Cryptocurrency platforms operating in Nigeria are facing increased expectations to demonstrate how they collect, store and protect customers’ personal and financial information.

These responsibilities have become more significant as crypto services expand beyond digital-asset trading into payment cards, business infrastructure, cross-border settlements and conversion into local currencies.

Under the Nigeria Data Protection Act 2023, organisations that process personal information must do so lawfully, fairly and transparently.

They must collect information for specified purposes, limit processing to what is necessary and implement appropriate technical and organisational measures to protect the data.

The General Application and Implementation Directive 2025 provides additional guidance on the implementation of the Act.

It requires organisations to develop internal data-protection policies, update agreements with third-party processors, conduct data-protection impact assessments where required and provide systems through which users can exercise their privacy rights.

The rules apply to businesses across sectors, including financial technology and cryptocurrency companies that collect identification documents, bank information and transaction records while conducting customer verification and processing payments.

Why crypto platforms handle sensitive customer information

Crypto platforms often collect personal and financial information to verify users, process transactions, prevent fraud and meet Know Your Customer and anti-money-laundering requirements.

This may include government-issued identification, biometric data, bank details, wallet addresses, transaction records, device information and location data. Because these records can expose both a person’s identity and financial activity, platforms must explain why the information is needed, restrict access to it and protect it from misuse.

Breet, operated by Inbreetic Technologies Limited, is one example of a crypto platform addressing these responsibilities through its privacy policies and internal controls.

“Crypto platforms are asking users to trust them with two sensitive things: their money and their identity,” said Olufunmilayo Tugbobo, Breet’s Head of Compliance.

Breet’s privacy policy states that the company relies on lawful grounds including consent, contractual necessity, legal obligations and legitimate interests when processing customer information.

It also says the platform uses measures such as encryption, multi-factor authentication, firewalls, restricted internal access, security audits and penetration testing.

“We minimize the information we collect and explain why it is required,” Tugbobo said.

“We also control who can access it internally and work with external providers under data-processing and confidentiality requirements.”

These measures are described in Breet’s public policies, although the scope and findings of its security audits and penetration tests have not been publicly disclosed.

PCI DSS compliance

PCI DSS sets security requirements for organisations that store, process or transmit payment-card data.

Breet displays a PCI DSS compliance badge on its website, while a Finbold analysis of crypto-to-fiat activity in Africa also identifies the company as PCI DSS compliant and registered with the Nigeria Data Protection Commission.

The standard relates specifically to systems handling payment-card data.

It does not cover every category of personal information a company may process, including identity documents, biometric information and broader transaction records.

“Our PCI DSS compliance applies established requirements to the systems handling payment-card data,” said Olufunmilayo Tugbobo, Breet’s Head of Compliance.

“We apply additional controls to the personal information used for customer verification and service delivery.”

Data protection, compliance and regulations

Data-protection professionals argue that privacy compliance should not be treated solely as a regulatory exercise or marketing claim.

Vanessa Obi, a data-protection consultant and legal expert, told Techpoint Africa that the central purpose of the rules was the protection of individuals.

“At the heart of these rules is the protection of people, their rights, their privacy, and their trust,” Obi said.

She added that companies whose products depend on user information should assess the privacy risks created by their services and take steps to manage them.

Obi said organisations could work with licensed data protection compliance organisations where they lacked the capacity to maintain a full internal data-protection team.

However, outsourcing compliance functions does not remove the organisation’s responsibility for how customer information is processed.

Enforcement increases compliance pressure

Nigeria’s data-protection requirements have already resulted in enforcement action within the financial-services sector.

In 2024, the Nigeria Data Protection Commission imposed a ₦555.8 million penalty on a traditional bank following an investigation into the processing of personal information during an account-opening process.

The bank disputed the regulator’s conclusions, maintained that it had not violated the law and said it was engaging the commission to resolve the matter.

Reuters reported that the penalty was equivalent to 0.1 per cent of the bank’s 2023 revenue.

The case illustrates the financial and reputational consequences that can arise when regulators determine that an organisation has failed to meet its data-processing obligations.

Tugbobo said clearer data-protection and financial regulations could contribute to public confidence in cryptocurrency services.

“For years, crypto in Nigeria operated in a grey area, and that discouraged some cautious users and investors,” she said.

“Clear rules create expectations around accountability. They also give users a better understanding of their rights and the responsibilities of the platforms they use.”

However, regulatory registration, published privacy policies and compliance badges do not eliminate all security and privacy risks.

Meaningful data protection also depends on how policies are implemented, how employees and service providers are supervised, whether security controls are tested regularly and how quickly an organisation responds when weaknesses or incidents are identified.

For crypto-payment platforms such as Breet, the handling of customer information will remain central to their relationship with users.

As the sector expands, the credibility of data-protection claims will increasingly depend on transparent policies, verifiable controls and continued compliance with evolving regulatory requirements.