Crypto Custody Requirements in Africa 2026: Nigeria, Kenya and South Africa Compared

Last reviewed: 30 September 2026. Next review: after Nigeria finalises its rules or Kenya’s 4 November deadline.

Short answer: African regulators now treat custody as a licensed activity with technical rules. Nigeria has proposed the strictest controls: 80% cold storage, legal segregation and 24-hour reporting of discrepancies. Kenya licenses custodial wallet providers through CBK. South Africa covers custody inside its CASP licence.

Key takeaways

• Nigeria’s SEC proposes that custodians keep at least 80% of client assets in cold storage. It is a proposal, not law.
• Nigeria’s draft names multi-party computation (MPC) as a permitted key technology. It must meet recognised standards, such as FIPS 140-3 or ISO/IEC 19790.
• Kenya requires KSh150 million in capital for custodial wallets, with a 4 November 2026 deadline for existing operators.
• Custody rules now include segregation, key management, reconciliation and incident reporting.

Custody used to be a technical choice. It is now a compliance test. Nigeria’s SEC published draft rules on 20 August 2026. Kenya’s Regulations took effect on 22nd July 2026. This guide compares what each regulator expects and what it means for wallet design.

What counts as crypto custody under African VASP rules?

Regulators treat a business as a custodian when it holds or controls client assets. Kenya licenses custodial wallets because they involve safeguarding and control of customer assets. Software providers can fall outside the rules, but the exemption depends on actual functionality, not the label used. Nigeria’s draft defines custody as holding, controlling, or being able to access or transfer assets or private keys for another person. Kenya treats a wallet as custodial when a third party holds and manages the private keys. A provider that can access or move client assets may fall inside the rules, even if it calls its service non-custodial. Get local legal advice on your exact role.

Crypto custody requirements compared: Nigeria, Kenya and South Africa

Nigeria custody rules: what the SEC proposed in August 2026

Digital asset custodians need ₦2 billion in minimum capital. The SEC set this figure in Circular No. 26-1 of 16 January 2026. The proposed rules repeat it.. Firms have until 30 June 2027 to comply.

On 17 July 2026, an Executive Order gave the CBN oversight of payment, settlement and custody services for non-security virtual assets. The SEC keeps securities-type assets. A custodian should confirm which regulator applies to each asset it holds. The Virtual Asset Council had 30 days to issue a harmonised framework.

The 20 August 2026 proposal adds technical controls:

• Cold storage: at least 80% of client assets, unless the SEC prescribes another percentage. Hot and warm wallets hold only what withdrawals, settlement and operations need, under documented wallet limits. Above a set threshold, custodians must give periodic proof of reserves.
• Segregation: custodians must legally separate client assets from their own and from affiliates’ assets. They must keep separate wallets per client, or an equivalent ledger. Client assets must also be protected from the custodian’s creditors and insolvency proceedings.
• No reuse of client assets: no proprietary trading, lending, pledging or rehypothecation without disclosure, separate client consent and SEC permission.
• Reconciliation and incidents: discrepancies go to the SEC within 24 hours. Incident notice is due within 24 hours, with a detailed report within 48 hours.
• Key management: no single person can approve a material transaction. Multi-signature or equivalent controls apply. The draft names hardware security modules, secure enclaves, multi-party computation (MPC) and multi-signature as permitted technologies. They must meet recognised standards, such as FIPS 140-3, ISO/IEC 19790 or Common Criteria. Keys must stay under the custodian’s control, and the SEC must be able to audit them. Key backups must sit apart from signing systems. The SEC may require key management and recovery arrangements inside Nigeria.
• Insurance and fees: insurance or a fidelity bond as the SEC prescribes (reported at a quarter of paid-up capital),, and a ₦30 million registration fee.
• Local presence: local incorporation unless the SEC grants an exception. A registered office in Nigeria and a Nigeria-resident chief executive are also required.
• Separate entity: a custodian must be a separate legal entity from group members that offer non-custody services. It may not combine custody with trading, exchange, lending or staking unless the SEC approves.
• Audit: an independent audit of custody systems at least once a year, by an expert the SEC recognises.
• Regulator access: the SEC may require API access to wallet and custody data. Firms must tag or separate domestic and cross-border flows so they are traceable.
• Bridges: a custodian may support cross-chain transfers only with safeguards the SEC accepts.

For scale, Japan already requires at least 95% of customer assets to stay offline. The proposal is not yet law and could change.

Kenya custodial wallet licence: CBK requirements

The VASP Act 2025 commenced on 4 November 2025. The Regulations were gazetted on 22nd July 2026 as a Legal Notice No. 134. Custodial wallets need KSh150 million in capital. Liquid capital must be at least KSh30 million, or 100% of current liabilities for 30 days if higher. A firm with several licences holds the highest capital plus 50% of each extra category.

Custody controls include:

• Client assets must be held separately from the VASP’s own funds. In a voluntary liquidation, customers are paid before other creditors.
• Licensees must file an independent information system audit. It includes vulnerability assessment and penetration testing.
• Regulators expect recognised custody and security standards, regular penetration testing and incident reporting.
• Boards need three directors, one-third independent, and a compliance officer with direct board access. The chief executive must be domiciled in Kenya.

Existing operators have until 4 November 2026 to comply. After that date, operating without a licence is a criminal offence. The sources reviewed set no numeric cold-storage ratio for Kenya.

South Africa crypto custody regulation: custody inside the CASP licence

South Africa declared crypto assets a financial product under FAIS in 2022, which placed providers under FSCA licensing. The FSCA had approved 300 of 512 CASP applications as at 12 December 2025. The Travel Rule applies through FIC Directive 9.The Travel Rule applies through FIC Directive 9, in force since 30 April 2025. The draft cross-border manual of 3 August 2026 would also restrict some transfers to and from self-hosted wallets.. No numeric cold-storage ratio was found in the sources reviewed for this guide.

What custody regulators are converging on

1. Segregation and attribution. Every client asset must be traceable to its owner.
2. A hot and cold wallet policy. Nigeria is the first of these three markets to propose a numeric ratio.
3. No single point of failure in key management.
4. Reconciliation and fast incident reporting.
5. Independent testing and audit.
6. Outsourcing control. Nigeria’s rules require custodians to control outsourcing risk. Buying wallet infrastructure does not transfer the duty. The board stays accountable, and the SEC must keep access to outsourced systems and records. 

What 80% cold storage means for payment and OTC firms

This section is design analysis, not regulatory text. A firm that settles many transfers a day cannot send each one through offline signing. The workable model keeps a capped hot wallet. Policy rules refill it from cold storage. Approvals tighten as amounts rise. Every step leaves an audit trail. Design for the ratio and the throughput together. Plan for documented wallet limits, monitoring and proof of reserves on the hot and warm portion.

Build or buy: questions to ask a wallet infrastructure provider

• Can it hold separate wallets or ledgers per client?
• Can it enforce hot wallet caps and automatic refills?
• Does key management remove single points of failure?
• Can approval rules vary by amount, asset and destination?
• Does it produce audit trails a regulator can read?
• Does it integrate Travel Rule and transaction screening tools?
• Can it support local data residency, local key-recovery arrangements and regulator access if asked?
• Who carries responsibility when something fails?

How Liminal supports custody compliance in Africa

Liminal provides institutional custody and wallet infrastructure built on MPC and multi-signature technology. Liminal Firewall enforces approval requirements, transfer limits and risk-based rules before signing. Integrations include Notabene for Travel Rule and TRM Labs for transaction screening.

Infrastructure does not replace a licence. Each business keeps its own legal, reporting and compliance duties in every market. Under Nigeria’s draft, a provider that can access or move client assets may itself need custodian registration.