions must process student records, employee information, and parent contact details under strict privacy requirements.
    • Professional Services Firms manage confidential information requiring robust protection and clear data processing agreements.

    Whether your operations are digital, traditional, or hybrid, if you collect, store, or process personal data about identifiable individuals, data protection compliance is mandatory.

    The Critical Role of Licensed DPCOs

    Here’s What Many Organizations Do Not Realize:

    UHL and EHL entities cannot file their mandatory annual Compliance Audit Returns directly with the NDPC. The law requires these submissions to go through licensed Data Protection Compliance Organizations. This requirement recognizes that effective data protection compliance demands specialized expertise which most organizations lack internally. Licensed DPCOs provide independent compliance audits (meeting NDPC standards), gap analysis (identifying specific deficiencies), CAR preparation and filing (ensuring proper submission), expert guidance (navigating complex regulations), ongoing compliance monitoring (adapting to regulatory changes), DPO services (fulfilling appointment requirements), DPIA support for high-risk activities, and staff training (building organizational capacity).

    Licensed DPCOs are compliance partners who help organizations build sustainable frameworks rather than check boxes. They bring practical knowledge of NDPC expectations, industry best practices, and proven implementation methodologies.

    The Business Value of Strong Data Protection

    Beyond regulatory compliance, robust data protection practices create tangible business advantages:

    • Market Differentiation – Privacy conscious customers increasingly choose vendors demonstrating compliance. In competitive markets, certified compliance becomes a deciding factor.
    • Partnership Opportunities – Multinational corporations and government agencies require verified compliance before awarding contracts. Strong data protection opens doors to lucrative opportunities.
    • Risk Reduction – Comprehensive security measures reduce breach likelihood and impact, avoiding incidental costs, legal liabilities, and reputational damage.
    • Operational Efficiency – Disciplined data management often reveals redundancies and inefficiencies, streamlining operations and reducing costs.
    • Innovation Enablement – Clear governance frameworks allow responsible innovation, providing confidence to explore new technologies and business models.

    Organizations viewing data protection as strategic investment rather than a compliance burden position themselves for sustainable competitive advantage.

    Critical Compliance Deadlines

    The NDPC requires that UHL and EHL entities file their annual Compliance Audit Returns before the 31st day of March 2026 through licensed DPCOs. The compliance audit and CAR preparation process typically requires 4- 8 weeks for most organizations. Organizations starting late can face compressed timelines, rushed implementations, and increased non-compliance risk. Those missing deadlines face financial penalties, public listing on non-compliance registers, and intensified regulatory scrutiny.

    Beyond March 2026, data protection compliance remains an ongoing process. Regulations evolve, threats change, and business operations develop. Sustainable compliance requires continuous monitoring, regular audits, staff training updates, and adaptation to new requirements.

    Taking Action: Your Path to Compliance

    If you are just starting your compliance journey or seeking to strengthen existing frameworks, partnering with a licensed DPCO makes the difference between compliance as a burden and compliance as a competitive advantage.

    As a licensed Data Protection Compliance Organization, Stransact Chartered Accountants assists organizations across all industries to achieve and maintain compliance with Nigeria’s data protection requirements. Our certified professionals bring deep regulatory knowledge, practical implementation experience, and tailored solutions addressing your specific business context.

    Our comprehensive services include:

    • Compliance assessments identifying current gaps
    • Annual Compliance Audit Returns preparation and filing
    • Data Protection Officer services
    • Policy development and staff training
    • Data Protection Impact Assessments
    • Breach response planning and support
    • Ongoing compliance monitoring and advisory

    Conclusion

    Every organization’s data protection journey is unique. We begin by understanding your specific challenges, then develop solutions meeting regulatory requirements while aligning with operational realities and business objectives. Proactive organizations that invest in strong data protection frameworks today position themselves for success while those delaying face mounting risks and compressed timelines.

    Reach out to us today to discuss your data protection compliance needs. Let us help you build a sustainable framework that protects your organization, respects individual rights, and positions you for success in Nigeria’s evolving regulatory landscape.

  • PAYE Deductions Are Not Enough: Key Compliance Gaps Organizations Must Address in Nigeria

    PAYE Deductions Are Not Enough: Key Compliance Gaps Organizations Must Address in Nigeria

    As organizations commence a new financial year, it is imperative to take a strategic look at statutory compliance obligations particularly those related to employee taxation. While many employers consistently deduct and remit monthly Pay-As-You-Earn (PAYE) taxes, a key compliance requirement is often overlooked: the Annual PAYE Returns Filing. 

    Annual filing is not merely an administrative formality; it is the statutory confirmation of an employer’s year-round PAYE compliance. A clear understanding of filing requirements, deadlines, and the risks associated with non-compliance ensures that organizations maintain robust governance practices and avoid unnecessary penalties. 

    What Exactly Is the Employer Annual PAYE Returns Filing? 

    Annual PAYE returns provide the State Internal Revenue Service (SIRS) with a consolidated record of an organization’s payroll-related tax activities for the entire fiscal year. These returns typically include: 

    • A comprehensive list of all employees on the payroll 
    • Total emoluments paid to each employee 
    • Pension and other statutory deductions 
    • Monthly PAYE deductions and remittances 

    Why Does It Matter? 

    • For Relevant Tax Authorities:

      It is a key tool for reconciling monthly PAYE remittances, validating employer compliance, and maintaining accurate taxpayer records. 

    • For Employees:

      Accurate annual filings ensure that their tax contributions are correctly documented—supporting applications for Tax Clearance Certificates (TCCs), banking transactions, employment verification, contract bidding, and visa processing. 

    Monthly deductions alone do not constitute full compliance. The annual filing is the formal legal confirmation of PAYE deducted and remitted through the year.

    Statutory Deadline: 31 January 

    The Nigeria Tax Administration Act (NTAA) 2025 retains the long-standing statutory deadline of 31 January following the assessment year for filing annual PAYE returns. This deadline is fixed and not subject to extension. 

    Timely filing: 

    • Confirms compliance with the law. 
    • Prevents administrative escalations by tax authorities.
    • Facilitates the prompt issuance of TCCs to employees.

    Missing the deadline, even by a short period, exposes organizations to penalties under Section 101 of the NTAA 2025. 

    Penalties for Late, Incorrect, or Incomplete Filing 

    Under Section 101 of the NTAA 2025: 

    • ₦100,000 penalty for the first month of default 
    • ₦50,000 for every subsequent month until compliance is achieved 

    These penalties are administrative and not punitive; but they can accumulate quickly, resulting in unnecessary financial burdens. Early preparation and filing remain the most cost-effective strategy.

    The Compliance Challenges Many Organizations Overlook

     Even organizations with strong compliance cultures may encounter challenges such as: 

    • Incomplete employee records (e.g., missing TINs or biodata) 
    • Delayed year-end payroll processing, especially in December 
    • Third-party payroll errors arising from outsourced service arrangements 
    • Lack of awareness, many companies assume monthly PAYE remittance alone is sufficient 

    Most of these issues are preventable through early planning and enhanced data governance. 

    Practical Steps to Strengthen Compliance 

    Employers can improve the filing process by taking the following actions: 

    • Audit payroll records early to confirm accuracy and completeness. 
    • Verify employee Tax Identification Numbers (TINs) to avoid submission delays. 
    • Reconcile monthly PAYE filings with year-end totals to ensure consistency. 
    • Engage payroll teams and service providers ahead of time, reinforcing expectations. 
    • Submit returns well before 31 January to avoid the rush and mitigate risks. 

    These steps help eliminate errors, reduce pressure, and ensure seamless compliance. 

    Beyond Compliance: Why Timely Filing Truly Matters 

    Annual PAYE filing offers benefits that extend beyond legal requirements: 

    • Employees: Accurate tax records ensure the facilitation of certain key personal and professional transactions. 
    • Employers: Enhance their corporate governance profile and reinforce stakeholder confidence. 
    • State tax authorities:  Improve revenue planning and maintain reliable taxpayer databases. 

    Timeliness reflects organizational professionalism and strengthens trust among employees, regulators, and business partners. 

    Conclusion 

    Annual PAYE returns filing remains a vital obligation under Nigerian tax law. Whilst monthly PAYE deductions are fundamental, they are not a substitute for the statutory annual filing that confirms compliance for the entire year. The 31st of January deadline and the penalties outlined in the NTAA 2025 underline the importance of proactive planning, not to intimidate organizations, but to encourage best-practice governance. 

    With early preparation, accurate data management, and a proactive compliance strategy, organizations can meet their obligations seamlessly supporting their workforce, enhancing their reputation, and maintaining regulatory peace of mind. 

    Start the financial year on a compliant foundation. It is smarter, safer, and ultimately more professional. 

  • Cybersecurity Risks in Tax Technology and How Nigerian Firms Can Stay Protected

    Cybersecurity Risks in Tax Technology and How Nigerian Firms Can Stay Protected

    The digital transformation of the accounting industry has brought unprecedented efficiency, especially in tax preparation and filing. However, this reliance on tax technology from cloud-based software to secure client portals also introduces a critical set of cybersecurity challenges.

    For organizations handling highly sensitive financial and personal data, protecting these digital assets is no longer optional; it’s the foundation of client trust and regulatory compliance.

    Tax season, in particular, has become peak hunting season for cybercriminals, with attacks on accounting firms surging as workloads increase and vigilance drops.

    The Top Cybersecurity Risks in Tax Technology

    Cybercriminals are sophisticated, targeting both large and small firms with a variety of attack vectors. Here are the most prominent risks your firm must actively defend against:

    1. Phishing and Social Engineering

    This is overwhelmingly the initial entry point for most breaches. Threat actors send deceptive emails (phishing) or use voice calls (vishing) that mimic trusted entities like the IRS, QuickBooks, or a firm executive. Their goal is to trick employees into:

    • Clicking on malicious links that download malware or ransomware.
    • Revealing login credentials or two-factor authentication codes.
    1. Ransomware and Malware

    Once an attacker gains access, often via a phishing link or an unpatched vulnerability, they can deploy ransomware. This malicious software encrypts your files and systems, holding critical client data hostage until a ransom is paid. The disruption, downtime, and cost of recovery can be catastrophic. Malware can also be installed to steal usernames, passwords, and other confidential data over time.

    1. Third-Party and Cloud Vulnerabilities

    Modern tax practices rely on a network of external services: cloud-based tax software, e-signature platforms, and managed IT services. If one of your vendors a third-party partner suffers a breach due to an unpatched system or weak security, your firm’s data can be exposed. Furthermore, misconfigurations in cloud environments remain a significant security gap.

    1. Insider Threats

    Not all threats come from outside. Insider threats stem from employees, contractors, or other personnel. This can be malicious (intentionally leaking data) or, more commonly, accidental (negligently clicking a link, using an unsafe mobile connection, or mishandling sensitive files). Given that 95% of cybersecurity breaches are reportedly due to human error, staff training is paramount.

    1. Outdated Software and Weak Access Controls

    Failing to regularly update tax software, operating systems, and network hardware leaves systems vulnerable to known exploits. Equally dangerous is a lack of strict access controls and reliance on weak passwords, which are easily guessed or compromised, giving attackers an effortless entry into your sensitive systems.

    Read more: Cybersecurity as a Boardroom Priority: Moving from IT to Strategic Risk

    How Firms Can Stay Protected: Best Practices

    Protecting client data requires a multi-layered, proactive security strategy. A single firewall or antivirus won’t cut it.

    1. Establish an Unbreakable Digital Foundation

    • Mandatory Multi-Factor Authentication (MFA): This is the single most effective defense against unauthorized access. Make MFA mandatory for all systems email, tax software, client portals, and VPNs. It requires users to verify their identity using a second factor (like a mobile code or authenticator app) in addition to a password.
    • Encrypt Everything: Ensure all sensitive data is encrypted at rest (on your servers or cloud storage) and in transit (when being sent to a client or vendor).
    • Strong Password Protocols: Enforce the use of complex, unique passwords (at least 12 characters with a mix of types) and require the use of a secure password manager for all staff.
    1. Prioritize Data and System Resilience

    The 3-2-1 Backup Rule: To mitigate the damage of a ransomware attack, you must be able to restore your data.

    • Keep 3 copies of your data (the primary and two backups).
    • Store them on 2 different types of media (e.g., local server and cloud).
    • Ensure 1 copy is kept off-site or offline (air-gapped).

    Keep Software Patched and Updated: Implement a policy for automatic, timely patching of all operating systems, antivirus software, and tax-specific applications to close known security gaps.

    Implement Role-Based Access Control (RBAC): Limit employee access to only the specific data and systems absolutely necessary for their job function. This minimizes the scope of a breach if an account is compromised.

    1. Invest in People and Processes

    • Continuous Cybersecurity Training: Since human error is the top vulnerability, frequent, mandatory training is essential. Teach employees to spot phishing, recognize social engineering tactics, and report suspicious activity immediately.
    • Due Diligence on Vendors: All third-party software and IT providers must adhere to your firm’s security standards. Conduct regular security assessments of your vendors to manage supply chain risks.
    • Develop an Incident Response Plan: No system is impenetrable. Have a comprehensive, documented plan detailing the immediate steps to take in the event of a breach, including roles, communication protocols, data recovery steps, and client notification procedures. Test this plan regularly.
    1. Maintain Compliance and Oversight

    • Security Audits and Penetration Testing: Hire third-party experts to conduct annual security audits, vulnerability scans, and simulated attacks (penetration tests) to identify and address weaknesses before criminals exploit them.
    • Formal Written Information Security Plan (WISP): Create a formal document outlining all security policies and procedures, as this is often required for compliance with industry regulations and standards.
    • By treating cybersecurity as a year-round, top-tier priority, not just a tax-season concern, your firm can build the resilience needed to protect client data, maintain trust, and safeguard your reputation in the digital age.
    • Read more: One Law, Two Scripts: Navigating the Material Discrepancies in the Nigeria Tax Act 2025 – Eben Joels
    • Conclusion
    • The stakes are too high to leave your firm’s security to chance. At Stransact Chartered Accountants, we provide specialized cybersecurity and tax technology services designed to protect your most sensitive assets. From implementing Multi-Factor Authentication and robust encryption to developing Written Information Security Plans (WISP) and conducting staff training, we ensure your firm is defended against the latest threats.
    • Do not wait for a breach to take action. Contact us today at [email protected] to schedule a security assessment and let us help you build a secure, resilient digital environment for your tax operations.
  • One Law, Two Scripts: Navigating the Material Discrepancies in the Nigeria Tax Act 2025 – Eben Joels

    One Law, Two Scripts: Navigating the Material Discrepancies in the Nigeria Tax Act 2025 – Eben Joels

    Nigeria’s fiscal landscape has officially shifted with the commencement of the Nigeria Tax Act, 2025 on January 1, 2026. However, a quiet storm is brewing in the boardrooms of tax consultants and corporate legal departments. Two versions of the same Act are currently in circulation: one released previously by the Federal Inland Revenue Service (FIRS) as the gazette tax laws, bearing a reference number “FGP 29/72025/5OO” and the “Final Approved Copy”; the version bearing the weight of the law, signed by both the Clerk of the National Assembly and President Bola Ahmed Tinubu, which was recently made public by the National Assembly. Incidentally, both copies claim to be published by the official gazette of the Federal government Press. While the former “FGP 29/72025/5OO” lists the page range as A385-A597, the copy released by the National Assembly bearing the stamp “Final Approved Copy” lists the page range as A387-A596.

    While the differences may seem subtle at a glance, a deep dive reveals material discrepancies that could redefine tax liabilities for millions of businesses, particularly Small and Medium Enterprises (SMEs).

    Perhaps the most jarring difference lies in the very definition of a “Small Company.” Under the FIRS version of the Act, a small company which enjoys a 0% Companies Income Tax (CIT) rate, is defined as a business with an annual gross turnover of N50,000,000 or less. In a significant departure, the Presidentially-signed Final Approved Copy raises this ceiling to N100,000,000. This N50 million gap is not merely semantic; it represents a vast segment of the Nigerian business community that would be exempt from income tax under the official law but potentially pursued for payment under the FIRS version.

    Read more: Why Nigeria Cannot and Will Not Tax Your Bank Account – Eben Joels

    Another subtle but material difference lies in the taxation of “Digital” vs. “Virtual Assets”. As Nigeria seeks to formalize its burgeoning digital economy, the terminology used to describe what is to be taxed is not so straightforward. In the FIRS version, Section 4(1)(j) explicitly brings “profits or gains from transactions in digital or virtual assets” into the tax net. The Final Approved Copy, however, opts for the more concise “digital assets”. While “digital” is often used as a catch-all, the inclusion of “virtual” in the FIRS version appears to cast a wider, more aggressive net over the crypto and blockchain space.

    The list of repealed laws is the bedrock of any new tax regime. Here, the FIRS version includes a critical addition: it lists the “Taxes and Levies (Approved List for Collection) Act” as being repealed. The version released by the National Assembly and signed by the President does not include this Act in its list of repeals. This creates a legal grey area regarding which agency; Federal, State, or Local has the authority to collect specific levies. If the Taxes and Levies Act remain in force (as the President’s signature suggests), many of the collection mandates assumed by the new Act could face constitutional challenges in court.

    The energy sector is not exempt from the confusion. In Section 86, which governs decommissioning and abandonment funds for petroleum operations, the FIRS version demands that licensees deposit a minimum of 30% of the fund with a Nigerian bank. The national assembly version sets the threshold at 15%.

    Furthermore, the FIRS document contains an expanded Section 13 that provides detailed definitions for “financial technology” (fintech), “shared services”, and “labelled startups”. These technical definitions, intended to clarify the tax status of tech-driven services, are notably absent from the same section in the version signed into law by the President.
    In the eyes of the Nigerian judiciary, the rule of thumb is clear: the version signed by the Clerk of the National Assembly and given Presidential Assent is the law of the land. The “Final Approved Copy,” which lists the Official Gazette range as A387-A596, remains the only legitimate reference for taxpayers.

    Read more: The Limits of Regulatory Authority and the Imperative of Legislative Clarity

    The instances mentioned above do not reflect all the material instances we have cited. For example, the scope of “employment income” appears broader in the unsigned version distributed earlier, before the recent version released by the National Assembly. There are also differences in what constitutes “Gas Production Credits”. Hidden somewhere in the previous version is a mandate for the Nigerian Upstream Petroleum Regulatory Commission to account for all royalties due within the ten years immediately preceding the Act’s commencement. This material mandate is missing from the version released by the National Assembly.

    As the FIRS begins implementation, discrepancies such as referring to the “Nigeria Revenue Service” instead of the “Nigerian Revenue Service” cited in the signed copy and several other subtle differences may lead to avoidable litigation. For now, Nigerian businesses are advised to comply with the signed Gazette issued by the National Assembly.

  • The Limits of Regulatory Authority and the Imperative of Legislative Clarity

    The Limits of Regulatory Authority and the Imperative of Legislative Clarity

    Nigeria’s ongoing tax reform process, including the enactment of omnibus tax statutes intended to replace and consolidate several existing tax laws, represents one of the most far-reaching fiscal restructurings in recent history. Given the breadth and systemic impact of these reforms, strict adherence to constitutional procedure, legislative authority and settled principles of administrative law is indispensable. These are just not matters of form; they go to the legitimacy of the law itself.

    Recent public statements attributed to the Chairman of the Presidential Fiscal Policy and Tax Reforms Committee, suggesting that perceived defects or inconsistencies in the clear provisions of a gazetted Act may be addressed through regulations, had already raised concern within the legal and tax community. Those concerns have now assumed greater significance in light of both Mr. Oyedele’s further explanation and the emergence of an ongoing investigation by the National Assembly into post-passage alterations of the tax legislation.

    Mr. Oyedele’s Clarification and the Problem It Reveals

    In his most recent public explanation, Mr. Taiwo stated that he does not have access to the harmonised version of the tax legislation as passed by the National Assembly. He further indicated that this lack of access makes it difficult to ascertain whether the version currently gazetted accurately reflects what was approved by the legislature.

    This clarification is legally consequential. If a key factor in the reform process is unable to independently verify the harmonized legislative text, then questions about discrepancies cannot be resolved by assumption, explanation or administrative interpretation. At that point, the issue ceases to be one of implementation detail and becomes a question of legislative authenticity.

    Read more: Why Nigeria Cannot and Will Not Tax Your Bank Account – Eben Joels

    Legislative Authority and the Role of the National Assembly

    Under sections 4(1) and (2) of the Constitution of the Federal Republic of Nigeria 1999 (as amended), legislative power for the Federation is vested exclusively in the National Assembly. That authority is neither shared with committees nor exercisable by administrative bodies through proxy. The Supreme Court has consistently affirmed that substantive law-making power is exclusive and non-delegable.

    Once a bill has been passed by the National Assembly, assented to by the President and published in the Official Gazette, the legislative process is complete. The text so gazetted constitutes the law and is the only version recognized by the Constitution. However, this constitutional finality necessarily presupposes that the gazetted text is an authentic reproduction of the harmonised bill passed by Parliament.

    Gazetting, Authenticity and the Current Uncertainty

    Publication in the Official Gazette is the act that confers legal force and public notice on legislation. Nigerian courts have consistently treated the Gazette as conclusive evidence of statutory law. However, the authority of the Gazette depends on authenticity. Where credible questions arise as to whether the gazetted text corresponds with the harmonised version approved by the National Assembly, that uncertainty strikes at the root of legality.

    This concern is no longer speculative. The House of Representatives has formally constituted a Select Committee to investigate allegations of post-passage alterations to the tax legislation. The Committee’s interim findings suggest that certain provisions may have been inserted, modified or removed after legislative passage, raising serious constitutional questions as to validity.

    In such circumstances, neither drafts, explanatory notes nor post-enactment assurances can cure the uncertainty. Only the legislature itself can conclusively determine what it passed.

    Read more: How the Nigeria Tax Act 2025 Empowers Individual Taxpayers

    Why Regulations Cannot Resolve Legislative Defects

    It is in this context that suggestions about using regulations to “correct” perceived defects become particularly problematic. Regulations are a form of delegated or subsidiary legislation. Their validity depends entirely on the enabling Act, and Nigerian case law is settled that they cannot amend, override or contradict the clear provisions of an Act of the National Assembly.

    More fundamentally, regulations cannot be used to resolve doubts about whether the primary legislation itself accurately reflects legislative intent. Delegated legislation presupposes a valid and settled principal statute. It cannot be deployed to stabilise, legitimise or repair uncertainty at the level of primary legislation.

    Institutional Risk of Proceeding Amid Legislative Uncertainty

    Proceeding with implementation while the National Assembly is actively investigating the legality and provenance of the gazetted Acts carries significant institutional risk. It risks creating multiple competing “versions” of the law: one allegedly passed, another gazetted, and a third administratively interpreted. In tax law, where certainty is foundational, such fragmentation is untenable.

    It also exposes taxpayers, administrators and the government itself to avoidable litigation, compliance disputes and enforcement challenges. Once implementation begins, unwinding actions taken under a statute later found to be defective becomes legally and practically complex.

    The Case for Deferring Implementation

    In light of Mr. Oyedele’s clarification and the ongoing legislative investigation, constitutional prudence points in one direction. Implementation of the new tax legislation should be deferred until the National Assembly concludes its inquiry and either confirms the authenticity of the gazetted text or takes corrective legislative action.

    Deferring implementation is not an indictment of reform. Rather, it is a safeguard for the reform. It protects taxpayers from uncertainty, preserves institutional credibility and ensures that when implementation begins, it rests on an unimpeachable legal foundation.

    Conclusion

    Nigeria’s tax reform agenda can only succeed if it is anchored firmly in constitutional legality. Where uncertainty exists as to whether a gazetted Act faithfully reflects what the legislature passed, that uncertainty must be resolved by the legislature, not managed by regulation or administrative explanation.

    No committee, however well intentioned, can substitute regulatory assurance for legislative certainty. The supremacy of the Constitution, the primacy of the National Assembly and the authority of an authentic Official Gazette are not obstacles to reform. They are the conditions that make reform lawful, credible and enduring.

     

  • Why Nigeria Cannot and Will Not Tax Your Bank Account – Eben Joels

    Why Nigeria Cannot and Will Not Tax Your Bank Account – Eben Joels

    There is a pervasive fear among Nigerians often fueled by aggressive headlines that the government is on the verge of peering into your bank account and arbitrarily debiting “unpaid taxes” based on your daily transaction alerts.

    The fear is understandable. The government is desperate for revenue. The recent passage of the Income Tax Act (ITA) 2025, a product of the current administration’s tax reform committee, was meant to modernize our archaic tax laws. Despite the fanfare, the new Act has failed to address the fundamental structural flaws in the old Personal Income Tax Act (PITA).

    Here is the cold, hard reality: The Nigerian government cannot and will not tax your bank account directly anytime soon. Here is why.

    The Wrong Taxman has the Data (Federal vs. State)

    The primary safeguard preventing Nigeria from taxing your personal bank account is Nigeria’s federal structure.

    Under the Nigerian constitution and retained by the ITA 2025, the Federal Government (via the FIRS or the newly proposed Nigeria Revenue Service) collects taxes from companies. The State Governments (via their State Internal Revenue Services) collect taxes from individuals.

    This creates a massive disconnect. The Federal Government has the data. Through the NIBSS and BVN frameworks, the Federal Government can theoretically track money flows.  However, the Federal Government cannot legally collect Personal Income Tax (PIT) from you unless you are a police officer, military personnel, or a diplomat. For the remaining 99% of the population, that right belongs to the state where you reside.

    The FIRS cannot simply hand over your banking data to 36 states because of complex data privacy and banking secrecy laws that remain largely unaddressed by the new Act. A simple fix such as enacting a nominal federal income tax (say 1%) would have significantly enabled the sharing of data between Federal and State Tax agencies. It could also be used as tool to transfer funds to the vulnerable rather than the current opaque method done via the Ministry of Humanitarian Affairs.

    The 35 Weak Links (State Internal Revenue Services)

    If you live in Lagos, you might have reason to be slightly worried. The Lagos State Internal Revenue Service (LIRS) is an outlier, technologically advanced and aggressive. But for the rest of the country? The system is broken.

    Aside from Lagos and perhaps the FCT, most State Internal Revenue Services (SIRS) are hollow institutions. They are often headed by political appointees; friends of the Governor with zero depth in tax administration or forensic accounting.

    These agencies lack the software to analyze bank statements even if they had them. They lack the political will to compel their wealthy residents to pay the right amount of tax because these wealthy individuals may very well be the sponsors of those holding the highest political positions.

    The State IRS rely almost exclusively on Pay-As-You-Earn (PAYE), where companies do the work for them by deducting taxes at the source. They lack the capacity to audit the millions of personal bank accounts within their domain. They are too weak to enforce collection on individuals who do not earn a salary.

    The “Secondee” Loophole

    The most glaring weakness of the ITA 2025 is that it was touted as a reform to capture the wealthy, yet it arguably makes it easier for the ultra-rich to slip away.

    A major flaw exists in the definition of taxable income regarding “Secondees”, expatriates or Nigerians seconded from foreign firms to work in Nigeria. The Act appears to completely exempt the income of a secondee if they can prove they are paying taxes in their “home country.”

    This is a massive oversight. It means a high-earning executive earning $20,000 a month in Nigeria can avoid paying any tax to the Nigerian state by presenting a tax receipt from a low-tax jurisdiction or their home country. While the average Nigerian employee has their tax deducted at source, the high-net-worth individual with complex global income sources is given a legal exit route. If the law cannot even capture the clearly defined income of a corporate executive, it certainly lacks the sophistication to scrutinize the murky inflows of a personal savings account.

    Bank Turnover ≠ Taxable Income

    Finally, there is a legal hurdle that the tax authorities have not cleared. A credit alert in your bank account is not proof of income. If your spouse transfers money to you for school fees, that is not income. If you sell a used car and the buyer transfers cash, that is a return of capital, not necessarily profit. If you receive a refund for a failed transaction, that is not income.

    For a tax authority to tax your bank account, it must first distinguish between revenue and income. This requires a level of forensic auditing that simply does not exist at the state level. They cannot simply apply a flat tax rate to your total credit alerts without facing lawsuits they would almost certainly lose in a working judiciary.

    Conclusion

    While ITA 2025 has rearranged the furniture, the house remains the same. As long as the collection of personal income tax is left to 36 disparate, under-resourced, and politically compromised State Boards, your bank account remains relatively safe.  And as long as every Nigerian does not pay personal income tax to the center, the current tax reforms from a personal income perspective are inchoate.

    The taxman may bark, but until the constitution is amended to centralize personal tax collection or until the States wake up and employ technocrats rather than politicians, he has no teeth to bite your savings.

    Eben Joels is the Managing Partner of Stransact Chartered Accountants, an audit, tax, and consulting firm in Nigeria. He is also a subject-matter expert in International Tax and Financial Reporting Standards and a licensed attorney.

  • Why Nigeria Cannot and Will Not Tax Your Bank Account

    Why Nigeria Cannot and Will Not Tax Your Bank Account

    There is a pervasive fear among Nigerians—often fueled by aggressive headlines—that the government is on the verge of peering into your bank account and arbitrarily debiting “unpaid taxes” based on your daily transaction alerts.

    The fear is understandable. The government is desperate for revenue. The recent passage of the Income Tax Act (ITA) 2025, a product of the current administration’s tax reform committee, was meant to modernize our archaic tax laws. Despite the fanfare, the new Act has failed to address the fundamental structural flaws in the old Personal Income Tax Act (PITA).

    Here is the cold, hard reality: The Nigerian government cannot—and will not—tax your bank account directly anytime soon. Here is why.

    The Wrong Taxman has the Data (Federal vs. State)

    The primary safeguard preventing Nigeria from taxing your personal bank account is Nigeria’s federal structure.

    Under the Nigerian constitution and retained by the ITA 2025, the Federal Government (via the FIRS or the newly proposed Nigeria Revenue Service) collects taxes from companies. The State Governments (via their State Internal Revenue Services) collect taxes from individuals.

    This creates a massive disconnect. The Federal Government has the data. Through the NIBSS and BVN frameworks, the Federal Government can theoretically track money flows.  However, the Federal Government cannot legally collect Personal Income Tax (PIT) from you unless you are a police officer, military personnel, or a diplomat. For the remaining 99% of the population, that right belongs to the state where you reside.

    The FIRS cannot simply hand over your banking data to 36 states because of complex data privacy and banking secrecy laws that remain largely unaddressed by the new Act. A simple fix such as enacting a nominal federal income tax (say 1%) would have significantly enabled the sharing of data between Federal and State Tax agencies. It could also be used as tool to transfer funds to the vulnerable rather than the current opaque method done via the Ministry of Humanitarian Affairs.

    The 35 Weak Links (State Internal Revenue Services)

    If you live in Lagos, you might have reason to be slightly worried. The Lagos State Internal Revenue Service (LIRS) is an outlier—technologically advanced and aggressive. But for the rest of the country? The system is broken.

    Aside from Lagos and perhaps the FCT, most State Internal Revenue Services (SIRS) are hollow institutions. They are often headed by political appointees—friends of the Governor with zero depth in tax administration or forensic accounting.

    These agencies lack the software to analyze bank statements even if they had them. They lack the political will to compel their wealthy residents to pay the right amount of tax because these wealthy individuals may very well be the sponsors of those holding the highest political positions.

    The State IRS rely almost exclusively on Pay-As-You-Earn (PAYE), where companies do the work for them by deducting taxes at the source. They lack the capacity to audit the millions of personal bank accounts within their domain. They are too weak to enforce collection on individuals who do not earn a salary.

    The “Secondee” Loophole

    The most glaring weakness of the ITA 2025 is that it was touted as a reform to capture the wealthy, yet it arguably makes it easier for the ultra-rich to slip away.

    A major flaw exists in the definition of taxable income regarding “Secondees”—expatriates or Nigerians seconded from foreign firms to work in Nigeria. The Act appears to completely exempt the income of a secondee if they can prove they are paying taxes in their “home country.”

    This is a massive oversight. It means a high-earning executive earning $20,000 a month in Nigeria can avoid paying any tax to the Nigerian state by presenting a tax receipt from a low-tax jurisdiction or their home country. While the average Nigerian employee has their tax deducted at source, the high-net-worth individual with complex global income sources is given a legal exit route. If the law cannot even capture the clearly defined income of a corporate executive, it certainly lacks the sophistication to scrutinize the murky inflows of a personal savings account.

    Bank Turnover ≠ Taxable Income

    Finally, there is a legal hurdle that the tax authorities have not cleared. A credit alert in your bank account is not proof of income. If your spouse transfers money to you for school fees, that is not income. If you sell a used car and the buyer transfers cash, that is a return of capital, not necessarily profit. If you receive a refund for a failed transaction, that is not income.

    For a tax authority to tax your bank account, it must first distinguish between revenue and income. This requires a level of forensic auditing that simply does not exist at the state level. They cannot simply apply a flat tax rate to your total credit alerts without facing lawsuits they would almost certainly lose in a working judiciary.

    Conclusion

    While ITA 2025 has rearranged the furniture, the house remains the same. As long as the collection of personal income tax is left to 36 disparate, under-resourced, and politically compromised State Boards, your bank account remains relatively safe.  And as long as every Nigerian does not pay personal income tax to the center, the current tax reforms from a personal income perspective are inchoate.

    The taxman may bark, but until the constitution is amended to centralize personal tax collection—or until the States wake up and employ technocrats rather than politicians—he has no teeth to bite your savings.

    Eben Joels is the Managing Partner of Stransact Chartered Accountants, an audit, tax, and consulting firm in Nigeria. He is also a subject-matter expert in International Tax and Financial Reporting Standards and a licensed attorney.

  • FRCN Requirements on Internal Control over Financial Reporting [ICFR]

    FRCN Requirements on Internal Control over Financial Reporting [ICFR]

    Over the past two decades, corporate scandals most notably Enron and global financial crises have driven major reforms in financial reporting. For Public Interest Entities (PIEs), this led to the adoption of stronger ICFR frameworks like COSO 2013 Internal Control: Integrated Framework, reinforcing the need for transparency, accountability, and stakeholder trust.

    In Nigeria, the Financial Reporting Council (FRC) requires all Public Interest Entities to implement and report on the effectiveness of their ICFR. With the mandate effective from financial years ending on or after 31 December 2024. 2025 marks the second year of mandatory compliance. PIEs are reminded to maintain and annually assess their ICFR, ensuring ongoing transparency, accountability, and independent assurance.

    Read more: Stransact makes World Tax list of Tier-1 firms in tax services

    What Is ICFR and Why Does It Matter?

    Internal Control over Financial Reporting (ICFR) refers to the processes and controls established by management to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements in accordance with applicable accounting standards.

    ICFR Core Objectives

    • Ensuring transactions are recorded accurately to support the preparation of financial statements.
    • Providing assurance that receipts and expenditures are made only with proper authorization.
    • Safeguarding assets against unauthorized use, loss, or disposition.

    While most organizations already maintain internal controls, what’s evolving is the benchmarking of these controls against globally recognized frameworks most notably, the COSO 2013 Internal Control – Integrated Framework.

    This shift enhances the effectiveness, consistency, and auditability of ICFR, ensuring that financial statements are not only accurate and complete but also compliant with international best practices.

    Read more: National Repository Portal and Financial Reporting Compliance: A Guide for Nigerian PIEs

    What does FRC expects from Public Interest Entities Management’s Responsibility

    Management is responsible for the design, implementation, and annual certification of ICFR effectiveness. As mandated by the Financial Reporting Council of Nigeria (FRCN), this responsibility cannot be delegated to external auditors to preserve their independence. While internal audit or independent consultants may support the process, only management must assess and certify ICFR annually.

    External Auditors’ Role

    External auditors are required to independently review management’s ICFR assessment and issue a separate attestation report, without compromising their independence. This may be conducted as part of an integrated audit, which includes:

    • A distinct ICFR audit (with its own fee), and
    • A financial statement audit informed by ICFR conclusions.

    Even if ICFR is ineffective, it doesn’t mean the financial statements are misstated but it may require more substantive testing and higher audit fees.

    Read more: Financial Reporting in Nigeria: The Critical Role of ICFR

    Call to Action

    • CEOs: Champion ICFR as a continuous, enterprise-wide Ensure it is adequately resourced and embedded into the organization’s governance and risk management framework not treated as a mere compliance checkbox.
    • CFOs: Lead continuous maintenance of ICFR and annual certification of ICFR. Ensure timely, evidence-based assessments and maintain clear documentation to support transparency and audit readiness.
    • External Auditors: Uphold independence by refraining from performing ICFR assessments. They should independently review and attest to management’s ICFR assessment as part of the integrated audit.

    Read more: Why IFRS 18 Should Be a Strategic Priority for CFOs and Financial Leaders

    Looking Ahead: Strengthening Trust Through Effective ICFR Implementation

    As Nigeria’s regulatory landscape continues to evolve, the successful implementation of Internal Control over Financial Reporting (ICFR) stands as a defining marker of corporate integrity and governance maturity. For Public Interest Entities, this is more than a compliance exercise; it is a commitment to building investor confidence, enhancing financial transparency, and reinforcing accountability across all levels of the organization.

    In 2025 and beyond, organizations that embed ICFR into their governance culture will not only stay compliant but also position themselves as trusted leaders in financial reporting excellence.

  • How the Nigeria Tax Act 2025 Empowers Individual Taxpayers

    How the Nigeria Tax Act 2025 Empowers Individual Taxpayers

    The Nigeria Tax Act (NTA) 2025 represents a landmark reform in the country’s fiscal landscape, particularly for individual taxpayers. Enacted to modernize and harmonize Nigeria’s tax framework, the Act introduces a suite of progressive measures aimed at enhancing equity, simplifying compliance, and delivering tangible reliefs to low and middle-income earners.

    This article explores the key provisions of the NTA 2025 that affect individuals, highlighting the opportunities, reliefs, and incentives embedded in the new law and what they mean for taxpayers, employers, and the broader economy.

    Read more: Stransact makes World Tax list of Tier-1 firms in tax services

    A New Era for Personal Taxation

    The NTA 2025 repeals and replaces the Personal Income Tax Act (PITA) 2011, addressing long-standing ambiguities and introducing a more transparent, inclusive, and equitable tax regime. The reforms are designed to align Nigeria’s tax system with global best practices while ensuring that taxation supports, rather than stifles, economic growth.

    Read more: Nigeria Tax Reform Act: What Businesses Need to Know

    Key Provisions of the NTA 2025 and their Implications

    1. Expanded Definition of Chargeable Income: The Act now explicitly lists items such as: Prizes, winnings, and honoraria, grants, awards, laurels, etc.; profits or gains from transactions in digital or virtual assets; disposal of money or money instruments; profits or gains from the disposal of property or fixed assets; and securities; discounts or rebates, etc., under the scope of taxable income.This eliminates previous ambiguities surrounding the tax treatment of income from emerging sectors and informal sources, thereby widening the tax net and enhancing government revenue without increasing tax rates for compliant taxpayers. It reflects the government’s policy objective of modernizing the tax base to capture new forms of wealth and align Nigeria’s tax framework with global best practices [NTA 2025, Section 4].
    1. Introduction of Rent Relief Deduction: Individual taxpayers can now claim 20% of their annual rent (up to a maximum of ₦500,000) as an Eligible Deduction, provided valid tenancy documentation is provided. This provision is particularly beneficial for salaried workers and urban dwellers, offering meaningful relief from housing-related expenses [NTA 2025, Section 30 (2) (vi)].
    1. Abolition of the Consolidated Relief Allowance (CRA): The CRA, previously a blanket deduction for all taxpayers, has been repealed. In its place, the Act introduces a more itemized and transparent system of deductions, encouraging accurate reporting and aligning tax reliefs with actual expenses incurred.
    1. Enhanced Compensation for Loss of Office: The tax-exempt threshold for compensation due to loss of office has now been increased from ₦10 million to ₦50 million (only the excess above this new threshold will constitute chargeable gains). This change provides greater financial protection for individuals facing job termination or workplace-related injuries [NTA 2025, Section 50 (1)].
    1. Revised Progressive Tax Bands: The Act introduces a new progressive tax structure, adjusting rates from the previous 7%–24% under PITA to 0%–25% under the NTA. This ensures that:
    • Low-income earners (earning the minimum wage and below /month) are exempt from income tax
    • Middle-income earners benefit from reduced tax burdens
    • High-income earners contribute a fairer share of their income towards national development
      [NTA Fourth schedule).
    1. Clarified Definitions for Key Tax Terms: To eliminate ambiguity and reduce disputes, the Act provides precise definitions for terms such as:
    • Non-Resident Individual (NRI); Interest; Dividend; Royalty
    • This clarity enhances legal certainty and simplifies compliance for both taxpayers and tax administrators [NTA 2025, Sections 7-8, 202].

    Other Notable Provisions and Compliance Implications

    Beyond the major reforms highlighted above, the Nigeria Tax Act 2025 introduces several additional measures that shape how individuals earn, report, and manage their tax obligations.

    • Taxation of Capital and Chargeable Gains: The Act consolidates the taxation of chargeable gains, bringing profits from the disposal of property, securities, or other assets directly within the personal income tax framework. This integration simplifies administration but also means that individuals must now evaluate the tax impact of every asset sale or transfer. Certain exemptions remain for personal residences and low-value personal assets.
    • Clarified Residence and Source Rules: Sections 7 – 8 establish clearer tests for determining whether an individual is resident in Nigeria and whether income is derived from Nigerian sources. These provisions are especially relevant for Nigerians earning from remote or cross-border work, digital businesses, or offshore investments. Proper documentation of residence and income source will be critical for compliance.
    • Broader Range of Allowable Deductions: In addition to the new rent relief, the NTA 2025 retains or clarifies deductions for pension contributions, National Housing Fund (NHF), and National Health Insurance Scheme (NHIS) contributions, as well as verified donations to approved charitable causes. These provisions reward documented savings and social contributions, encouraging a more structured financial culture.
    • Presumptive Taxation for Informal Income Earners: To improve inclusion and widen the tax net, the Act empowers the tax authorities to apply presumptive assessment frameworks for individuals or micro-enterprises with incomplete records. This ensures that self-employed and gig-economy earners contribute fairly, while still providing mechanisms for appeal and voluntary disclosure.
    • Digitalization and Enhanced Compliance Obligations: Complementing the NTA are reforms under the Nigeria Tax Administration Act 2025, which mandate electronic filing, use of Tax Identification Numbers (TINs), and stricter record-keeping for individuals. Taxpayers are therefore encouraged to adopt digital compliance tools and maintain proper documentation to avoid penalties.
    • Effective Date and Transition Arrangements: Most provisions of the NTA 2025 relating to individuals take effect from 1 January 2026, giving taxpayers time to understand the new framework and adjust their financial and payroll systems accordingly. Transitional guidelines are expected from the Federal Inland Revenue Service (FIRS) and relevant State Tax Authorities to aid smooth implementation.

    Read more: Why IFRS 18 Should Be a Strategic Priority for CFOs and Financial Leaders

    Beyond Compliance: A Pathway to Financial Empowerment

    The NTA 2025 is not merely a legislative update, it is a strategic tool for financial empowerment. By offering targeted reliefs and incentives, the Act encourages individuals to: Plan their finances more effectively, leverage available deductions and engage proactively with the tax system.

    For employers, the reforms necessitate a review of payroll systems, employee benefits, and vendor engagement processes to ensure full alignment with the new tax framework.

    Read more: Stransact expands horizon, unveils Deals and Advisory Services

    Looking Ahead: A More Inclusive Tax Culture

    The Nigeria Tax Act 2025 positions personal taxation as a catalyst for inclusive economic growth. By prioritizing fairness, transparency, and simplicity, it fosters a culture of voluntary compliance and trust in the tax system.

    Whether you are a salaried employee, entrepreneur, or investor, the new law offers a timely opportunity to reassess your financial strategy, maximize your tax benefits, and contribute meaningfully to national development.

  • How Telecom Operators, Fintech and Retail Brands Can Leverage MVNO Licenses in Nigeria

    How Telecom Operators, Fintech and Retail Brands Can Leverage MVNO Licenses in Nigeria

    In 2023, the Nigerian Communications Commission (NCC) introduced a structured licensing regime for Mobile Virtual Network Operators (MVNOs) to enhance competition and expand digital inclusion. According to BusinessDay (2025), the NCC issued 46 MVNO licenses across five tiers, representing one of the most ambitious frameworks in Africa. However, as of August 2025, only two operators: Vitel Wireless and EmoSIM have commenced commercial operations. This disparity between policy ambition and market activation prompts a critical evaluation of Nigeria’s progress in telecom liberalization.

    Understanding Mobile Virtual Network Operators

    MVNOs deliver mobile services without owning radio access networks or spectrum. Instead, they lease capacity from incumbent Mobile Network Operators (MNOs) and differentiate through customer segmentation, pricing models, bundled offerings, user experience, and distribution strategies. Globally, MVNOs have demonstrated effectiveness in:

    • Stimulating innovation through niche offerings tailored to students, rural users, SMEs, travelers, and fintech-oriented customers.
    • Enhancing affordability by exerting downward pressure on retail prices and enabling targeted bundles.
    • Deepening market segmentation through localized content and flexible service plans.

    Nigeria’s Licensing Framework: A Step Forward

    The NCC’s five-tier licensing model represents a significant advancement in liberalizing the telecommunications sector. It accommodates varying degrees of operational independence, ranging from basic resellers to full-service providers with core network capabilities. This flexible structure is designed to attract a diverse array of market participants, including startups and established technology firms.

    Furthermore, the framework aligns with Nigeria’s National Broadband Plan and Digital Economy Strategy, which aim to increase broadband penetration and bridge the digital divide. In principle, MVNOs are well-positioned to extend connectivity to underserved regions and reduce data costs. The licensing tiers include:

    • Tier 1 (Reseller MVNOs): Focus on branding, distribution, and customer service, relying entirely on MNOs for network operations.
    • Tier 2 (Service Provider MVNOs): Manage customer care, billing, and select value-added services.
    • Tier 3 (Core MVNOs): Operate critical network elements such as the Home Location Register (HLR) and Home Subscriber Server (HSS), while leasing radio access.
    • Tier 4 (Aggregator/Enabler MVNOs): Aggregate network capacity and wholesale it to smaller MVNOs, reducing the need for direct MNO agreements.
    • Tier 5 (Full MVNOs): Function nearly as MNOs, operating core networks while leasing spectrum and radio access.

    Read more: International Tax Review (ITR) Ranks Stransact Chartered Accountants Among Tier-1 Firms

    The Execution Gap

    Despite a robust framework, market activation has been limited. BusinessDay (2025) reports that only Vitel Wireless and EmoSIM have launched commercially, out of the 46 licensed MVNOs. Several challenges have impeded progress:

    • Infrastructure Bottlenecks: MVNOs depend on MNOs for network access, and negotiations over pricing and service-level agreements have proven complex.
    • Market Readiness: Many MVNOs lack the technical and financial capacity to scale operations. The Nigerian market remains price-sensitive and dominated by a few major MNOs.
    • Regulatory Ambiguity: While the NCC has issued a licensing framework, there is limited clarity regarding enforcement mechanisms, dispute resolution, and consumer protection specific to MVNOs.

    Untapped Potential

    Nigeria continues to present substantial growth opportunities. Mobile internet adoption remains low, and millions of citizens are underserved or offline. MVNOs can address this gap by offering:

    • Localized propositions, including language-specific content and regionally tailored pricing models.
    • Flexible commercial models such as family wallets, shared data plans, and SME-focused bundles.
    • Embedded connectivity for fintech, edtech, and health tech applications, bundling data with essential services.

    According to Grand View Research (2025), the global MVNO market is projected to reach USD 137.31 billion by 2030, growing at a CAGR of 7.7%. Nigeria possesses the demographic and digital appetite to capture a meaningful share of this market, provided enabling conditions are established.

    Read more: Why IFRS 18 Should Be a Strategic Priority for CFOs and Financial Leaders

    Strategic Imperatives

    To realize the full potential of MVNOs, several strategic interventions are necessary:

    • Infrastructure Sharing Mandates: The NCC should enforce equitable access terms between MNOs and MVNOs to prevent anti-competitive practices.
    • Capacity Building: Technical and financial support for MVNO startups is essential to bridge the execution gap.
    • Consumer Awareness: Public education initiatives can enhance understanding of MVNO offerings and their value proposition.
    • Policy Integration: MVNO strategy should be harmonized with broader digital economy initiatives, including rural broadband expansion and financial inclusion.

    Read more: From Traditional to Digital: How Financial Services Can Thrive in the Era of Fintech

    Conclusion

    MVNO licensing in Nigeria is a commendable initiative with transformative potential. However, without effective execution, it risks becoming a missed opportunity. The regulatory framework is in place, market demand is evident, and digital inclusion remains a national priority. A coordinated effort by regulators, operators, and innovators is imperative to translate policy into tangible progress.