• CBN’s second Regulatory Sandbox cohort is accepting applications until August 31.
• The programme has one track for virtual-asset and stablecoin financial services, and another for data-enabled financial services.
• Sandbox entry allows a controlled live test; it is not a permanent licence to operate beyond the approved test.
The Central Bank of Nigeria is opening a supervised room for fintech and crypto products. The most important word is still “testing.”
For a Nigerian founder, the hard part of a financial product often begins after the demo works. A wallet can send money. A stablecoin tool can settle a payment. A credit product can pull useful customer data. Then comes the uncomfortable question: can this product meet the standards required when real people, real money and real harm are involved?
CBN’s second Regulatory Sandbox cohort is built for that moment. It gives selected innovators a controlled environment to test a financial product or business model with live users under regulatory supervision. That can sound like a shortcut to market. It is not. It is a structured way to show that a product is ready to be questioned.
The official CBN sandbox portal says applications are open until August 31. It describes Cohort 2 as an environment for innovators, fintechs, financial institutions and technology providers whose products do not yet fit neatly inside existing rules but are sufficiently developed for controlled live testing.
Two tracks, two different kinds of problem
The first track is Virtual Asset & Stablecoin Financial Services. It is for digital-asset propositions with a payment, settlement or store-of-value function. The official portal specifically names stablecoin-related services, payment use cases, fiat on- and off-ramp arrangements, digital wallets, custody structures, token-based products, compliance technology and related market infrastructure.
That is a broad list, but it does not mean every crypto idea belongs in the room. A founder needs to show how the product is governed, how the technology works, how risk is managed and what happens when something goes wrong. The CBN says applications involving stablecoins, custody, wallets, token issuance or smart-contract-based arrangements should include relevant governance, technology, reserve, disclosure and risk-control documentation in the application questionnaire.
The second track is Data-Enabled Financial Services. This is the less headline-friendly half of the cohort, but it may touch ordinary users just as directly. It focuses on secure, permission-based data sharing and digital infrastructure that can improve access, efficiency, risk management and consumer outcomes. The CBN points to alternative-data credit assessment, lower onboarding or compliance costs, better trust and transparency, and stronger consumer control over financial data.
In plain English, this is the track for a product that wants to use financial data — but only with the right consent, safeguards and accountability. It is where open-banking-style ideas, account aggregation, payment initiation, fraud prevention and data-driven credit decisions become more than product slides.
Who can apply
The portal is wider than many founders may assume. It is open to CBN-licensed institutions, institutions licensed by other Nigerian financial regulators where the innovation intersects with the sandbox scope, recognised foreign-regulated firms whose products can be adapted to Nigeria, VASPs, and startups or technology companies that do not yet have financial licences.
That final group matters. A startup does not need to arrive as a fully licensed bank to be considered. But it cannot arrive with only an idea. The CBN requires applicants to show that the solution is innovative and ready for controlled live testing.
The application therefore turns the usual founder pitch inside out. A polished interface is not enough. The stronger application explains the product, the customer, the live-test plan, the risks and the controls. It should be able to answer what happens if a customer loses money, if a cyber incident occurs, if a transaction fails, if a data subject withdraws consent, or if a test reveals a weakness that needs to pause the product.
What “ready for testing” actually means
The official portal says all applicants must demonstrate that risks have been assessed and mitigated; that effective AML/CFT/CPF controls are in place; that consumer safeguards are appropriate; and that the team can meet reporting and incident-notification obligations during the sandbox period.
These are not decorative requirements. They are the reason the sandbox exists. Financial products become dangerous when founders learn about fraud, poor disclosure, unreliable systems or weak customer support only after operating at scale. A controlled test is meant to make those problems visible before the impact becomes wider.
Approved participants operate within boundaries. The CBN says tests can have limits on user categories, transaction volumes, customer exposure and duration. Material cyber incidents, fraud events or consumer harm must be reported promptly under sandbox requirements. That can feel restrictive to a startup trying to grow fast. It is also the difference between testing a new financial product and simply releasing one into the market and hoping it survives.
A sandbox is not a licence
This distinction needs to be repeated because it is the part most likely to get lost in a founder announcement. Admission into the sandbox does not amount to permanent licence or regulatory approval to operate outside the approved test parameters. It may help a company build evidence for a later pathway, but it does not erase the legal, prudential, conduct or supervisory requirements that still apply.
The CBN says information from the application and testing stages may be considered with other relevant authorities, including bodies involved in securities regulation, financial intelligence, tax administration, national security and data protection. For successful VASPs especially, sandbox outcomes can inform the right post-sandbox regulatory route, subject to compliance with all applicable conditions.
That makes the cohort useful for founders who are serious about building in a regulated market. It is less useful for a company looking for a badge it can put on a social post. The value is not only that a regulator notices the product. The value is that the product becomes harder to lie to itself about.
Why the non-crypto track may be the bigger everyday story
Stablecoins and wallets will attract attention because they are visible. But permission-based data sharing could have a wider daily effect if it is handled properly. A more reliable way to verify a customer, assess a credit application, detect fraud or start a payment can lower friction for people who currently repeat the same onboarding steps across multiple platforms.
The caveat is built into the opportunity. More data can make a financial service smoother; it can also make a customer more exposed if consent is vague or security is weak. That is why the CBN’s focus on consumer safeguards, transparency and data control matters as much as its invitation to innovate.
For Nigerian founders, the deadline is not merely a chance to test the newest app. It is a chance to prove that the app is useful enough, safe enough and accountable enough to deserve trust when the test ends.
Also read: Bitcoin nearly reached $73,000. What the rally means for Nigerian crypto startups
Also read: Six Nigerian startups got $521,700 from Stellar. What they are building beyond crypto hype
Should regulation slow a Nigerian founder down, or is it the proof that a financial product is ready to be trusted? Tell us below.
