The Central Bank of Nigeria (CBN) has opened applications for the second cohort of its Regulatory Sandbox Programme, and while most attention has landed on the new track for virtual asset firms, the announcement carries a second track that could matter just as much to Nigerian fintechs: a dedicated lane for companies building on permission-based data sharing.
The apex bank called it the Data-Enabled Financial Services (Non-VASP) Track. It is open to innovations that use secure digital infrastructure and permission-based data sharing to improve financial inclusion, payments, credit, risk management, operational efficiency, and consumer outcomes. That description reads as a near-complete summary of what open banking was meant to deliver in Nigeria.
Applications opened on 12 August 2026 and close on 31 August 2026, giving eligible firms a window of under three weeks. Companies apply through the CBN Regulatory Sandbox Portal.
Why the second track matters
Nigeria has had an open banking rulebook for years without having much open banking. The CBN approved a regulatory framework in 2021 and followed it with operational guidelines, but the rollout has repeatedly slipped past its expected launch dates, leaving banks, fintechs, and third-party providers holding standards that nobody has been compelled to implement at scale.
The sandbox does not change that mandate. What it changes is the availability of a supervised environment in which a firm can put a consent-based data product in front of real customers and have the regulator watch it work. For a category of companies that has spent years building against APIs with uncertain regulatory standing, a formal testing track is the closest thing yet to an invitation.
The CBN said applications will be assessed on the level of innovation, readiness for controlled live testing, potential consumer or market benefit, governance arrangements, risk management capability, and the suitability of the proposed testing plan. Readiness is doing heavy lifting in that list. A firm that has not already built something testable will struggle to make the case in three weeks.
What participants get, and what they do not
Successful applicants run supervised tests within parameters agreed with the CBN, including safeguards for consumer protection, operational resilience, cybersecurity, and regulatory reporting.
They do not get a licence. The CBN was explicit that participation “does not constitute a licence, authorisation, or approval to operate outside the approved testing parameters.”
The value on offer is proximity and regulatory learning rather than permission, which means firms are taking on reporting and compliance obligations for an outcome the bank has not promised.
The first cohort suggests appetite will not be the constraint. The CBN opened applications in December 2022 and closed the window on 1 February 2023, reportedly receiving more than 1,000 submissions.
The wider regulatory picture
Cohort 2 arrives during an unusually busy stretch for Nigerian financial regulation. It follows President Bola Tinubu’s executive order harmonising virtual asset oversight, which created a Virtual Asset Council chaired by the CBN, and a Nigeria Revenue Service tax framework for virtual assets released earlier this month.
Against that backdrop, the Non-VASP track looks less like an afterthought and more like the CBN testing two futures at once. One involves stablecoins and settlement rails. The other involves customer data moving between institutions with consent, which is the older and, so far, less delivered promise.
Whether the sandbox becomes the mechanism that finally moves open banking from framework to market will depend on what the CBN does with what it learns. For now, firms have until the end of the month to make their case.
