Loan app licence in Nigeria: the FCCPC rules, the licence underneath and the cost

Is a loan app legal in Nigeria?

Yes, when the lender is licensed, approved and follows the rules. The FCCPC’s DEON regulations, in force since 21 July 2025, cover unsecured consumer loans made through digital, electronic, online or other non-traditional channels, including loans of airtime and data. They say a digital lender “must be duly registered and licensed by the Commission”.

Anyone can look a lender up on the FCCPC’s digital lending register. When we checked on 30 October 2026, it listed 525 approved lenders, 35 with conditional approval, 33 CBN-licensed lenders with waivers, 112 apps on a watchlist and 54 delisted apps. If your company isn’t approved, conditionally approved or waived, it shouldn’t be lending through an app.

Two recent events matter. The FCCPC’s 2025 guidelines repealed its 2022 interim framework, and lenders registered under that framework kept a “deemed licence” only until 30 June 2026. Then, in April 2026, a Federal High Court order paused enforcement in a case brought by the Wireless Application Service Providers Association of Nigeria. On 20 July 2026 the court dismissed the case and upheld the regulations, and the FCCPC resumed enforcement. Press reports say the association has appealed, so check the FCCPC’s site for the latest position.

The licence underneath: three routes

FCCPC approval isn’t a licence to lend on its own. The regulations ask for a copy of your licence from the “sector regulator” where one applies, and they describe lenders as businesses licensed by a sector regulator, a term that covers state and federal ministries and agencies. In practice, that means one of these:

If you’ll lend your own capital and won’t take deposits, a state money-lenders licence is the route to ask about first. Each state issues its own, so ask the ministry or board that handles money-lending in the state where your company is based for the current requirements and fee. One caution: the FCCPC regulations deliberately reach lending that crosses state lines, while a state licence comes from one state’s law. If your app will lend nationwide, ask a Nigerian lawyer whether one state’s licence is enough for your model.

CBN-licensed institutions sit largely outside the FCCPC regime. The guidelines exclude them, and microfinance banks apply to the FCCPC for a waiver while still filing the forms. Registered cooperative societies are excluded too. Before you plan around any capital figure, read the CBN’s current circulars and guidelines.

Planning to partner with a licensed lender instead? The regulations forbid partnerships for consumer lending unless the contract has been presented to the FCCPC and approved, and the two parties apply together.

FCCPC approval under the 2025 regulations

What you file

• Forms 001 and 002, plus Form 003 for a partnership, from the FCCPC’s register page.
• Proof you’ve paid the application fee, and a copy of your lending licence where one applies.
• Your CAC certificate, status report, and memorandum and articles.
• Profiles of directors and key managers, and a list of shareholders that shows who ultimately owns the company.
• Evidence you can fund the loans: audited accounts for up to three years, or proof of financing.
• Your loan contract and standard terms, terms of use, privacy policy and code of conduct.
• An Audit Trust mark from the NDPC, plus a compliance audit report and privacy impact assessment from a licensed data protection compliance organisation (DPCO). You can apply while these are being prepared.
• Every app you’ll use (five at most), proof you own each app’s code or hold a licence to use it, and evidence the apps meet ISO standards for mobile apps and information security.
• Your complaints process, evidence of tax payments, and a named person to receive official correspondence.

Form 001 also asks you to confirm that your apps aren’t designed to access customers’ call logs, contacts or photos, and never will. The regulations direct applications to lendersinterimregistration@fccpc.gov.ng; check the register page for any change before you send yours.

Fees and timelines

The regulations give the FCCPC 30 days from a complete application to decide, and let it extend that. An approval runs to 31 December of the third calendar year after it’s issued; renew it by the following 31 March, then every 36 months. The regulation calls the ₦500k an “annual levy” while describing a three-year cycle, so confirm with the FCCPC how often you’ll pay it. Report any change to your details within 14 days.

Starting small: the pilot route

The guidelines let a new lender ask the FCCPC for a “no-objection” to run a pilot: at most ₦1M lent in total, to no more than 100 customers, for 90 days, renewable once. You report monthly and apply for full approval at least 14 days before the pilot ends. It’s a sensible way to test a product before paying for a full launch.

Penalties

A breach can cost an individual up to ₦50M, and a company up to ₦100M or 1% of the previous year’s turnover, whichever is greater. Directors can be disqualified for up to five years, approval can be revoked, and the FCCPC can direct app stores to delist an app.

Step by step: from idea to a lawful launch

1. Define the product. Cash loans, salary advances, buy-now-pay-later or airtime and data credit; who funds them; the tenor, the pricing and how you’ll assess ability to repay.
2. Register the company with the CAC. The regulations require it for lenders based in Nigeria.
3. Get the licence underneath: a state money-lenders licence or a CBN licence.
4. Do the data protection work: name someone responsible, write the privacy policy, commission the DPCO audit and privacy impact assessment, and register with the NDPC.
5. Build the app to the rules: no contacts, photos or call logs; full cost shown before acceptance; opt-in only; a complaints channel.
6. Apply to the FCCPC with the forms, documents and ₦100k fee, then pay ₦1M when approved.
7. Publish from a Google Play organisation account, with the financial features declaration and your FCCPC approval letter.
8. Run it by the book: answer complaints on time, file your reports and renew on schedule.

Data protection: what the NDPA asks of a lender

A loan app holds some of the most sensitive data a person has: BVN, NIN, bank details, ID documents and phone numbers. That puts you under the Nigeria Data Protection Act 2023, enforced by the Nigeria Data Protection Commission (NDPC).

• Register if you’re “of major importance”. The NDPC’s guidance notice treats an organisation that processes the personal data of more than 200 people within six months as a data controller of major importance, and a lending app will pass that quickly. Depending on your tier, the NDPC’s implementation directive then has you file compliance audit returns each year or renew your registration each year; most organisations file by 31 March.
• Report breaches within 72 hours. If a breach is likely to put people’s rights at risk, the Act gives you 72 hours from learning of it to tell the NDPC.
• Know the penalty. For a data controller of major importance, the Act allows a penalty of up to ₦10M or 2% of annual gross revenue, whichever is greater.
• Collect less. Ask only for what the loan decision needs, encrypt BVN and NIN, limit which staff can see them, and keep a record of every consent.

Google Play and App Store rules

FCCPC approval won’t get you onto the stores by itself. Google Play’s financial services policy sets its own conditions, which we checked on 30 October 2026:

• Loan apps must be published from an organisation developer account, which needs a D-U-N-S number. Registration costs a one-off fee of US$25.
• Every developer completes the financial features declaration in Play Console. For Nigeria, digital lenders must also provide a verifiable approval letter from the FCCPC. Google’s page still names the FCCPC’s 2022 framework, which the 2025 guidelines replaced.
• The store listing must show the minimum and maximum repayment period, the maximum APR, and an example of a loan’s total cost.
• Google doesn’t allow personal loans that must be repaid in full within 60 days.
• Loan apps can’t request access to contacts, photos and other media, device storage, precise location, phone numbers or the list of installed apps.

Apple goes further. App Store guideline 3.2.2(ix) requires loan apps to disclose the maximum APR and the due date, caps APR at 36% including fees, and bans loans repaid in full within 60 days. If your pricing is above that, plan for Android and the web.

What the app itself must do

Consent you can prove

Loans must be opt-in: the regulations ban automatic or pre-authorised lending, so the customer asks for each loan. Explain each use of their data (identity checks, credit checks, marketing) on its own screen, ask for consent wherever consent is your legal basis, give an easy way to stop marketing messages, and log every consent with a time stamp.

The full cost before they accept

Interest, repayment terms and every fee must be disclosed in clear, simple English before the loan is taken, and the contract terms delivered straight away. In practice, the acceptance screen shows the amount received, every fee, the total to repay in naira, the due dates and the APR, and the customer gets the same summary by SMS or email.

No scraping, ever

Don’t request contacts, call logs, photos or files, not even “for verification”. The FCCPC form and Google’s policy rule it out, Apple forbids contacting people from a user’s contacts unless the user starts it, and the people in a borrower’s phone book never agreed to anything.

Credit checks, complaints and records

Assess whether each borrower can repay before you lend, and tell applicants when a request is declined or changed. Put a complaints channel in the app: the guidelines expect complaints resolved within 48 hours, or within 14 days with a written explanation for complex ones. A borrower can ask for a statement of their loan history, which you must provide within 24 hours. File biannual reports, quarterly complaint reports and annual returns by 31 March, and keep your records for five years.

Collecting without harassment

When the FCCPC announced the regulations, its statement said: “No consumer should be harassed, defamed, or lured into unsustainable debt under the guise of digital lending.” Messaging a borrower’s contacts or shaming them in public is exactly what the rules target.

Lawful collection looks ordinary:

• Reminders to the borrower only, before and on the due date, by SMS, email, in-app message or a call at a reasonable hour.
• Late fees that were in the contract and shown before acceptance, never added later.
• A restructuring option for borrowers who can’t pay, and a person they can talk to.
• Repayment data shared with recognised credit bureaus where the FCCPC or another regulator requires it.
• The courts for large debts, not threats.

If an outside agency collects for you and earns a share of what it recovers, the regulations reach it too, and your recovery methods belong in the agreements you file. Its conduct becomes your problem.

What it costs

There are three kinds of cost: regulatory fees, compliance work and the software. The biggest, the money you’ll lend, isn’t on this list at all.

Our build prices are on our pricing page. Projects are paid by milestone, usually 40–50% to start, and you own the code and accounts after the final payment. That ownership matters here, because the FCCPC asks for proof that you own your lending app or hold a licence to use it. For what pushes an app’s price up or down, see how much an app costs in Nigeria.

Mistakes that get loan apps shut down

• Launching first, registering later. Lending without approval exposes the company to fines of up to ₦100M or 1% of turnover, and the app to delisting.
• Asking for contacts “just for KYC”. Google bans the permission, and the FCCPC form makes you confirm you won’t use it.
• A 30-day product on Google Play. Full repayment within 60 days isn’t allowed there, whatever the FCCPC has approved.
• Fees the customer discovers later. Every charge must be shown before the loan is accepted, and terms can only change where the contract allows it.
• Running apps you didn’t declare. An undeclared app can cost you the approval, and the cap is five.
• A white-label app you don’t own. You need proof of ownership or a licence for the code, and a vendor who disappears takes your compliance with them.
• A partnership without FCCPC approval. Sharing revenue with a licensed lender still needs an approved agreement.

Where we fit

We build lending software. We hold no lending licence and we aren’t lawyers, so get a Nigerian lawyer for the licence and the FCCPC file. What we build is the part regulators and app stores look at: consent screens and logs, cost disclosure, minimal permissions, identity checks through licensed BVN and NIN providers, repayment schedules, audit trails and an admin dashboard.

We built Elite Creed, a vehicle-backed lending platform with online applications, identity checks, credit assessment and repayments. See our fintech and payments work, software development and mobile app development, or contact us. If you’re looking at airtime or data credit, which these regulations also cover, the plumbing is close to a VTU platform: see how to start a VTU business in Nigeria.

Frequently asked questions

General information, not legal advice. Rules change; check the current version with the FCCPC, the CBN, the NDPC and your state’s money-lending authority before you act.