Prepare for His visitation, by Funmi Komolafe

Nigeria's legal landscape has undergone significant transformation with the enactment of pivotal legislation aimed at enhancing corporate governance, combating financial crime, and safeguarding personal data. This article provides an overview of the key provisions and implications of the Companies and Allied Matters Act (CAMA) 2020, the Money Laundering (Prevention and Prohibition) Act (MLPPA) 2022, and the Nigeria Data Protection Act (NDPA) 2023. It highlights the imperative for legal practitioners and businesses to proactively adapt to these evolving regulatory frameworks to ensure compliance, mitigate risks, and foster sustainable operations in Nigeria's dynamic economic environment.

The Nigerian regulatory environment has experienced a period of profound evolution, marked by the introduction of several landmark statutes designed to align the nation's legal framework with international best practices and foster a more transparent and accountable business climate. These legislative reforms necessitate a proactive approach from legal professionals and businesses alike, as the cost of non-compliance can be substantial, ranging from significant financial penalties to reputational damage and operational disruptions. The overarching theme of these reforms is a push towards greater transparency, accountability, and the protection of fundamental rights in the digital age.

This article delves into the critical aspects of three cornerstone pieces of legislation: the Companies and Allied Matters Act (CAMA) 2020, the Money Laundering (Prevention and Prohibition) Act (MLPPA) 2022, and the Nigeria Data Protection Act (NDPA) 2023. Each of these Acts introduces far-reaching changes that impact corporate operations, financial transactions, and the handling of personal information across various sectors. For legal practitioners, understanding these nuances is not merely an academic exercise but a practical necessity for effectively advising clients and navigating the complexities of modern Nigerian commerce.

For decades, the Companies and Allied Matters Act, Cap C20, Laws of the Federation of Nigeria 2004 (CAMA 1990) served as the primary legislation governing corporate entities in Nigeria. However, with the rapid changes in global commerce and the need to improve the ease of doing business, a comprehensive overhaul was long overdue. This led to the enactment of the Companies and Allied Matters Act 2020 (CAMA 2020) on August 7, 2020, which repealed and replaced its 30-year-old predecessor. CAMA 2020 introduced significant reforms aimed at streamlining company registration, reducing compliance burdens for small and medium enterprises (SMEs), and enhancing corporate governance and transparency.

Concurrently, Nigeria has intensified its efforts to combat financial crimes, particularly money laundering and terrorism financing, in line with international standards set by the Financial Action Task Force (FATF). The Money Laundering (Prevention and Prohibition) Act 2022 (MLPPA 2022), assented to on May 17, 2022, repealed the Money Laundering (Prohibition) Act 2011, providing a more robust legal and institutional framework. This legislative update was crucial for strengthening Nigeria's anti-money laundering and counter-terrorism financing (AML/CFT) regime, leading to its removal from the FATF grey list in October 2025. Furthermore, recognizing the increasing importance of data privacy in a digital economy, Nigeria enacted the Nigeria Data Protection Act (NDPA) 2023 on June 12, 2023. This Act replaced the Nigeria Data Protection Regulation (NDPR) 2019, establishing a comprehensive legal framework for the protection of personal data and creating the Nigeria Data Protection Commission (NDPC) as the primary regulatory authority.

CAMA 2020 introduced several transformative provisions. Notably, it replaced the concept of 'authorized share capital' with 'minimum issued share capital,' simplifying the process and reducing upfront costs for businesses. The Act also permits the formation of a company with a single shareholder, a significant departure from the previous requirement of a minimum of two. To enhance transparency and combat illicit financial flows, CAMA 2020 mandates the disclosure of beneficial ownership for all companies, requiring them to file particulars of persons with significant control with the Corporate Affairs Commission (CAC). The CAC has since operationalized a public Beneficial Ownership Register, making this information accessible and supporting anti-corruption efforts.

The MLPPA 2022 significantly expanded the scope of anti-money laundering obligations. It broadened the definition of 'funds' to include 'virtual assets' and extended the regulatory oversight to 'Virtual Asset Service Providers' (VASPs), reflecting global trends in financial regulation. The Act retained and strengthened reporting obligations for financial institutions and Designated Non-Financial Businesses and Professions (DNFBPs), requiring them to report single transactions exceeding specified thresholds (e.g., N5 million for individuals and N10 million for corporate bodies). It also established the Special Control Unit Against Money Laundering (SCUML) as a department under the Economic and Financial Crimes Commission (EFCC) to supervise DNFBPs and ensure compliance. The Nigerian Financial Intelligence Unit (NFIU) remains central to the AML/CFT framework, responsible for receiving, analyzing, and disseminating financial intelligence.

Complementing these reforms, the NDPA 2023 establishes a robust framework for data protection, aligning Nigeria with international standards like the GDPR. The Act applies to any entity processing personal data within Nigeria or processing the data of individuals located in Nigeria, regardless of the entity's location. Key provisions include the requirement for lawful bases for data processing (such as consent, contractual necessity, or legitimate interest), the establishment of data subject rights (including the right to access, rectification, erasure, and data portability), and obligations for data controllers and processors to implement robust security measures. Data controllers are also mandated to notify the NDPC within 72 hours of becoming aware of a personal data breach. The interplay between these Acts, particularly the NDPA and AML/CFT regulations, requires careful navigation, as financial institutions must ensure their AML systems comply with data privacy principles.

The recent legislative enactments in Nigeria, particularly CAMA 2020, MLPPA 2022, and NDPA 2023, collectively represent a significant shift towards a more regulated, transparent, and accountable business environment. For legal practitioners, this evolving landscape presents both challenges and opportunities. It is no longer sufficient to merely react to regulatory changes; a proactive and integrated approach to compliance is essential. Firms must invest in continuous legal education to stay abreast of these developments and their practical implications, advising clients on the necessary adjustments to their corporate structures, financial operations, and data handling practices.

Practitioners should guide clients in conducting thorough compliance audits, updating internal policies and procedures, and implementing robust training programs for their personnel. The emphasis on beneficial ownership, anti-money laundering, and data protection underscores a global trend towards greater corporate transparency and individual rights. By embracing these changes and developing comprehensive compliance strategies, legal professionals can help their clients not only avoid regulatory pitfalls but also build trust, enhance their reputation, and ultimately thrive in Nigeria's increasingly sophisticated legal and business ecosystem. The continuous monitoring of subsidiary legislation, guidelines from regulatory bodies like the CAC, NFIU, and NDPC, and judicial interpretations will be crucial in the years to come.