Regcompass September Regulatory Roundup
Welcome to the September regulatory round-up. The long-awaited General Application and Implementation Directive (GAID) finally took effect on 19 September 2025. Enforcement has started, at least on paper but public signals of NDPC’s full enforcement readiness are still emerging.
Beyond GAID, it’s been a wild month globally. The EU has officially added crypto platforms to their sanctions regime and Canadian Law enforcement just recovered $56m from a Crypto platform. We’ll break it all down, along with the key updates from Nigeria, Africa, and beyond. Let’s get into it.
Table Of Content
Regulatory Update in Nigeria
- GAID takes effect in Nigeria on 19 September 2025.
- CBN issues new directive to Domestic Systemically Important Banks (DSIBs)
- Nigeria and South Africa likely to exit FATF Grey list
- CBN cuts MPR by 50 Basis points to 27%
- NDPC issues security advisory to Nigerians over Google Chrome vulnerabilities
Across Africa: Welcoming Innovation While Addressing Challenges
- Uganda publishes Landmark competition regulations
- Gambia enacts first ever Data Protection Law
- AI Powered fraud schemes are on the rise in South Africa
- Kenyan High Court exempts Fintechs from VAT in Landmark ruling.
- Bank of Ghana suspends operating licenses for Flutterwave and 7 others
- Zambia gets $120m from the World Bank to build Digital Infrastructure
Across the World
- AI regulation gains momentum as California enacts new law.
- China lures Techies with new KI Visa after US hiked H-IB visa fees to $100,000
- FCA convicts an Individual for Data Protection breach
- Google petitions US Supreme Court to pause Epic Playstore ruling
Crypto Scoop:
- Google embeds stablecoin payments into AI apps
- Crypto platforms now included in EU Sanction
- Canadian Law enforcement recovers $56m in largest crypto seizure
- CFTC to allow Stablecoin as collateral in derivatives market
Deals and Raises
- Telo raises $20m to build tiny electric trucks for cities.
- SEON closes $80m Series C funding for AI Product Development and Talent Acquisition.
- Netskope raises almost $1bn in US IPO
- Kredete raises $22m series to expand credit building infrastructure with stablecoins transfers
- Juicebox raises $30M from Sequoia to revolutionize hiring with LLM-powered search
Mergers and Acquisitions
- Nexamont acquires 21.4% Stake in Royal Exchange Plc valued at N3.6 billion
- Egyptian e-health marketplace Duaya acquires SaaS provider EXMGO
- South African mobile payments company Street Wallet acquires Digitip
- OpenAI to acquire Product testing Startup StartsIg for $1.1 billion
- Leadway Holdings announces acquisition of PAL Pensions
Regulatory News in Nigeria
GAID takes effect in Nigeria on 19 September 2025.
In March 2025, The Nigeria Data Protection Commission (NDPC) issued the General Application and Implementation Directive (GAID), and it officially became effective on 19 September 2025. The Directive repealed the NDPR 2019 and gave clearer guidelines on implementation of the NDPA
In theory, enforcement of the Directive has begun but public signals of full enforcement readiness by the NDPC are still emerging. Some stakeholders question whether all data controllers and processors, especially smaller ones are fully equipped to meet GAID’s requirements.
CBN issues new directive to Domestic Systemically Important Banks (DSIBs)
The Central Bank of Nigeria has issued a circular requiring DSIBs to seek CBN approval at least six months before the expiration of any incumbent MD/CEO’s tenure, and to publicly announce their successor no later than three months before transition. The directive aims to prevent leadership vacuums and preserve stability within institutions deemed “too big to fail.” For banks, the new timeline could enhance investor confidence, but it also compresses boards’ flexibility to manage succession discreetly. How DSIBs strike that balance will be telling.
Nigeria and South Africa likely to exit FATF Grey list
Nigeria and South Africa are likely to be removed from the Financial Action Task Force (FATF) grey list at the upcoming October plenary, after on-site inspections confirmed significant progress in addressing anti-money laundering (AML) and counter-terrorist financing (CFT) deficiencies. Delisting would mark a major milestone for both countries, which have faced two years of heightened monitoring, restricted capital inflows, and tighter scrutiny from global banks. It is also likely to strengthen investor confidence and reduce the compliance burden for businesses engaged in cross-border trade and finance.
CBN cuts MPR by 50 Basis points to 27%
In a landmark move, the Monetary Policy Committee of the CBN has lowered the Monetary Policy Rate (MPR) by 50 basis points (bps) to 27.00 %. This is its first rate cut since 2020. In addition, the CBN expanded the standing facilities corridor to ±250 basis points, increased the Cash Reserve Requirement (CRR) for commercial banks to 45%, and implemented a 75% CRR on non-TSA (Treasury Single Account) public sector deposits.The signal is clear: with headline inflation easing to 20.12 % in August, the CBN is cautiously pivoting toward growth.
NDPC issues security advisory to Nigerians over Google Chrome vulnerabilities
The Nigeria Data Protection Commission (NDPC) has alerted the public to serious Chrome browser flaws that could permit remote code execution. It urged Nigerians to update browsers promptly, restrict admin privileges, and beware of malicious downloads.
Beyond the technical details, this incident shows NDPC stepping into a more activist role in public cybersecurity.
Across Africa: Welcoming Innovation While Addressing Challenges
Uganda publishes Landmark competition regulations
Uganda has formally gazetted the Competition Regulations, 2025, providing the long-awaited operational framework under the existing Competition Act. The rules lay out procedures for merger control, definitions of dominance, prohibitions on anti-competitive practices (tying, refusal to deal, price abuse) the structure of a technical committee within the Ministry of Trade to manage enforcement.
Gambia enacts first ever Data Protection Law
The Gambia has passed its first comprehensive Data Protection and Privacy Law (2025), replacing the patchwork reliance on the 1997 Constitution’s privacy clause and the 2019 Data Protection Strategy. The law establishes binding obligations for organizations handling personal data and marks a major step toward digital trust. Key details on its effective date and enforcement body are still awaited, leaving stakeholders with a short window to align compliance frameworks before regulators move to enforce.
AI Powered fraud schemes are on the rise in South Africa
SABRIC (South African Banking Risk Information Centre) reports that although overall financial crime losses declined (from ~R3.3 billion in 2023 to ~R2.7 billion in 2024), there is a marked rise in AI-enabled fraud and social engineering-based scams. Techniques such as deep fakes, voice cloning, fake applications, and AI-generated phishing content are becoming more common. This trend suggests that traditional fraud detection systems may no longer be sufficient as the fraudsters’ tools improve rapidly. Increased investment in AI-based detection, consumer education, and tighter regulation of synthetic identity use will likely be critical if South Africa wants to stay ahead.
Kenyan High Court exempts Fintechs from VAT in Landmark ruling
In a significant decision, the Kenyan High Court has ruled that fintech companies providing payment facilitation are entitled to VAT exemption, even when not licensed under the Banking Act, so long as they perform functions equivalent to financial institutions. The ruling could level the playing field with banks and mobile money platforms and reduce compliance costs for small and medium fintechs.
Bank of Ghana suspends operating licenses for Flutterwave and 7 others
The Bank of Ghana has suspended remittance partnerships of five Money Transfer Operators and three Payment Service Providers . The action follows breaches of the Updated Guidelines for Inward Remittance Services by Payment Service Providers, 2023. Ghana is by this action, sending a message that non-compliance in remittance and forex channels won’t be tolerated.
Zambia gets $120m from the World Bank to build Digital Infrastructure
Zambia has secured financing from the World Bank to build digital infrastructure. This investment is a strong signal for what “digital readiness” could look like in sub-Saharan Africa. If Zambia pulls this off, it could serve as a blueprint for similar economies aiming to accelerate digital transformation under tight fiscal constraints.
Across The World
AI regulation gains momentum as California enacts new law.
California has enacted the Transparency in Frontier Artificial Intelligence Act, making it the first State in the U.S. to require large AI firms to publicly disclose how they guard against catastrophic risks. The Law also requires firms to report safety incidents within 15 days and adopt whistleblower protections. This is a clear signal that AI regulation is entering a new phase. In the future, it’s likely that lawmakers will require more transparency and accountability.
China lures Techies with new KI Visa after US hiked H-IB visa fees to $100,000
In response to the U.S. raising the cost of new H-1B visa applications to $100,000, China announced a new “K Visa” for STEM professionals, effective October 1. The new visa will feature multiple entries, longer validity, and most importantly, no requirement for a local employer invitation. This is a bold talent-war move. China is signaling that it will compete aggressively for global tech talent, especially where U.S. policy becomes a barrier. The question is how will China address intellectual property, regulatory, and national security risks associated with an influx of foreign technologists?
FCA convicts an Individual for Data Protection breach
The U.K. Financial Conduct Authority (FCA) has successfully prosecuted Nicholas Harper, who pleaded guilty to “encouraging or assisting” a breach of the Data Protection Act. While a jury acquitted him of conspiracy to defraud and conducting regulated activity without authorization, Harper was fined £100 and ordered to pay a £30 victim surcharge. This case stands out in the fintech sector, as it’s a rare example of an individual held accountable for a data protection violation.
Google petitions US Supreme Court to pause Epic Playstore ruling
Google has petitioned the U.S. Supreme Court to pause a lower-court injunction that would force it to overhaul its Play Store rules. The ruling mandates Google to allow third-party app stores, remove billing restrictions, and open access to its catalog. Google is claiming that abrupt enforcement would inflict “irreparable harm” on both the Android ecosystem and millions of developers and users. As this plays out, all eyes are on whether the Court will intervene and what this means for global app store regulation.
Global Crypto
Google embeds stablecoin payments into AI apps
Google has launched a new open-source payments protocol (AP2) that enables AI applications to send and receive payments (including stablecoins) in partnership with Coinbase, the Ethereum Foundation, and over 60 industry players. The protocol, which builds on Google’s agent-to-agent (A2A) infrastructure, introduces an extension (x402) to support one-tap stablecoin settlement.
This marks a major step towards the merging of autonomous AI systems and money flows, by embedding stablecoin rails directly into AI workflows, Google is reducing friction in digital transactions where agents may act without constant human oversight. But it also raises new questions: How will regulators respond to “agent-initiated payments”? Who bears liability if an AI misuses funds? And how will anti-money laundering guardrails adapt to this emerging architecture?
Crypto platforms now included in EU Sanctions
For the first time, the EU has explicitly included cryptocurrency platforms in its sanctions regime, with the 19th package targeting Russian transactions with alternative payment systems. This signals that digital assets are now squarely part of global financial geopolitics. However, it’s clear that enforcement won’t be simple, Just like we saw with the recently hacked Iranian crypto exchange, “Nobitex” , sanctioned entities can quickly spin up new anonymous wallets, thus leaving compliant exchanges unknowingly exposed until clustering tools catch up to identify the real owners. A tougher compliance question which no guidance has yet resolved is this: Will lawful platforms bear liability for exposures that only become visible after attribution by clustering tools?
Canadian Law enforcement recovers $56m in largest crypto seizure
The Royal Canadian Mounted Police (RCMP) has seized more than CAD 56 million in crypto assets tied to the trading platform TradeOgre, marking the country’s largest crypto seizure to date. The platform was unregistered with FINTRAC and allegedly facilitated anonymous, illicit fund flows. This is a watershed in digital asset enforcement. Canada is now sending a clear signal that crypto is firmly within its criminal justice radar.
CFTC to allow Stablecoin as collateral in derivatives market
The U.S. Commodity Futures Trading Commission (CFTC) has proposed a pilot program to allow tokenized non-cash collateral, including stablecoins, in derivatives markets. The move is part of the broader digital asset markets pilot initiative, intended to expand permissible collateral types and bring crypto rules closer to traditional finance.If adopted, this could be a major shift: stablecoins could begin functioning more like traditional securities or money-market instruments in derivatives ecosystems. That said, credible reserve backing, collateral valuation, settlement risk, and counterparty regulation will be critical hurdles.
Deals & Raises
- Telo raises $20m to build tiny electric trucks for cities.
- SEON closes $80m Series C funding for AI Product Development and Talent Acquisition.
- Netskope raises almost $1bn in US IPO
- Kredete raises $22m series to expand credit building infrastructure with stablecoins transfers
- Juicebox raises $30M from Sequoia to revolutionize hiring with LLM-powered search
Mergers & Acquisition
- Nexamont acquires 21.4% Stake in Royal Exchange Plc valued at N3.6 billion
- Egyptian e-health marketplace Duaya acquires SaaS provider EXMGO
- South African mobile payments company Street Wallet acquires Digitip
- OpenAI to acquire Product testing Startup StartsIg for $1.1 billion
- Leadway Holdings announces acquisition of PAL Pensions
Join the Conversation:
Do you have questions or insights about the regulatory landscape in your region? Reach out to us on any of our social media handles, email and we would be available to help.
Please note that the information provided in this article does not constitute legal advice and should not be construed as such.
For legal advice specific to your situation, please consult a legal practitioner.
