CBN regulations for loan apps 2026: What borrowers & lenders must know

Nigeria’s most comprehensive loan app regulation was paused by a court order in April 2026, but most borrowers are still operating as if nothing changed.

Key Takeaways

The Federal Competition & Consumer Protection Commission (FCCPC), not the CBN, is the primary regulator for most loan apps in Nigeria, which fundamentally changes how you verify legitimacy and where you take your complaints.
The DEON Regulations 2025 (Digital, Electronic, Online, or Non-Traditional Consumer Lending Regulations 2025) introduced Nigeria’s strictest digital lending rules to date (₦100 million penalties, hard data privacy limits), but enforcement is currently suspended following an April 2026 Federal High Court injunction.
Over 520 loan apps have been screened by regulators as of early 2026, marking a significant cleanup of a space that was, not long ago, almost entirely unpoliced.
Nigeria’s consumer credit market has reached ₦3.82 trillion, proof that demand for digital lending is accelerating even as the regulatory environment remains unsettled.
More than 11,000 complaints filed between 2021 and 2023, centered on harassment and data abuse, are the direct reason stricter regulations became unavoidable.

Nigeria’s digital lending space isn’t governed by a single regulator with a single rulebook. It’s a shared jurisdiction between the CBN and the FCCPC, and understanding which body covers which type of lender is the difference between knowing your rights and filing a complaint with the wrong agency entirely.

In 2025, the government introduced the DEON Regulations, Nigeria’s most sweeping digital lending framework to date, built to address years of documented abuse across loan apps. Then, in April 2026, a Federal High Court injunction suspended enforcement, leaving borrowers, lenders, and compliance teams in a regulatory grey zone that nobody fully anticipated.

This article clarifies who actually regulates loan apps in Nigeria right now, what the rules require when they’re in force, which platforms are operating in compliance, and what the current legal situation means for you (whether borrowing or lending).

Who regulates loan apps in Nigeria: CBN vs. FCCPC?

When most people ask about CBN regulations for loan apps, they assume the apex bank is the primary authority governing the app on their phone. In most cases, it isn’t.

Breakdown of roles

If a loan app is backed by a licensed microfinance bank, it falls under CBN oversight for its banking operations, but it still requires an FCCPC registration waiver to operate as a digital lender.

If it’s a standalone digital money lender with no MFB structure underneath it, the FCCPC is the sole regulatory authority.

Related Story: Meta contests $25,000 Falana judgment, citing jurisdictional flaws

The Nigeria Data Protection Commission (NDPC) falls under both categories, governing how these platforms handle your personal data.

The Nigerian Communications Commission (NCC) enters the picture specifically for telco-based lending, though its jurisdictional boundaries there remain actively disputed.

Why does knowing who regulates what actually matter to you?

Three reasons:

It determines where your complaint goes when something goes wrong.
It tells you what consumer protections legally apply to your loan.
It’s your clearest signal for identifying which apps are operating within the law and which ones aren’t.

Regulator	Who it covers	What it governs	Status
CBN	Banks, MFBs	Licensing, capital, & monetary policy	Active
FCCPC	Digital lenders	Consumer protection, licensing	Enforcement paused
NDPC	All data handlers	Data protection compliance	Active
NCC	Telco lending	Telecom infrastructure	Disputed

What the DEON Regulations 2025 require

If you’ve ever had a loan app contact your employer without permission, charge fees that weren’t disclosed upfront, or access your phone contacts before you’d even been approved, the DEON Regulations were written specifically in response to that.

This is Nigeria’s most detailed consumer protection framework for digital lending to date, and it covers more ground than most borrowers realize.

Here’s what it mandates.

1. Registration and reporting

All covered platforms were required to register with the FCCPC by January 5, 2026, and maintain ongoing compliance reporting.

The registration requirement alone was designed to flush out unregistered operators who had proliferated across Nigeria’s app stores without regulatory accountability.

Meanwhile, microfinance banks and other CBN-licensed institutions are required to apply to the FCCPC for a waiver of registration.

2. Coverage

The regulation’s scope applies to traditional loan apps, buy-now-pay-later platforms, and telco-based lending products, meaning the regulatory net extends well beyond the obvious targets.

If your platform extends digital credit to Nigerian consumers, DEON most likely applies to you.

3. Full transparency on costs

Every loan app operating under the DEON framework must disclose interest rates, fees, and all associated charges upfront before users accept any loan offer.

Where it used to be just another grey area, hidden charges that surface after disbursement are a violation of this regulation.

The intent is for customers to know exactly what a loan costs before they’re committed to it.

4. Loans must be user-initiated

Several digital lenders developed a practice of automatically issuing credit to users without explicit request, a tactic that created debt obligations users hadn’t consciously taken on.

Under DEON, every loan must be user-initiated. Automatic credit issuance without a deliberate borrower action is prohibited outright.

5. Data privacy restrictions

Under DEON, loan apps are prohibited from accessing your contact list or photo gallery until after loan approval, not as a condition of application, as many apps previously required.

The data access creep that characterized Nigeria’s early loan app era, where apps harvested contact information and then weaponized it during collections, is directly addressed here.

6. Anti-harassment rules

Contacting a borrower’s friends, family members, or colleagues as a collections tactic is explicitly prohibited.

This was among the most complained-about practices in Nigeria’s digital lending space: over 11,000 complaints between 2021 and 2023 documented harassment as a primary grievance.

Under DEON, any lender who contacts a borrower’s contacts faces license revocation and a financial penalty.

7. Complaint resolution within 24–48 hours

Registered lenders are required to maintain functional complaint resolution channels and respond within 24 to 48 hours. That’s a meaningful shift from an environment where borrower complaints routinely disappeared into unmonitored email inboxes.

8. Penalties

Violations carry fines of up to ₦100 million per breach. The penalty structure is designed to make cutting corners more costly than building compliant systems.

What’s happening now with the April 2026 court injunction?

As of the time of writing this article in April 2026, here are the developments:

What happened?

On April 15, 2026, the Federal High Court issued an injunction that partially suspended enforcement of the DEON Regulations, and the digital lending space has been navigating the fallout ever since.

The injunction was filed by the Wireless Application Service Providers’ Association (WASPA Nigeria). It targets a specific but consequential question: whether the FCCPC has the authority to regulate telco-based lending products, or whether that jurisdiction belongs to the NCC.

The court’s eventual ruling could redraw regulatory boundaries that the FCCPC spent years building.

What is currently suspended?

While the injunction holds, enforcement of DEON’s licensing requirements, sanctions, and penalty mechanisms is paused for the affected category of players.

That means the ₦100 million per-violation penalties, the license revocation provisions, and the compliance reporting obligations are not being actively enforced against telco lenders in dispute.

For borrowers who use telco-based credit products, the practical implication is that the consumer protections those rules were designed to guarantee are currently not being backed by active regulatory teeth.

Why does this create a problem?

Regulatory uncertainty of this kind affects lenders, compliance teams, and borrowers in ways that are immediate and tangible.

When enforcement is suspended, the regulation’s deterrent effect weakens. Platforms that might have cleaned up their collection practices or data access policies under the threat of penalties have less immediate incentive to do so while the injunction holds.

The macro backdrop makes this worse. Loan demand continues to climb, driven by persistent inflation, rising living costs, and limited access to traditional bank credit. More Nigerians are turning to digital lending precisely when the regulatory framework meant to protect them is operating at reduced capacity.

The jurisdictional stakes

The case is adjourned for the hearing of the substantive application on April 27, 2026.

If the court ultimately rules in WASPA’s favor and finds that telco-based lending falls under NCC rather than FCCPC jurisdiction, the consumer protection implications are significant. The NCC’s mandate is infrastructure and telecommunications regulation, not consumer financial protection.

A ruling that removes telco lenders from FCCPC oversight could mean that a meaningful segment of Nigeria’s digital lending market operates outside the strict data privacy, anti-harassment, and transparency rules that DEON established.

How to verify a loan app is legally approved in 2026

With over 430 apps screened, hundreds approved, and dozens delisted or watchlisted, the Nigerian loan app market looks very different from what it was three years ago. But that cleanup only protects you if you know how to use it.

Here’s how to verify whether an app is legit:

Check the FCCPC register first. The FCCPC maintains a publicly accessible list of approved digital money lenders. If the app isn’t on it, that’s your answer.
Cross-reference with the CBN for MFB-backed apps. If the platform claims to operate under a microfinance bank license, verify that the MFB is listed on the CBN’s licensed institutions list.
Match the developer name with its CAC registration. The company name on the app store listing should correspond to a registered Nigerian business entity. Mismatches are a red flag worth acting on.
Reject any app requesting contacts or gallery access before approval. Under DEON, this is prohibited at the application stage.
Confirm a physical Nigerian address. Legitimate lenders are required to maintain a verifiable local presence. No address, no accountability.

FAQs

Does the CBN directly regulate loan apps?

In most cases, no. The CBN regulates microfinance banks. Standalone loan apps without MFB backing fall under FCCPC jurisdiction, not the Central Bank.

Are the DEON Regulations currently active?

They exist as law, but enforcement is partially suspended as of April 2026 following a Federal High Court injunction.

What happens if a loan app violates the rules?

When enforcement is active, penalties include fines of up to ₦100 million per violation, license revocation, and public blacklisting from Nigeria’s approved lender registers.

How do I verify a loan app in Nigeria?

Start with the FCCPC approval list, confirm the developer’s identity matches a registered Nigerian entity, and treat any app requesting contact or gallery access before approval as an immediate disqualifier.

Conclusion

The DEON framework is the clearest signal yet that Nigeria is serious about ending the harassment, data abuse, and opacity that defined digital lending’s early years. But the April 2026 court injunction is an equally clear signal that the regulatory architecture isn’t yet finished.

For borrowers, the rule hasn’t changed much: verify before you trust, regardless of the enforcement environment at any given moment. For lenders, compliance isn’t something you pursue only when penalties are active.

Citations

Disclaimer!

This publication, review, or article (“Content”) is based on our independent evaluation and is subjective, reflecting our opinions, which may differ from others’ perspectives or experiences. We do not guarantee the accuracy or completeness of the Content and disclaim responsibility for any errors or omissions it may contain.

Related Story: Can Africa build its own global social media platform?

The information provided is not investment advice and should not be treated as such, as products or services may change after publication. By engaging with our Content, you acknowledge its subjective nature and agree not to hold us liable for any losses or damages arising from your reliance on the information provided.

Always conduct your research and consult professionals where necessary.