A single figure in the Securities and Exchange Commission’s (SEC) latest draft, Proposed Rules on Digital and Virtual Asset Operations, Custody and Markets, has generated more anxiety in Nigeria’s crypto ecosystem than the accompanying billion-naira capital requirements: 80%.

Under the proposal, Virtual Asset Service Providers (VASPs) would be required to keep that share of client digital assets offline in cold storage at all times. Only assets needed for near-term withdrawals, settlements or transaction processing could remain in hot or warm wallets. Those wallets would also be subject to new requirements covering limits, monitoring, reconciliation and multi-party key controls.

The SEC’s approach reflects a familiar risk-management argument. Nigeria has watched the collapse of FTX and a series of exchange hacks unfold, while assets kept offline are generally more difficult to steal and may be easier to trace or freeze when regulators intervene. However, the proposal would apply to a market with less infrastructure and liquidity than the jurisdictions from which the SEC appears to be drawing comparisons.

Nigeria is not the first country to impose a cold-storage requirement. Japan’s crypto custody rules require at least 95% of customer assets to be held offline, making the SEC’s proposed 80% threshold appear comparatively moderate. The difference is the broader financial burden that would accompany the Nigerian rule.

The proposal would introduce a minimum capital base of ₦2 billion, roughly $1.5 million, for Digital Asset Exchanges and Custodians. It would also impose a separate ₦30 million registration fee and require a fidelity insurance bond covering at least one-quarter of the paid-up capital.

Digital Asset Platforms, Digital Asset Offering Platforms and Real World Asset Tokenisation Offering Platforms would need ₦500 million in capital and would pay the same ₦30 million registration fee. The broader Virtual Asset Service Provider category would require ₦200 million in capital and a ₦15 million registration fee.

Taken together, a ₦2 billion capital floor, a ₦500 million insurance bond and an 80% custody requirement would create substantial costs before a single Nigerian user traded Bitcoin through a licensed platform.

An underdeveloped hardware supply chain

The policy also raises questions about the supply of custody hardware. Cold storage at scale generally relies on hardware wallets, air-gapped devices or comparable offline infrastructure, much of which is manufactured outside Africa.

Several hardware-wallet manufacturers have largely avoided African markets, including Nigeria, because of customs duties and concerns about maintaining control over last-mile delivery. The scale of the supply gap was highlighted by Singapore-based manufacturer Cypherock, which told TechCabal in December 2025 that it had sold approximately 15,000 wallets worldwide but only about 200 across Africa.

That figure represents a very limited supply base for a serious custody industry. One possible effect of the SEC’s proposal, however, is that regulatory demand could encourage manufacturers to enter markets they would otherwise overlook. It could also accelerate the development of locally built custody systems, including internal multi-signature arrangements and equivalent ledgering systems that do not depend entirely on imported devices.

A related headline from TechNext24 stated: “SiBAN President says SEC’s new guidelines, NRS’s tax policy could kill indigenous crypto startups.”

The response from operators has broadly divided into two camps. Large and mid-sized local exchanges have described the tougher capital and custody requirements as evidence that the regulator is taking risk and market integrity more seriously. They have also pledged to continue negotiating for rules that are fair and proportionate to companies of their size.

Smaller operators and some blockchain-services executives have expressed stronger opposition. They argue that combining a ₦2 billion capital requirement with an 80% custody lockup could price Nigeria out of its own market and make it one of the most expensive jurisdictions in which to obtain a crypto licence. Related coverage has also examined whether a ₦30 million SEC crypto fee could push startups out and reported on reactions from SiBAN to Nigeria’s proposed crypto rules.

Cold storage does not eliminate custody risk

The SEC’s custody framework is based on the premise that offline storage is safer. But an incident involving Coldcard, a Bitcoin-only hardware wallet made by Toronto-based Coinkite and long marketed as one of the more trusted cold-storage products, showed that offline custody can create other vulnerabilities.

Coldcard was affected by a firmware flaw that allowed attackers to reconstruct users’ wallet seed phrases without physically accessing the devices. The root cause was traced to a March 2021 firmware update that weakened the way the device generated randomness for keys. As a result, some seeds could be brute-forced using information as ordinary as a device serial number.

Across four waves of attacks that began on 30 July 2026, hackers drained approximately 1,800 BTC, worth more than $116 million, from over 5,200 addresses. The incident ranked among the year’s largest crypto hacks.

The episode did not show that cold storage is worthless. Instead, it demonstrated that offline custody can shift rather than eliminate risk. Exposure moves from live network attacks to firmware integrity, supply-chain trust and key-generation processes that most users—and many exchanges—cannot independently audit.

A rule requiring 80% cold storage without also requiring rigorous, continuing firmware and entropy audits for the hardware used by Nigerian custodians could concentrate risk rather than reduce it. That concern is amplified by the region’s limited access to vetted and reputable hardware.

Liquidity and withdrawal concerns

The central operational question is not only whether holding 80% of assets in cold storage is safer than the current system. It is also whether Nigerian exchanges, many of which are still developing treasury operations, can retain enough assets in hot wallets to process withdrawals without delays.

Their customers often trade actively rather than hold assets for long periods. Cold-storage retrieval is not immediate, while multi-signature approvals and offline key ceremonies are deliberately time-consuming. An exchange that keeps too little in its hot-wallet buffer could face delayed withdrawals, potentially undermining customer trust.

The SEC has reserved the right to prescribe a different percentage. That provision indicates that the Commission may view 80% as an initial position open to negotiation rather than a final determination that the figure is optimal.

The proposal was published on 20 August 2026 and remained open for public comment until 3 September. The SEC’s notice did not specify a cutoff time zone, an omission that is notable for a rule with potentially significant consequences. The proposal is not yet law.

Digital assets had already been reclassified as securities under the Investment and Securities Act 2025, giving the Commission clear jurisdiction to finalise rules close to the draft, regardless of the strength of opposition.

The longer-term outcome remains uncertain. Nigeria could develop a smaller, better-capitalised crypto industry centred on a limited number of exchanges able to absorb the costs. Alternatively, compliant operators could follow the formal requirements while a much larger share of activity continues through peer-to-peer channels and offshore platforms beyond the SEC’s effective reach.

Cold storage protects assets held within the regulatory perimeter. It does not protect assets that never enter it.