FOREX TRADING IN NIGERIA: THE IMPLICATIONS OF SEC PROPOSED RULES ON ONLINE FOREX TRADING FOR TECHNOLOGY AND PLATFORM PROVIDERS
BY SEUN TIMI-KOLEOLU & PROMISE ITAH
Introduction
The Securities and Exchange Commission (“SEC”) has proposed rules on Online Forex Trading and Contracts for Difference (“CFDs”) (the “Proposed Rules”), introducing a regulatory framework for businesses involved in the provision of online Forex and CFD trading services in Nigeria.
The Proposed Rules will affect not only Forex brokers and CFD providers, but also the companies that provide the technology they use. This includes companies that provide the websites and apps where users open trading accounts; check currency and asset prices; place trades; and manage their investments. It may also include companies that host these platforms or provide the technology and systems that allow them to operate.
In this newsletter, we highlight key provisions of the Proposed Rules relevant to businesses that provide technology or platforms for online Forex and CFD trading.
What are Online Forex Trading and CFDS?
Under the Proposed Rules, Forex/FX/Foreign Exchange means the exchange of one national currency for another. Online forex trading involves trading foreign currencies through an online platform.
A Contract for Difference (CFD) is a derivative that allows a person to trade based on changes in the price of an underlying asset without owning the asset.
Key Highlights of the Proposed Rules
- Technology and Platform Providers Within the Regulatory Framework
Under the Proposed Rules, technology and platform providers are recognised as a distinct category of regulated persons. This category appears broad enough to cover businesses that provide trading infrastructure, software, platforms, systems or other technology used in connection with online Forex and CFD trading.
The Proposed Rules also apply to offshore businesses that target or provide services to Nigerian residents. This may arise where a platform permits Nigerian residents to open accounts, advertises its services to Nigerians, uses Nigerian currency or references, engages Nigerian influencers or affiliates, or otherwise demonstrates an intention to serve the Nigerian market.
Accordingly, a technology provider may need to assess its activities carefully where its platform is used by a Forex broker or CFD operator serving Nigerian residents. The fact that the provider does not deal directly with clients or execute trades may not, by itself, take it outside the scope of the Proposed Rules.
- Registration and Capital Requirements
A person may not carry on, or hold itself out as carrying on, the business of a technology or platform provider within the scope of the Proposed Rules without registration with the SEC.
For technology and platform providers, the Proposed Rules contemplate a minimum paid-up capital of ₦5 billion. The provider must also be incorporated in Nigeria or be a foreign company with an appropriate local presence in Nigeria.
The proposed registration fees comprise:
- Application fee – ₦100,000;
- Processing fee – ₦300,000; and
- Registration fee for a Category C technology or platform provider – ₦30 million.
In addition, a registered provider would be required to maintain professional indemnity insurance of not less than 20% of the applicable minimum capital per claim, or provide an equivalent security acceptable to the SEC.
- Operational and Technology Standards
The Proposed Rules place significant emphasis on the reliability, security and resilience of trading platforms. Technology providers would be expected to maintain systems that support the continuous and orderly operation of trading activities. The key requirements include:
- Platform availability: Platforms must maintain a minimum uptime of 99.5% during trading hours.
- Cybersecurity: Providers must have appropriate security measures in place, including end-to-end encryption of client and trade data, multi-factor authentication, regular penetration testing, and systems for monitoring and responding to security threats.
- Business continuity and disaster recovery: Providers must maintain business continuity and disaster recovery arrangements, test these arrangements annually and submit the relevant certification to the SEC.
- Record-keeping: Providers must retain audit trails of transactions and other relevant activities for at least seven years. Records must be readily retrievable within 24 hours and may include client information, orders, transactions, confirmations, electronic communications, financial records, AML records and risk disclosures.
These requirements may have implications for the design and operation of trading platforms and should be considered in the contractual arrangements between technology providers and the brokers or other regulated entities using their systems.
- Data Protection and Data Localisation
The Proposed Rules also set requirements for the storage and protection of client and trading data. Client order data must be stored in Nigeria or another jurisdiction approved by the SEC, in line with applicable data protection requirements. Technology providers may therefore need to review their data hosting arrangements, third-party access and cross-border data transfers.
- White-Label Platforms and Outsourced Technology
The Proposed Rules are also relevant to businesses that provide white-label platforms or outsourced technology solutions. Where a provider supplies the infrastructure used by a broker or trading operator, the parties will need to consider how responsibility for regulatory compliance is allocated. This should include responsibility for:
- platform availability and performance;
- cybersecurity and access controls;
- data storage and processing;
- incident reporting;
- recordkeeping and audit trails;
- business continuity and disaster recovery;
- regulatory inspections and information requests;
- use of subcontractors and external technology providers; and
- suspension, termination or migration of the platform.
The Proposed Rules require prior SEC approval for certain material changes, including changes to a trading platform or technology provider. This means that brokers and other regulated entities may need to obtain SEC approval before changing their technology providers or making significant changes to their trading platform.
Technology agreements should therefore be reviewed to ensure that they contain appropriate provisions dealing with regulatory cooperation, audit rights, service levels, incident escalation, data access, business continuity and orderly transition.
- Incident Reporting and Regulatory Cooperation
A technology provider would be required to notify the SEC within 24 hours of a material system breach, outage or cybersecurity incident.
This requirement creates a need for clear internal escalation procedures and contractual reporting arrangements. A broker may not become aware of a system incident immediately, while a technology provider may not have sufficient information to determine whether an incident is material from a regulatory perspective.
Technology providers and their regulated clients should therefore agree in advance on:
- What constitutes a reportable incident;
- How quickly incidents must be escalated;
- Who is responsible for notifying the SEC;
- The information to be included in an incident report;
- How affected clients will be notified; and
- The steps required to contain, investigate and remedy the incident.
The Proposed Rules also contemplate independent systems audits and penetration testing reports for proprietary and white-labelled platforms. Providers should expect increased scrutiny of their technology architecture, security controls, access management, development processes and third-party dependencies.
- What Technology Providers Should Consider
Businesses providing technology or platform services to online Forex and CFD operators should begin reviewing their current operations against the proposed framework. In particular, they should:
- assess their regulatory classification and determine whether their services fall within the proposed definition of a technology or platform provider;
- review their Nigerian market exposure, including whether their platforms are accessible to Nigerian residents or marketed through Nigerian brokers, affiliates, influencers or other intermediaries;
- evaluate their capital and local presence requirements, particularly where they operate through a foreign company or provide services on a white-label basis;
- review their technology infrastructure, including uptime, encryption, authentication, monitoring, penetration testing and incident response arrangements;
- assess their data arrangements, including data hosting locations, backups, cross-border transfers, subcontractors and compliance with applicable data protection laws;
- update their contractual arrangements with brokers and other regulated entities to address service levels, audit rights, incident reporting, regulatory access, business continuity and liability;
- prepare for enhanced recordkeeping and audit requirements, including the retention and retrieval of client, transaction and system records for at least seven years.
Conclusion
The SEC’s Proposed Rules signal closer regulation of online Forex and CFD trading in Nigeria, including the technology infrastructure supporting such activities. While the provisions highlighted in this newsletter are not exhaustive, the proposed requirements may have significant implications for both local and foreign businesses operating in this space.
Businesses should therefore review their regulatory position and relevant operations ahead of the final rules. As the proposals remain subject to change, businesses should continue to monitor developments and assess any implications based on the nature of their services and Nigerian market exposure.
