CBN Compliance & Wallet Systems
Legal Intelligence Memo

The Core Regulatory Framework

The Central Bank of Nigeria's primary instruments governing digital payments are the CBN Guidelines on Operations of Electronic Payment Channels in Nigeria (2020/2021), the CBN Regulatory Framework for Payment Service Providers (PSP) 2022, and the CBN Framework for the Regulation of Payment Service Banks (PSBs) 2021. Together, they create a tiered licensing architecture based on what you do with money — not merely how much passes through you.

PSP vs PSSP — The Critical Distinction

The Three Triggers: Processing vs Holding vs Escrow

• Processing Payments — You initiate or route a payment instruction on behalf of others. Example: Customer's card is charged via your platform and the money immediately settles to the merchant. If done through a licensed PSP (Paystack/Flutterwave), you inherit their license for this activity. Risk: LOW.
• Holding Funds — Customer money arrives into an account you control, sits there, and you later disburse it. Even for seconds/minutes, if funds rest in your account before reaching their destination, you are holding — not merely processing. This enters regulatory grey territory. Risk: MEDIUM–HIGH depending on duration and volume.
• Acting as Escrow — You hold funds intentionally pending a condition (job completion, dispute resolution). This is the most regulated activity. The CBN views this as quasi-financial intermediation. Without licensing, this is the highest-risk structure. Risk: HIGH.

Does Using Paystack/Flutterwave Protect Us?

The protection fails when:

• Money flows into your bank account rather than directly to the end recipient
• You hold funds for any material period (even in a Paystack sub-account you control)
• You make discretionary decisions about when/whether to disburse funds
• You are the merchant of record AND the ultimate beneficiary is a third party (artisan, school)

Volume & Time Thresholds

The CBN does not publish a simple "under ₦X you are fine" threshold. The test is functional: are you performing regulated activities? However, in practice, CBN enforcement attention intensifies when:

• Monthly transaction volumes exceed ₦100 million across your platform
• Average holding period for third-party funds exceeds 24–48 hours
• You have 100+ active merchants/schools/artisans receiving disbursements
• Your platform is identifiable as a "payment intermediary" in marketing materials

Is This Legal Without a CBN License?

Technically ambiguous. Practically risky. Structurally fixable.

The CBN's 2022 PSP Framework defines payment intermediation as collecting and holding funds on behalf of others for subsequent disbursement. SortAm's flow — collect from customer, hold, pay artisan — fits this definition. However, enforcement risk is presently low for small platforms if structured to minimize actual fund-holding.

The key mitigant: if funds never actually sit in an account controlled by SortAm Ltd, and instead remain within Paystack's licensed infrastructure with SortAm merely instructing the release, the argument shifts: Paystack is the holder; SortAm is a merchant with conditional payout logic. This is a defensible position that many Nigerian marketplaces operate under.

Safe Technical Implementation

Critical architectural rule: The Paystack balance used here must be SortAm's merchant balance, not a third-party customer balance. This means:

• Customer's payment settles to SortAm's Paystack merchant account (SortAm recognises this as revenue upon receipt)
• When job is confirmed, SortAm initiates a Paystack Transfer to the artisan's bank account
• SortAm's platform fee is retained; the net amount is transferred
• This frames the artisan payment as a vendor/contractor payment (SortAm paying its service providers) rather than SortAm holding customer money on behalf of the artisan

How Long Can We Legally Hold Funds?

There is no explicit CBN-mandated maximum holding period for unlicensed platforms because the CBN's position is that you shouldn't be holding third-party funds at all without a license. Practically:

• Under 24 hours: Effectively invisible — settlement timing
• 24 hours – 7 days: Acceptable for most job types with proper T&Cs
• 7–30 days: Elevated risk; document clearly in user agreements as "payment processing timeline"
• Over 30 days: High risk; approach PSSP licensing or restructure to milestone payments

Recommended SortAm policy: Maximum 14-day job period before automatic dispute window. Auto-release or auto-refund triggers at day 21 if no confirmation.

What Happens if a Customer Disputes?

This is where SortAm's lack of explicit licensing creates the most practical risk. A dispute management process that resembles financial arbitration (you holding funds while adjudicating) strengthens the case that SortAm is performing regulated financial services.

• Do: Frame dispute resolution as a "service quality complaint" process in T&Cs
• Do: Have a defined 72-hour resolution window
• Do: Allow Paystack chargebacks to serve as the financial remedy (this puts the licensed party — Paystack — in the dispute role)
• Don't: Position SortAm as an "escrow agent" in any marketing, legal, or T&C language
• Don't: Create a formal internal dispute tribunal that "decides" fund releases — this looks like financial regulation

Does SortAm Need a Separate Legal Entity?

Ensure SortAm Ltd's company objects clause in its CAC registration is broad enough to include "facilitating marketplace transactions and payment intermediation services". This doesn't confer regulatory approval but prevents challenge that the company is acting ultra vires.

Future Path: If SortAm Scales Significantly

If SortAm reaches ₦500M+ monthly GMV or 10,000+ active artisans, the PSSP license becomes the natural next step. At ₦250M capital requirement, this is achievable post-Series A. Early alternative: partner with a licensed PSSP (e.g., VoguePay, Interswitch) to provide the escrow infrastructure under their license while SortAm operates as an "agent" of the PSSP.

Is Klas a Payment Processor?

Klas collects ₦300/student/term as a platform fee while facilitating school fee payment. The regulatory analysis hinges entirely on where the bulk of the payment (the school fee itself) goes first.

Paystack Split Payment Implementation for Klas

• Each school is registered as a Paystack subaccount with their CAC/bank account details
• Klas creates a Split object: flat ₦300 to Klas main account + remainder (bearer: subaccount) to school
• When parent pays, Paystack routes simultaneously — Klas never holds school fees
• School receives funds within Paystack's standard settlement period (T+1 or T+2)
• Klas's role: technology platform, not payment intermediary

Do We Need PSB or PSSP License at Scale?

With Paystack Split properly implemented: No — even at 500+ schools.

The ₦5B PSB license is irrelevant — that's for deposit-taking. The PSSP question arises only if Klas begins holding funds, operating a school wallet system, or processing payments without a licensed intermediary. Using Paystack's infrastructure means Paystack's PSSP license covers the payment processing.

Monitor trigger: If Klas moves to direct bank integration (bypassing Paystack), or builds its own payment gateway infrastructure, PSSP licensing becomes necessary.

NDPA 2023 Implications for Klas Student Data

Key NDPA 2023 Requirements for Klas:

• Lawful basis: Processing children's financial data requires explicit parental/guardian consent. Klas must obtain this at onboarding — not buried in T&Cs.
• Data Minimisation: Collect only what is necessary. Student name + class + fee amount. Not biometrics, medical records, or family financial details beyond what fee collection requires.
• Data Processing Agreement (DPA) with schools: Schools are data controllers; Klas is a data processor. A formal DPA must be in place before any data exchange. This is a legal requirement under NDPA s.29.
• NDPC Registration: Klas must register with the Nigeria Data Protection Commission (NDPC) as a data controller/processor. Annual audit required once registered.
• Breach notification: Any breach of student financial data must be reported to NDPC within 72 hours of discovery.
• Data residency: Student financial data should be stored in Nigeria or countries with equivalent data protection standards. Confirm with your cloud provider (AWS Lagos, Azure, or similar).
• Retention policy: Define and enforce clear data retention periods. Payment records: 6 years (financial regulation). Student identity data: until student leaves school + 2 years.

What Would a Mpaukwu Wallet Be?

A cross-product stored balance — user tops up once, spends across MediSeen, SortAm, Klas, and Savour. This is the natural evolution but triggers the highest-tier regulatory requirements.

License Comparison for Wallet Products

Recommended Wallet Roadmap

White-Label / API Partner Options (Near-Term)

• Paystack (Stripe-owned): Paystack's sub-account + balance API allows partial wallet behaviour within their licensed ecosystem. Most straightforward integration.
• OPay: Licensed MMO with APIs for wallet top-up, transfers. Nigerian brand recognition. Partnership model available.
• Moniepoint: Licensed, strong SME focus — particularly relevant for SortAm artisans who may already bank with them.
• Interswitch (Quickteller): PSSP licensed. Enterprise-grade. Higher integration complexity but solid for Klas at scale.

🔴 Urgent — Do This Month (Days 1–30)

• 🔴
  Restructure SortAm payment flow — no funds in Mpaukwu/SortAm bank accounts Implement Paystack Transfers API so customer payments settle to SortAm's Paystack merchant balance (not bank account), then trigger bank transfers to artisans on job completion. This is the single most important structural change.
• 🔴
  Remove "escrow" language from SortAm marketing, T&Cs, and code comments Replace with "secure payment holding" or "payment protection." Escrow is a legally defined term that triggers CBN scrutiny. Do not use it in public-facing materials.
• 🔴
  Draft SortAm Terms of Service — payment clause Must specify: (1) that SortAm is a marketplace technology platform, (2) payment processing is provided by Paystack (a CBN-licensed entity), (3) funds release timeline, (4) dispute resolution process, (5) SortAm's liability limitation.
• 🔴
  Implement Paystack Split Payment for Klas — take ₦300, pass rest to school Onboard schools as Paystack sub-accounts. This eliminates any argument that Klas is a payment intermediary holding school funds. Critical before scaling beyond 50 schools.

🟡 Important — This Quarter (Days 31–60)

• 🟡
  Register with Nigeria Data Protection Commission (NDPC) Required for Klas (student data), MediSeen (patient health + financial data), and SortAm (personal + financial data). Fines for non-registration under NDPA 2023 can reach 2% of annual gross revenue or ₦10M, whichever is higher.
• 🟡
  Draft Data Processing Agreements (DPAs) for Klas schools Each school is a data controller. Klas processes on their behalf. A signed DPA is mandatory under NDPA 2023 s.29. Template should cover: data categories, processing purpose, retention, breach notification.
• 🟡
  Update Privacy Policies across all products — NDPA 2023 compliant Must include: lawful basis for processing, data subject rights (access, deletion, portability), retention periods, third-party processors (Paystack, cloud providers), children's data statement for Klas, contact details of Data Protection Officer.
• 🟡
  Appoint a Data Protection Officer (DPO) NDPA 2023 requires organisations processing large-scale personal data (like Klas and MediSeen) to designate a DPO. Can be an internal staff member or external consultant. Must be registered with NDPC.
• 🟡
  Confirm each product is a separate CAC entity with correct objects clause SortAm, Klas, MediSeen should each be individually incorporated with objects clauses that cover their specific activities. Separate entities limit CBN exposure contagion and provide cleaner audit trails.

🟢 Recommended — Within 90 Days

• 🟢
  Engage a Nigerian fintech/payment law firm for a 1-hour paid consultation Firms like Oluwaseun Afolabi & Co, Aluko & Oyebode, or Banwo & Ighodalo have payment regulation practices. Present this memo as briefing material. Cost: ₦100K–300K. Worth every kobo before SortAm or Klas scale significantly.
• 🟢
  Build SortAm dispute resolution SLA into product — 14-day max hold policy Define auto-release triggers: job confirmed = pay artisan within 24hrs. Job disputed = 72hr resolution window. Unresolved at 14 days = auto-refund to customer + platform investigation. Document in T&Cs.
• 🟢
  Configure Paystack webhook reconciliation for all products Every payment event (charge.success, transfer.success, transfer.failed) must be logged with timestamps. This creates an audit trail demonstrating you are a technology platform, not a fund manager.
• 🟢
  MediSeen: Ensure patient payment flows settle directly to hospital accounts If any patient payment currently settles to a MediSeen/Mpaukwu account, restructure as Paystack Split or direct merchant registration for each hospital client. MediSeen's revenue is only its SaaS/platform fee.
• 🟢
  Begin PSSP license research — understand requirements now, decide later Download CBN's PSP Regulatory Framework. Understand the ₦250M capital pathway, application process (typically: letter of intent → CBN feedback → application → approval in principle → full licence). Start the clock on understanding, not necessarily applying yet.

On Separate Entities — Does It Help?

Operating separate CAC-registered companies per product achieves three things:

• Ring-fencing: If SortAm faces CBN scrutiny, it does not drag MediSeen, Klas, or Savour into the investigation
• Cleaner licensing path: If SortAm applies for PSSP, the entity applying has a clean payment history and singular business purpose
• Tax efficiency: Each entity files independently; a loss in one does not complicate another's accounts

Ensure each entity has its own Paystack account, bank account, and CAC registration. Do not co-mingle funds between entities under any circumstances.

What T&Cs Must Say About Payments

Every Mpaukwu product with any payment touchpoint must have T&Cs that include:

• [ALL] Payment processing is provided by Paystack (RC: [number]), a CBN-licensed payment company
• [SortAm] "SortAm Limited is a technology marketplace platform and is not a licensed financial institution or escrow service. Payment facilitation is provided by our payment processor."
• [Klas] "Klas collects a platform fee of ₦300 per student per term. School fees are routed directly to the school's designated account via our payment processor. Klas does not hold or manage school funds."
• [ALL] Refund and dispute resolution process with clear timelines
• [ALL] Reference to NDPA 2023 data rights and how to exercise them
• [ALL] Governing law: Federal Republic of Nigeria. Dispute resolution: Lagos State courts or arbitration

• CBN Guidelines on Operations of Electronic Payment Channels in Nigeria (2020) — Primary framework governing payment channels, merchant obligations, and dispute resolution. Available at cbn.gov.ng.
• CBN Regulatory Framework for Payment Service Providers (2022) — Defines PSP categories, licensing tiers, capital requirements, and operational guidelines. Supersedes elements of the 2015 framework.
• CBN Framework for the Regulation of Payment Service Banks (2021) — Governs PSB licensing (₦5B capital). MTN MoMo, Airtel Money operate under this.
• Nigeria Data Protection Act 2023 (NDPA 2023) — Signed into law June 2023. Replaces NDPR 2019. Establishes NDPC, introduces DPA obligations, strengthens children's data rights, sets breach notification timelines.
• Paystack Split Payment API — Allows automatic splitting of a single transaction between a main account and one or more sub-accounts. Ideal for Klas fee-splitting. See: paystack.com/docs/payments/split-payments
• Paystack Transfers API — Enables programmatic bank transfers to any Nigerian bank account. Ideal for SortAm artisan payouts post job-completion. See: paystack.com/docs/transfers
• CBN Consumer Protection Framework 2016 (updated 2022) — Governs how payment-adjacent platforms must treat customers, including dispute resolution and liability.
• FCCPA (Federal Competition and Consumer Protection Act) 2019 — Relevant to SortAm marketplace conduct; prohibits deceptive practices in consumer transactions.