The Imperative of Compliance

Legal compliance for a startup in Nigeria is not merely a formality; it is the bedrock for sustainable growth, investor readiness, and operational legitimacy. In Nigeria’s rapidly evolving business environment, driven by the Companies and Allied Matters Act (CAMA) 2020 and the Nigeria Data Protection Act (NDPA) 2023, non-compliance is a significant business risk. Failure to adhere to statutory requirements set by agencies like the Corporate Affairs Commission (CAC), the Federal Inland Revenue Service (FIRS), and sector-specific regulators can result in hefty fines, freezing of bank accounts, inability to access government contracts, and ultimately, the forced closure of the business.

A comprehensive legal compliance checklist, therefore, serves as a blueprint, guiding founders through the complex regulatory landscape. This explanation breaks down the essential legal and regulatory steps into five critical phases, ensuring a Nigerian startup builds a robust, rock-solid foundation from day one.

Business Structure and Registration

The first critical phase involves establishing the startup’s legal identity and formalizing its existence. The following steps must be followed to set up a company in Nigeria.

1. Choosing the Right Legal Structure

The choice of business entity dictates liability, tax obligations, and compliance. However, the most suitable entity for a business set up is a Limited Liability Company (LLC). It is a preferred structure for startups seeking external investment and significant scaling. It provides legal separation between the owners (shareholders) and the business, protecting personal assets from business liabilities.

2. Corporate Affairs Commission (CAC) Registration

The CAC is the sole regulator for company formation in Nigeria. The procedure for incorporation is as follows:

• Name Availability Search and Reservation: The chosen business name must be unique and reserved through the CAC portal.
• Incorporation and Document Filing: Submit the company’s Memorandum and Articles of Association (MEMART), details of the directors, shareholders, company secretary, and the share capital structure. The successful process culminates in the issuance of the Certificate of Incorporation.

3. Post-Incorporation Filings

The compliance duty does not end with incorporation. The following steps must immediately by followed after incorporation:

• Obtain Tax Identification Number (TIN): A TIN is usually auto-generated upon successful CAC registration but must be confirmed with the FIRS. It is mandatory for opening a corporate bank account and all tax-related transactions.
• CAC Annual Returns: Every registered company, regardless of its operational status, must file its annual returns with the CAC, starting 18 months after incorporation. Continuous failure to file can lead to the company being struck off the register and the directors incurring penalties.
• Special Control Unit against Money Laundering (SCUML) Registration: Mandatory for certain businesses, which are Designated Non-Financial Institutions (DNFI) such as consulting firms, real estate, and professional service providers.

Sector-Specific Licenses and Permits

General CAC registration is insufficient for operational compliance; specific industries are governed by powerful regulatory bodies whose licenses are mandatory. Some of the business sectors where companies require special licenses or permits to participate shall be discussed below.

1. Financial Services (Fintech)

The Central Bank of Nigeria (CBN) is the key regulator, often alongside the Securities and Exchange Commission (SEC) for capital market activities.

• Payment Service Provider (PSP) License: Required for services like payment gateways, mobile money operations, and payment terminal services. The type of PSP license (e.g., PTSP, PSSP, MMO) depends on the exact service offered and often requires a significant minimum share capital.
• Regulatory Sandbox: Innovative fintechs can apply for the CBN’s regulatory sandbox license to test new products in a controlled environment.
• Anti-Money Laundering (AML) and Know Your Customer (KYC): All financial service providers and Designated Non-Financial Institutions (DNFI) must implement robust AML/CFT (Combating the Financing of Terrorism) frameworks, conducting thorough due diligence on all customers.

2. Food, Health, and Manufacturing (FoodTech, HealthTech, FMCG)

• National Agency for Food and Drug Administration and Control (NAFDAC): Mandatory registration and product certification for all food, drugs, beverages, cosmetics, and medical devices. This process involves factory inspection, product testing, and adherence to labelling standards.
• Standards Organisation of Nigeria (SON): Provides certification (MANCAP) for locally manufactured products and SON Conformity Assessment Programme (SONCAP) for imported products to ensure quality and adherence to industrial standards.

3. State and Local Government Permits

Compliance is multi-tiered, involving federal, state, and local requirements.

• Business Premises Permit: An annual license required by state governments (e.g., the Lagos State Ministry of Commerce).
• Environmental Health Permit: Required by local government authorities to ensure compliance with basic hygiene, waste disposal, and environmental safety standards, particularly for businesses dealing with food or physical products.
• Signage and Advertisement Permit: Required from state agencies, such as the Lagos State Signage and Advertisement Agency (LASAA), for outdoor branding and marketing displays.

Tax and Fiscal Compliance

Nigeria operates under a dual tax system: the FIRS for federal taxes (e.g., Company Income Tax, VAT) and State Internal Revenue Services (SIRS) for state taxes (e.g., PAYE).

1. Federal Taxes (FIRS)

1. Company Income Tax (CIT): This tax is imposed on the profits of a company.
   • Small Companies: companies with an Annual Turnover of less than NGN 25 million) are exempted from CIT.
   • Medium Companies: companies with turnover between NGN 25m and NGN 100m- 20% CIT rate.
   • Large Companies: companies with turnover above 100m- 30% CIT rate.
   • Filing Deadline: Annual returns must be filed within six months after the company’s accounting year-end.
2. Value Added Tax (VAT): A consumption tax of 7.5% on the supply of most taxable goods and services.
   • Registration Threshold: Mandatory for businesses with a turnover of NGN 25 million and above.
   • Filing and Remittance: VAT returns must be filed and remitted monthly, no later than the 21st day of the month following the transaction.
3. Withholding Tax (WHT): An advance collection mechanism for CIT, deducted at source (5%-10%) on transactions like rent, interest, contracts, and dividends. WHT must be remitted to the FIRS by the 21st day of the month following the transaction.
4. Education Tax (EDT): Companies are required to pay a 2% tax on their assessable profits to fund the Tertiary Education Trust Fund (TETFund).

2. State Taxes (SIRS)

• Pay-As-You-Earn (PAYE) Tax: Employers are mandated to deduct Personal Income Tax (PIT) from employees’ salaries and remit it to the SIRS of the state where the employee resides (e.g., Lagos Internal Revenue Service – LIRS). The deadline is typically the 10th day of the following month.
• Annual PAYE Returns: Employers must file an annual return on all salaries paid in the preceding year, typically by January 31st.

3. Financial Record Keeping

Accurate and comprehensive financial records must be maintained for a statutory period of at least three years. This is crucial for obtaining a Tax Clearance Certificate (TCC), a document mandatory for most contracts and regulatory compliance.

Employment and Labour Compliance

As a startup begins to hire, it must comply with Nigerian labour law, a critical area for operational integrity. The following labour law must be strictly complied with:

• Employment Contracts and Policy: Every employee must have a clear, written employment contract detailing terms, conditions, remuneration, and termination clauses. An Employee Handbook is essential for establishing workplace rules, disciplinary procedures, and adherence to fundamental labour rights.
• Statutory Deductions and Contributions: A company must make the following deductions/contributions:
  • Pension Fund: Mandatory contribution for employers with at least three employees, with the employer contributing a minimum of 10% and the employee 8% of the emoluments. Remitted to a Pension Fund Administrator (PFA) under the National Pension Commission (PenCom) monthly.
  • Nigeria Social Insurance Trust Fund (NSITF): Employers must contribute 1% of the employee’s total emoluments to fund the Employee Compensation Scheme (ECS), which covers occupational accidents and diseases.
  • National Housing Fund (NHF): Mandatory contribution of 2.5% of a Nigerian employee’s monthly basic salary for those earning above the national minimum wage. This is now optional for a private company.
• Health, Safety, and Environment (HSE): Compliance with the Factories Act and other state/federal HSE regulations is required to ensure a safe and healthy work environment.

Data Protection and Intellectual Property (IP)

In the digital economy, protecting customer data and proprietary assets is a major compliance obligation. Consequently, a start-up must comply with the following laws and regulations regarding data and intellectual property protection.

1. Nigeria Data Protection Act (NDPA) 2023

The NDPA establishes a legal framework for data processing and is enforced by the Nigeria Data Protection Commission (NDPC). Companies must ensure the following:

• Data Controller/Processor Registration: Businesses that process the personal data of a minimum number of data subjects (e.g., 200 within a six-month period, as per previous guidance) are deemed “of major importance” and must register with the NDPC.
• Data Audit: Businesses must conduct an annual data audit in compliance with the provisions of the NDPA 2023 to identify and rectify any gaps.
• Privacy Policy: A clear, accessible privacy policy must be published, detailing what data is collected, the purpose of collection, and how it is protected.
• Lawful Basis for Processing: Personal data can only be processed if there is a lawful basis, such as the data subject’s explicit consent or a legitimate interest. Consent must be freely given, specific, informed, and unambiguous.
• Data Security and Breach Notification: The Act mandates the implementation of technical and organizational safeguards to prevent data breaches. In the event of a breach, the NDPC and affected data subjects must be notified within a specified timeframe (e.g., 72 hours).

2. Intellectual Property Protection

• Trademark Registration: Protects the brand name, logo, and slogan from unauthorized use. Registration is done through the Nigerian Trademarks, Patents and Designs Registry.
• Patent Registration: Protects new inventions (products or processes) that are novel, non-obvious, and industrially applicable. The registration is also done through the Nigerian Trademarks, Patents and Designs Registry.
• Copyright: Automatically protects literary and artistic works (e.g., software code, website content) upon creation, but formal registration with the Nigerian Copyright Commission (NCC) provides stronger evidence in litigation.

Conclusion

The legal compliance checklist for a Nigerian startup is extensive, covering corporate governance, fiscal obligations, labour relations, and digital privacy. Navigating this labyrinth successfully requires a proactive and diligent approach. By systematically addressing the requirements of the CAC, FIRS, SIRS, NDPC, and sector-specific regulators, a startup not only avoids severe penalties but, more importantly, de-risks the business. This legal diligence is the essential prerequisite for building the institutional trust required to attract sophisticated talent, secure significant investment, and ensure long-term, sustainable operation in Nigeria’s vibrant but heavily regulated business ecosystem. Consulting a lawyer specialising in startup law is the best investment a founder can make to ensure full adherence to these multifaceted statutory mandates.

Written by Omolade Animashaun, Esq.

Omolade Animashaun is a results-driven legal practitioner at Resolution Law Firm, recognized for delivering clear, practical, and timely legal solutions. She has experience in corporate and commercial law, advising clients on regulatory compliance, business structuring, and transactional matters. Her ability to provide precise legal guidance and her strong attention to detail make her a dependable resource for clients.

She also possesses extensive knowledge of family law, handling sensitive matters with professionalism and care. In addition, Omolade is experienced in dispute resolution, where she offers strategic insight to achieve efficient outcomes. With a client-focused approach and a commitment to excellence, she consistently provides tailored legal support and remains a valuable member of the firm’s team.