Buried inside the Securities and Exchange Commission’s (SEC) latest draft, Proposed Rules on Digital and Virtual Asset Operations, Custody and Markets, is a single number that has set off more anxiety in the Nigerian crypto ecosystem than the accompanying billion-naira capital demands: 80%. That is the share of client digital assets that Virtual Asset Service Providers (VASPs) would be legally required to hold offline, in cold storage, at all times. Only what customers need for near-term withdrawals, settlements or transaction processing may sit in hot or warm wallets, and even that comes wrapped in new rules on wallet limits, monitoring, reconciliation and multi-party key controls.
On paper, this reads like sound risk management. Nigeria has watched the FTX collapse and a string of exchange hacks play out from a distance, and the SEC’s logic is that assets kept offline are harder to steal and easier to trace or freeze when a regulator comes calling. In practice, though, the rule collides with a market that is poorer, thinner on infrastructure, and more liquidity-dependent than the jurisdictions the SEC appears to be borrowing from.
Nigeria isn’t inventing the cold storage concept. Japan’s crypto custody rules already require at least 95% of customer assets to sit offline, a threshold that makes the SEC’s 80% look almost lenient by comparison. What is different is the company the rule now keeps. It doesn’t arrive alone. It lands alongside a minimum capital base of ₦2 billion (roughly $1.5 million) for Digital Asset Exchanges and Custodians, plus a separate ₦30 million registration fee and a fidelity insurance bond covering at least a quarter of that paid-up capital.
Digital Asset Platforms, Digital Asset Offering Platforms, and Real World Asset Tokenisation Offering Platforms would be required to pay ₦500 million capital with the same ₦30 million fee, while the broader Virtual Asset Service Provider category needs ₦200 million and a ₦15 million registration fee.
Stack a ₦2 billion capital floor, a ₦500 million insurance bond and an 80% custody lockup on top of one another, and you get a licence that costs real money before a single Nigerian user has traded a Bitcoin.
The hardware problem nobody priced in
Here is where the policy runs into a supply chain the SEC’s drafters may not have fully reckoned with. Cold storage at scale generally means hardware wallets, air-gapped devices, or comparable offline custody infrastructure, most of it manufactured abroad. Several hardware wallet makers give African markets, Nigeria included, a wide berth, put off by customs duties and by losing control of last-mile delivery. The scale of that neglect is stark: Singapore-based manufacturer Cypherock told TechCabal in December 2025 that it had sold roughly 15,000 wallets globally, but only about 200 across the whole of Africa. That is a rounding error, not a supply chain a serious custody industry can lean on.
The upside, if there is one, is that the rule could force that number to change. Demand created by regulatory obligation has a way of pulling manufacturers into markets they’d otherwise skip or of accelerating homegrown custody solutions built by exchanges themselves, using internal multi-signature systems and equivalent ledgering rather than imported devices.
Meanwhile, operator sentiment has broken roughly two ways. Most big and mid-sized local exchanges call the tougher capital and custody demands evidence the regulator is finally taking risk and market integrity seriously and pledge to keep negotiating for rules that are fair and proportionate to firms of their size. Smaller operators and some blockchain-services executives have pushed back harder, warning that a ₦2 billion capital floor stacked on an 80% custody lockup risks pricing Nigeria out of its own market, making it one of the more expensive jurisdictions anywhere to hold a crypto licence.
Cold storage isn’t the safe harbour the SEC thinks it is
The SEC’s entire custody logic rests on an assumption that cold storage and, by extension, offline, equals safety. Yet, late July gave the industry a costly reminder that it doesn’t always hold. Coldcard, a Bitcoin-only hardware wallet made by Toronto-based Coinkite and long marketed as one of the more trusted names in cold storage, was hit by a firmware flaw that let attackers reconstruct users’ wallet seed phrases without ever touching the physical device.
The root cause traced back to a March 2021 firmware update that quietly weakened how the device generated randomness for its keys, making some seeds brute-forceable from data as mundane as a device serial number. Across four waves of attacks beginning 30 July 2026, hackers drained roughly 1,800 BTC, north of $116 million, from more than 5,200 addresses, ranking among the year’s largest crypto hacks.
The lesson isn’t that cold storage is worthless. It’s that offline custody moves risk rather than eliminating it, shifting exposure from live network attacks to firmware integrity, supply chain trust and key-generation processes that most users, and plenty of exchanges, have no way to independently audit. A regulation that mandates 80% cold storage without also mandating rigorous, ongoing firmware and entropy audits for whatever hardware Nigerian custodians end up using could end up concentrating risk rather than spreading it, especially given how thin the region’s access to vetted, reputable hardware already is.
The unresolved question isn’t only whether 80% cold storage is safer than the status quo. It’s whether Nigerian exchanges, many still building out treasury operations and serving a user base that trades actively rather than holds long term, can keep enough in hot wallets to process withdrawals without lag. Cold storage retrieval isn’t instant; multi-signature approvals and offline key ceremonies take time by design. An exchange under-provisioned in its hot wallet buffer risks the one thing that erodes user trust faster than a hack: a withdrawal that doesn’t land when a customer needs it.
The SEC itself hedges here, reserving the right to prescribe a different percentage, which suggests even the regulator isn’t fully certain 80% is the right number rather than an opening position for negotiation.
It’s important to note that the proposal, published on 20 August 2026, was open for public comment until 3 September, though the SEC’s notice doesn’t specify a cutoff time zone, an odd omission for a rule this consequential. It is not yet law. Digital assets were already reclassified as securities under the Investment and Securities Act 2025, so the Commission has clear jurisdiction to finalise something close to this draft regardless of how loud the pushback gets.
What’s less clear is whether Nigeria ends up with a smaller, better-capitalised crypto industry built around a few exchanges that can absorb the cost, or a fragmented market where compliant operators serve the letter of the law while a much larger volume of activity continues through peer-to-peer channels and offshore platforms the SEC has far less power to touch. Cold storage protects assets that are inside the regulatory perimeter. It does nothing for the ones that were never going to enter it in the first place.
Technext Newsletter
Get the best of Africa’s daily tech to your inbox – first thing every morning.
Join the community now!
