A Guide for Financial Institutions and Crypto-Risk Mitigation in Nigeria: From Blanket Prohibition and Stereotypical Discrimination to Proper and Compliant Risk-Based Control

Introduction

Whenever blanket prohibitions are made by financial institutions (FIs)—whether based on common stereotypes, fiat directives, or risk speculations over crypto-related transactions—there is serious cause for concern. Given the sanctity of the bank-customer relationship, the constitutional underpinnings of property rights, and the essential role of banking and financial services in modern life, it is reasonable to expect that restricting access to these services should be a carefully considered decision, grounded in robust, specific financial crime intelligence. Where otherwise, the result is often that yet another bank customer goes down. Cumulatively, economic activities gradually slow down with frozen bank accounts climbing up increasingly. The good, bad, and the ugly are consequently lumped together as suspects. As a result, senior executives and staff—including CEOs, COOs, CFOs, and CCOs—are compelled to divert significant time and attention away from core business operations to address investigations and other measures initiated by law enforcement agencies (LEAs), often at considerable cost to organizational productivity and focus.

FIs are not LEAs, and should not be. FIs’ mandate is to maximize risk management and mitigation, and support LEAs to do their jobs—kill unmanaged, unmitigated, and unleashed risks in the system. FIs do not kill; they mitigate. FIs apply compliance by implementing controls, monitoring and reporting risks, assessing risks, and cooperating with and supporting LEAs and regulators. On the other hand, LEAs apply the force of law, investigating crimes, gathering evidence, apprehending suspects, prosecuting offenders, recovering assets, and enforcing criminal laws. When FIs literally become LEAs, compliance is not done right. Things go wrong. And the trust deficit enlarges.

How do FIs do it right?

The major challenge with FIs is balancing the CBN’s mandate to facilitate legitimate transactions with their primary duty to maintain financial integrity by minimizing, managing, and mitigating risks, not necessarily removing them completely. It is when FIs have evidently failed in doing so based on inexistent or weak regulatory compliance that LEAs come in, to remove the risk from the system. Understandably, LEAs are not (inherently) trained to minimize, manage, or mitigate risks. By both design and instinct, LEAs kill risks. FIs should avoid assuming a law-enforcement role with their customers. It is simply not an FI’s job to do so—this is not within their mandate or expertise. In a jurisdiction where the rule of law is paramount, FIs that overstep their authority risk facing legal consequences, including lawsuits and damages, for breaching customer rights and privacy.

So essentially, how can FIs address the specific concerns of crypto-related transactions risks associated with a crypto trader or dealer within the framework of the CBN 2023 ‘Guidelines on the Onboarding of Virtual Asset Service Providers (VASPs)’and AML/CFT best practices? Leveraging my experience and expertise in the legal and compliance field, particularly in the financial services industry, below is how I believe FIs can address their concerns within the framework of the CBN 2023 Guidelines, shifting from blanket prohibition to risk-based control.

Following this guidance, FIs will hopefully permit individuals and entities conducting crypto-related transactions using their own bank accounts for personal and business purposes, without fear of criminalization or discrimination. These individuals and entities, as consumers rather than VASPs, should be able to transact lawfully and without undue restriction. FIs’ primary compliance role is to mitigate risks, not deny access to banking and financial services. Any denial of service must be accountable, cautious, and responsible, grounded in robust risk assessment and compliance frameworks. A safe and sound financial system is only truly secure when underpinned by the rule of law, ensuring all stakeholders—users, service providers, law enforcers, regulators, and government—operate securely and with confidence.

FI Risk Mitigation

The core problem many FIs have identified in transactions carried out by customers involved in peer-to-peer (P2P) crypto is the lack of visibility into the crypto leg of the P2P transaction, which is compounded when a customer hides their trading status.

To read more, this guide is available here for download.