Key takeaways from the CBC Blockchain Institute webinar | By the CBC Blockchain Institute | Category: Compliance | Webinar Recap
Africa now has crypto rules. Nigeria, Ghana and Kenya have all moved from consultation to regulation, and the question has changed from “what is crypto compliance?” to “are operators actually compliant?” On 10 November 2026, CBC Blockchain Institute brought together regulatory, legal and compliance practitioners from the US, Ghana, Nigeria and Kenya to answer it. The session ran close to two hours and left one clear message: the market is moving from guidance to enforcement.
Below is a recap of what the speakers covered, what regulators are looking for next, and what virtual asset service providers (VASPs) can do now.
The Big Shift: From “Show Me the Policy” to “Show Me the Data”
Supervisors are changing what they ask for. A written policy is no longer enough. They want evidence that controls work: records of travel rule messages sent and received, mismatches that were caught and resolved, and due diligence on counterparty VASPs.
This pressure is also coming from outside Africa. The Financial Action Task Force (FATF) launched a targeted review of jurisdictions with significant virtual asset sectors at its 28 to 30 October plenary, with results due in June and October 2027. Many countries have passed travel rule laws, but far fewer supervise them. The review will test that gap, and supervisors who are graded will push the pressure down onto firms.
Where the Rules Stand: A Quick Regional Guide
| Region | What speakers highlighted |
| Nigeria | The Central Bank of Nigeria (CBN) rules for non-security virtual assets took effect on 5 November 2026. Stablecoins need 100% reserves plus a 2% buffer, with next-business-day redemption at par. The travel rule applies and algorithmic stablecoins are out. Dollar stablecoins offered to Nigerians must come from a Nigerian-incorporated, CBN-licensed issuer, and existing operators have 180 days to apply. |
| Ghana | The Bank of Ghana is developing a stablecoin directive with SEC Ghana and the Financial Intelligence Centre. SEC Ghana expanded its sandbox from 11 to 20 firms and expects the first full licences between the end of 2026 and early 2027. |
| Kenya | The VASP Act took effect on 4 November 2025 with a one-year compliance window, and implementing regulations were gazetted on 22 July 2026. The Central Bank of Kenya covers stablecoin issuance and payment services, while the Capital Markets Authority covers exchanges, brokers, custodians and token offerings. |
| United States | The GENIUS Act for stablecoins takes effect on 18 January 2027. The Clarity Act market structure bill stalled in the Senate on 15 September by a single vote and moves to the new Congress that convenes on 3 January 2027. |
| European Union | MiCA’s grandfathering period closed EU-wide on 1 July 2026. Any firm serving EU clients without authorisation is in breach. |
Figures and dates are as stated by the speakers and have not been independently verified.
The practical point for African operators is that rules also reach you through your counterparties. US banks and MiCA-regulated EU firms apply their own standards to the firms they work with.
What the Speakers Said
Global rulebook: know which rules bind you
Prof. Tonya M. Evans, a global regulatory strategist and external expert reviewer for the CBN’s VASP regulations, urged operators to work out which rules bind them directly (home regulators and any market they target) and which reach them through counterparties. Her advice is to build one baseline that meets the strictest counterparty you want to serve, add local controls on top, write it down and name an owner. She also noted a US lesson from recent enforcement: a filing is a record, not permission.
Industry collaboration: raising the bar together
Kofi Genfi of CDABI Ghana said industry collaboration rests on standards, codes of conduct and continuous training. He stressed safe intelligence sharing, since scams and AI-enabled exploits repeat across firms, and secrecy after incidents creates a loop of repeated failure. His other warning was to check both sides of every transaction. In a recent case, hacked payment service provider funds were used to buy digital assets, and VASPs that had checked only the crypto side, with weak fiat-side KYC, were pulled in.
The basics many VASPs miss
Theophilus Oladipo, a country manager, MLRO and chief compliance officer at a digital asset exchange, described “paper compliance”: a template policy that is signed and never implemented. He listed the gaps he sees most often.
- No active risk assessment. Assess customer, geography, product and channel risk before building policies and controls.
- No independent testing. In one example, a pre-transaction screening control failed to flag known sanctioned addresses when it was finally tested.
- Partial travel rule implementation. Some firms receive messages but cannot send them, or have onboarded a provider without finishing the integration.
He also shared a maturity ladder, compressed from the IBM and ISACA five-stage model, that runs from initial or reactive (compliance driven by partner demands), through managed (policies, procedures and a controls register exist) to optimised (processes run without a single key person, and the firm scans the regulatory horizon).
Risks ahead for 2026 and 2027
Lorraine Massinde of Reap said the most dangerous risk may be the one not yet on the register. She pointed to three areas:
- Regulatory perimeter risk. The question has moved from “is crypto regulated here?” to which regulator has jurisdiction over the activity, and whether serving a customer creates a licensing nexus.
- Seams in the value chain. A single journey can involve a VASP, bank, issuer, payment processor, custodian and liquidity provider. Firms must be able to show who owns customer due diligence, transaction monitoring and travel rule obligations.
- Calendar-driven assessments. A new jurisdiction, product, counterparty or regulatory change should trigger a reassessment, not just the annual review.
Controls in live operations
Peter Akudike of Luno said the outlook for 2026 and 2027 is a move from clarity to enforcement, with more licensing regimes and discussion of capital requirements. Transaction monitoring must be real-time, alerts must be reviewed regularly, and suspicious, cash and foreign transaction reports must reach the Financial Intelligence Unit. Governance failures, he noted, have brought down many firms because they handle other people’s money.
Panel Highlights
How do supervisors test travel rule compliance? Passing firms can show records sent and received, mismatches resolved and counterparty due diligence. A useful self-test: if a supervisor asked for last month’s transfers, could you hand over proof? The rule follows the business rather than the chain, so it applies to every VASP on the path.
How do you make the case for compliance spending? Speak in commercial terms such as revenue retention and potential losses, propose a scalable plan rather than a huge upfront ask, benchmark what is necessary at your stage, and use real examples.
What should trigger an early risk assessment? Regulatory change, a new product or market, a new counterparty or material vendor, and data signals such as fraud spikes. Clients on the FATF grey list or from sanctioned jurisdictions are also triggers.
What happens in the first 48 hours after a control failure? Assess the impact first. If funds are actively being lost, block it, for example by limiting withdrawals. Then fix, monitor and report, and decide whether to notify the regulator. Report where customers, customer data or regulatory standing are affected.
How can competitors share fraud intelligence safely? Two models came up. One uses a regulator or FIU as a central umpire, so incidents are shared without naming the affected firm. The other is the Canadian model, where firms share privately and the regulator only oversees the initial agreements and sets guardrails. Speakers differed on which is better, because regulator-mediated sharing can be slow when value moves quickly.
Your Compliance Checklist
- Map your rules. List which rules bind you directly and which reach you through counterparties, including US banks and MiCA.
- Build one baseline to the strictest standard you serve, add local controls and name an owner.
- Run or refresh a documented risk assessment, with triggers for reassessment between annual reviews.
- Test your controls independently and keep evidence, especially travel rule records, mismatches and resolutions.
- Verify both sides of every transaction, including fiat and PSP sources of funds.
- Check your partners. Confirm EU partners are MiCA-authorised and that Nigerian stablecoin offerings meet CBN issuer rules.
- Fix one gap in 30 days. Pick a material gap, fix it, test it and share what you learned with peers.
- Prepare a scalable, commercially framed case for compliance investment.
- Document a 48-hour response plan for control failures, including when to notify the regulator.
Key Dates to Watch
| Date | Event |
| 5 November 2026 | CBN rules for non-security virtual assets take effect (180 days for existing operators to apply) |
| 3 January 2027 | New US Congress convenes |
| 18 January 2027 | GENIUS Act takes effect |
| 5 May 2027 (approx.) | End of the 180-day window for existing Nigerian operators, counting from 5 November 2026 |
| June and October 2027 | FATF targeted review results |
Why This Matters for Africa’s Talent Gap
Obinna Iwuno, CEO of CBC Blockchain Services, closed the session with two points. First, the cost of compliance tooling such as blockchain analytics is too high for many startups, so regulators and the industry need to address affordable tools suited to Africa. Second, there is an undersupply of qualified compliance professionals, and more than 90% of VASP compliance professionals come from the traditional sector. With Nigeria’s capital market already at T+1 settlement and a move to T+0 (atomic settlement) likely to rely on blockchain technology, compliance officers who get trained in crypto compliance now will be ahead of the change.
Build Your Crypto Compliance Skills with CBC Blockchain Institute
CBC Blockchain Institute trains institutions and professionals in compliance, governance and risk, blockchain technology, digital assets, digital finance, tokenization and real-world assets, and AI plus blockchain.
- Join the next cohort: [link to registration page]
- Join the crypto compliance professionals community: [link]
- Follow CBC on X, LinkedIn and Instagram: [links]
- Watch the recording and get the slides: [link, if available]
Frequently Asked Questions
Is crypto regulated in Africa? Increasingly, yes. Nigeria’s CBN rules for non-security virtual assets took effect on 5 November 2026, Kenya’s VASP Act has been in force since November 2025, and Ghana is moving towards its first full licences.
What is the travel rule in crypto? The travel rule requires VASPs to share information about the sender and recipient of a transfer with each other. Speakers said it applies to every VASP on the path of a transaction.
What will FATF review in 2027? A targeted review of jurisdictions with significant virtual asset sectors. It will test whether travel rule laws are actually supervised, with results due in June and October 2027.
Disclaimer
This article summarises views expressed by speakers at a CBC Blockchain Institute webinar and is for information only. It is not legal, compliance or financial advice. Dates, figures and regulatory details are as stated by the speakers and have not been independently verified, so confirm them with the relevant regulator before acting.
