A. INTRODUCTION
Nigeria’s 2025 tax reform package, comprising the Nigeria Tax Act (NTA), the Nigeria Tax Administration Act (NTAA), the Nigeria Revenue Service (Establishment) Act (NRSA) and the Joint Revenue Board (Establishment) Act (JRBA), came into full effect on January 1, 2026.
Among their many innovations, one demands particular attention from fintech operators and those advising them: the statutory repositioning of banks, payment platforms and other financial institutions from passive infrastructure into active agents of tax enforcement.
This article examines the three statutory mechanisms through which that repositioning operates, considers the precedent that preceded them and why it failed, identifies the unresolved tension between the new reporting obligations and Nigeria’s data protection framework, and sets out what financial institutions, particularly fintech operators must do now. The legal machinery is already live. The market has not yet fully absorbed its implications.
B. THREE STATUTORY MECHANISMS, ONE DIRECTION
Section 29 of the NTAA imposes a mandatory reporting obligation. Every bank, insurance company, stock-broking firm and other financial institution must prepare and submit, with or without demand by the Nigeria Revenue Service (NRS), annual returns specifying the names and addresses of new customers and of existing customers whose cumulative monthly transactions meet defined thresholds: N50 million for individuals and N250 million for bodies corporate. The provision is structural, continuous and automatic. It transforms any fintech platform processing transactions at scale into a periodic reporting agent for the NRS, the successor body to the Federal Inland Revenue Service (FIRS), regardless of whether any particular customer is under investigation.
Section 60 confers the Power of Substitution. Where a taxpayer fails to pay an established and final tax liability, the relevant tax authority may issue a substitution notice to any person holding money on behalf of, or owing money to, that taxpayer, directing remittance to the tax authority in settlement of the debt. The Lagos State Internal Revenue Service (LIRS) confirmed immediate activation of this power in its Public Notice of January 21, 2026. The practical reach is wide: float in a merchant wallet, settlement funds held for a vendor, a customer balance in a mobile money account. Any fintech holding funds on behalf of the taxpayer or owed to a taxpayer may receive such a notice. The affected taxpayer must receive written notification, but the notice to the financial institution may precede remittance.
Section 68 enables third-party debt assignment. Once all statutory recovery steps have been exhausted, including notifications, payment demands and enforcement actions, the relevant tax authority may assign outstanding tax debts of significant value to an accredited third party. That third party, which the NTAA expressly defines to include banks, other financial institutions and debt recovery practitioners, assumes responsibility for recovery in accordance with the Act. The assignment may be revoked at any time. Appointed agents must apply fair and lawful collection practices, maintain accurate records, file periodic reports and observe confidentiality obligations. Failure to comply exposes an agent to withdrawal of accreditation and personal liability for losses arising from negligence or misconduct.
C. THE 2018 FAILURE AND WHAT THE 2025 ACT DOES DIFFERENTLY
Nigeria attempted something similar in 2018, when the FIRS (now NRS), and certain State Internal Revenue Services appointed commercial banks as collection agents. The effort was controversial and largely ineffective. Banks resisted on three grounds: no mechanism existed to verify the legitimacy of underlying assessments; the CBN’s regulatory framework did not contemplate compelled remittance of customer deposits on the strength of a tax notice; and personal liability exposure for compliance was undefined. The legal architecture was judged insufficient and the programme yielded limited recoveries.
The 2025 reform addresses those failures with statutory precision. The NTAA provides unambiguous legislative authority rather than reliance on general agency provisions. It establishes procedural prerequisites before either the substitution power or third-party assignment can be invoked: the tax liability must be established and final, all statutory recovery steps must have been exhausted, and the taxpayer must receive written notification of any assignment. An accreditation framework introduces a licensing layer absent from the 2018 regime. The architecture is structurally more defensible. The implementation question left unanswered, as the expert commentary following the LIRS January 2026 notices made clear, concerns the interplay between NTAA obligations and the CBN’s supervisory framework. Until the CBN issues formal guidance, banks and licenced payment service providers will remain exposed to conflicting regulatory expectations, particularly in relation to Section 60 substitution notices.
D. THE DATA PROTECTION TENSION
The mandatory reporting regime under Section 29 sits in unresolved tension with the Nigeria Data Protection Act 2023 (NDPA). The periodic returns that financial institutions must file with the NRS cover transaction volumes, counterparty details and customer identifiers across a wide transactional sweep. Statutory compulsion provides a lawful basis for that processing under the NDPA. But the NTAA is silent on the data governance obligations that should govern the NRS as a recipient and processor of the information it receives. There is no provision specifying retention limits, no requirement for the NRS to publish a data processing notice, and no mechanism through which a customer whose data has been transmitted under Section 29 can ascertain what the NRS holds or how it is used.
For the broader financial institution-based tax framework, particularly fintech operators, the gap is a live compliance exposure, not a theoretical concern. A platform that transmits customer transaction data to the NRS under Section 29 must ensure that its privacy notices accurately reflect that processing. If they do not, the platform is in breach of the NDPA’s transparency requirements regardless of the fact that the transmission itself is statutorily compelled. The Nigeria Data Protection Commission (NDPC) has issued no guidance on the intersection of NTAA reporting obligations and NDPA requirements. Fintech operators should not wait for that guidance before auditing their privacy frameworks and updating their customer-facing documentation accordingly.
E. WHAT FINTECH OPERATORS MUST DO
On reporting, platforms must audit their transaction monitoring systems to determine whether and how the Section 29 quarterly return obligation applies to them, build structured reporting pipelines to the NRS for those within scope, and update privacy notices to reflect this processing activity accurately.
With respect to substitution notices, fintech operators holding float, settlement balances or customer funds must develop clear internal protocols for responding to Section 60 notices. The most defensible position, pending the Central Bank of Nigeria (CBN) guidance, is to treat any substitution notice as triggering an obligation to notify the CBN and seek regulatory direction before effecting any remittance, particularly where funds are held under a CBN-issued licence.
Furthermore, on governance, fintechs operating as licensed payment service providers, mobile money operators or switching companies must map NTAA obligations against their existing CBN compliance, NDPA and Anti-Money Laundering (AML) frameworks. The points of potential conflict between mandatory tax disclosure and data protection requirements need to be identified and managed proactively, not discovered during enforcement.
F. CONCLUSION
The 2025 tax reform package does not merely update Nigeria’s tax law. It reconfigures the role of financial infrastructure in the enforcement of public obligations. Fintech platforms, built on the promise of fast, convenient and trusted financial services, are now operating as extensions of the state’s revenue collection apparatus. That repositioning is legally defensible in architecture, commercially consequential in reach and insufficiently understood in its implications. The firms that recognise it earliest, build compliant systems around it and resolve the residual regulatory ambiguities proactively will be best positioned in what is a permanent structural change in the conditions under which digital financial services operate in Nigeria.
Please do not treat the foregoing as legal advice as it only represents the public commentary views of the authors. All enquiries on this should please be directed at the authors.
