Is Your Business Compliant Beyond CAC Registration?

Registering a company with the Corporate Affairs Commission (CAC) is an important milestone for every Nigerian entrepreneur. Tax registration, annual returns, and proper financial records are also essential parts of running a business. However, one important question is often overlooked: Does your business have additional regulatory obligations based on the nature of its activities? Some business owners assume that once their company is incorporated and its tax records are in order, they have fulfilled every legal requirement. Unfortunately, this assumption can leave businesses unaware of other obligations that may apply to them, including anti-money laundering and counter-terrorism financing requirements.

For businesses classified as Designated Non-Financial Businesses and Professions (DNFBPs), applicable requirements may include registration with the Special Control Unit Against Money Laundering (SCUML), customer due diligence, transaction monitoring, recordkeeping, and statutory reporting. These requirements are not identical for every business. Their applicability depends on the nature of the business, the relevant legislation, and any applicable regulatory guidance. This article explains the relationship between the Economic and Financial Crimes Commission (EFCC), SCUML, and business compliance in Nigeria, helping business owners identify potential gaps and take appropriate action.

1. The Awareness Problem: CAC Registration Is Only One Part of Business Compliance Many entrepreneurs concentrate on establishing their businesses and securing the necessary incorporation documents. Once they receive their CAC certificate, they turn their attention to finding customers, generating revenue, managing employees, and expanding operations. These priorities are understandable. However, regulatory compliance should not end with incorporation. Depending on the nature of a company's operations, its compliance responsibilities may extend to:

A business may be compliant with one regulator's requirements while having outstanding obligations under another regulatory framework. For example, a company involved in covered real estate activities may have completed its CAC registration and tax registration but still need to determine whether SCUML registration and related anti-money laundering obligations apply to its operations. Similarly, a consulting company should not assume that its general business description automatically determines its regulatory status. It should assess its actual activities against the relevant legal classifications.

The lesson is simple: business compliance requires more than a certificate of incorporation. It requires understanding the obligations attached to the activities your company actually performs. 2. Understanding the EFCC and SCUML: What Is the Difference? The EFCC and SCUML are closely connected within Nigeria's anti-money laundering framework, but they have distinct roles.

What is the EFCC? The Economic and Financial Crimes Commission is a law enforcement agency established to address economic and financial crimes. Its responsibilities include investigating and enforcing relevant laws concerning financial crimes and related offences. The EFCC also plays an operational role in Nigeria's anti-money laundering and counter-terrorism financing framework.

However, this does not mean that every incorporated company must submit a routine filing directly to the EFCC simply because it operates in Nigeria. Whether a business has a specific reporting obligation depends on the applicable law, the type of business, the nature of the transaction, and the relevant regulatory requirements.

What is SCUML? SCUML stands for the Special Control Unit Against Money Laundering. It is responsible for the registration, monitoring, and supervision of relevant Designated Non-Financial Businesses and Professions within Nigeria's AML/CFT framework. Its functions include:

SCUML operates within the EFCC's operational environment, while its regulatory mandate is connected to the relevant statutory framework and institutional arrangements. The principal legislation to understand includes the Money Laundering (Prevention and Prohibition) Act, 2022, alongside applicable regulations, guidelines, and official directives. Business owners can consult the official SCUML website and its laws and regulations page for authoritative information.

What about the NFIU and other regulators? The Nigerian Financial Intelligence Unit (NFIU) is another important institution in the country's financial intelligence framework. It receives and analyses financial intelligence and disseminates relevant information to competent authorities in accordance with applicable law. Other regulators may have responsibilities depending on the business sector. For example, a company operating in a regulated professional or financial services sector may have obligations beyond those administered by SCUML.

Understanding which authority is responsible for a particular registration, filing, or report helps businesses avoid confusing different regulatory requirements. 3. Which Businesses May Need SCUML Registration? Not every Nigerian business is required to register with SCUML.

The official SCUML guidance explains that the relevant categories are determined by the Money Laundering (Prevention and Prohibition) Act, 2022, and the applicable regulatory framework. Businesses and professions identified within SCUML's regulatory scope include categories such as:

This list is illustrative rather than a substitute for checking the current legal requirements and the exact classification of a business.

Why real estate companies should pay attention

Real estate businesses can be exposed to financial crime risks because property transactions may involve substantial sums, multiple parties, intermediaries, and complex ownership arrangements. Consequently, relevant real estate activities are included within the categories identified by SCUML. A property company should therefore assess whether its activities as a developer, estate agent, broker, or other covered operator bring it within the applicable requirements.

What about consulting and general business services? The term "consulting" covers a broad range of activities. A business offering management consulting, compliance advisory, or other professional services should review the applicable classifications rather than relying solely on its registered name or object clauses.

The same principle applies to procurement companies, trading businesses, logistics providers, and other service providers: the fact that a company handles payments or commercial transactions does not, by itself, establish that it must register with SCUML.

The correct approach is to assess the company's actual activities and determine whether the applicable legislation covers them. For further guidance, consult the official SCUML mandate and functions and registration guidelines.

4. What Does Compliance Actually Involve? For a business within the relevant regulatory scope, compliance may extend beyond obtaining a SCUML certificate.

The requirements applicable to a particular business should be confirmed against the current legislation, official guidelines, and relevant reporting directives. Important areas to assess include the following.

A. SCUML registration and certification Where a business is required to register, it should complete the applicable registration process and maintain its compliance records.

The official SCUML registration guidelines identify documents that may include:

The exact documents depend on the business type. Applicants should consult the current official checklist before submitting an application. Important: SCUML states that its registration and certification are free of charge. A business may separately choose to pay a professional adviser for legitimate assistance with document preparation or compliance advisory services, but such a service fee must not be represented as an official SCUML registration fee. B. Anti-money laundering and counter-terrorism financing policies Covered businesses may need internal procedures to identify, assess, and manage the risks of money laundering, terrorism financing, and related prohibited activities.

Depending on the applicable requirements, these procedures may address: • Risk assessment and risk-based controls. • Customer identification and verification. • Identification of beneficial owners where applicable. • Enhanced checks for higher-risk customers and transactions. • Internal escalation of suspicious activities. • Staff awareness and compliance training. • Retention of required records. • Reporting responsibilities and oversight.

A written policy should reflect the actual business model and the legal requirements applicable to the entity. A generic document that is never implemented is not an effective compliance system.

C. Customer due diligence Customer due diligence involves taking appropriate steps to establish who a customer is and understand relevant aspects of the business relationship or transaction. Depending on the applicable rules and risk profile, a business may need to verify customer information, identify beneficial ownership, understand the purpose of a transaction, and conduct additional checks where risks warrant them. For example, a covered real estate business may need procedures for verifying clients and understanding the parties involved in a property transaction. The objective is to help identify and manage risks, not simply to collect documents without reviewing them.

D. Transaction monitoring and recordkeeping Businesses should maintain accurate records in line with their applicable statutory obligations. Depending on the relevant rules, this may include customer records, transaction documentation, due diligence evidence, internal compliance records, and information needed to support regulatory reporting. A business should also consider whether its procedures can identify transactions that require further review. Proper recordkeeping supports transparency, internal accountability, and the ability to respond to lawful regulatory requests.

E. Applicable statutory reporting One of the most easily misunderstood aspects of compliance is transaction reporting. Different reports may apply to different circumstances. These can include prescribed currency or cash-based transaction reports and suspicious transaction or suspicious activity reports, as applicable under the relevant framework.

Businesses should not assume that every transaction requires a report, nor should they assume that only large transactions matter. Reporting obligations depend on the applicable legal criteria, transaction characteristics, thresholds where prescribed, and relevant regulatory guidance. SCUML's official website currently states that, from 1 January 2026, currency transaction reports and cash-based transaction reports are to be submitted through its portal rather than by email. Covered businesses should consult the latest official reporting procedures and ensure that authorised personnel can access the required portal.

See the official SCUML website and reporting notice for current instructions. Suspicious transaction reporting is a separate compliance consideration. Businesses should follow the applicable reporting rules and current SCUML/NFIU guidance rather than treating every reporting obligation as interchangeable.

5. What Are the Risks of Ignoring Applicable Compliance Obligations? Failing to meet a legal obligation can create regulatory, operational, and reputational problems. The consequences depend on the specific requirement, the circumstances of the breach, and the enforcement provisions that apply.

Potential consequences may include: Regulatory scrutiny: A business may be asked to provide records, explain its procedures, or demonstrate compliance during an appropriate supervisory review.

Enforcement action: Where a breach is established, the relevant authority may take action available under the applicable law or regulations. Operational disruption: Resolving compliance deficiencies may require additional documentation, management time, staff training, and changes to internal procedures.

Reputational damage: Customers, commercial partners, banks, or other stakeholders may have concerns when a business cannot demonstrate that it meets relevant legal requirements. Greater remediation costs: Identifying a compliance gap early can be easier than addressing it after a regulatory enquiry or an internal review reveals weaknesses.

These are potential risks, not automatic outcomes. A business should not assume that an outstanding filing will necessarily result in a particular penalty, prosecution, or account restriction. The legal consequences must be assessed against the facts and the applicable law. The most practical response is to identify obligations early, maintain adequate records, and address deficiencies promptly.

6. How Can Your Business Check Its Compliance Position? Business owners do not need to wait for a regulatory enquiry before reviewing their obligations. A structured compliance review can help identify outstanding requirements and establish a plan for addressing them.

Step 1: Review your business activities Start with your CAC documents, business profile, services, and actual commercial activities. Determine whether your company operates within any category subject to additional registration, licensing, or AML/CFT requirements.

Step 2: Confirm whether SCUML registration applies Check the relevant statutory provisions and current official SCUML guidance. Do not rely solely on information from social media, informal advice, or a company's name. Where the classification is unclear, seek appropriate professional or regulatory clarification. Step 3: Check your existing records

Review the availability and accuracy of your incorporation documents, tax registration evidence, applicable licences, compliance policies, customer records, and transaction documentation. Identify missing documents and outdated information.

Step 4: Review AML/CFT procedures Where applicable, determine whether your business has suitable risk assessment, customer due diligence, recordkeeping, internal escalation, training, and reporting procedures. Assign responsibility to an appropriate person and ensure that staff understand the procedures relevant to their roles.

Step 5: Verify reporting obligations Check whether your business must submit particular reports, what events trigger them, the relevant deadlines, and which official channel must be used. Confirm current portal procedures rather than relying on outdated instructions. Step 6: Address identified gaps Prepare a practical action plan that identifies each outstanding requirement, the responsible person, the documents needed, and the steps required to achieve compliance. Keep evidence of submissions and approvals, and monitor for changes in applicable laws or regulatory instructions.

7. Why Proactive Compliance Is Good for Business Compliance should not be viewed solely as a response to regulatory pressure. It is also an important part of sound business management. A well-organised compliance system can help a company: • Maintain more reliable corporate and regulatory records. • Identify legal obligations before they become urgent. • Strengthen internal accountability and risk management. • Improve preparedness for appropriate due diligence by business partners. • Reduce avoidable administrative errors. • Support sustainable growth and responsible operations.

No compliance adviser can guarantee that a business will never face a regulatory enquiry or enforcement action. Nevertheless, understanding the rules and maintaining appropriate procedures can put a business in a better position to demonstrate that it takes its legal responsibilities seriously. For growing Nigerian businesses, the goal should be to build compliance into everyday operations rather than treating it as an occasional paperwork exercise. Conclusion: Close the Compliance Gap Before It Becomes a Problem CAC incorporation and tax compliance are important, but they may not represent the full extent of a company's regulatory responsibilities. Depending on the nature of its activities, a Nigerian business may also need to assess SCUML registration, AML/CFT procedures, transaction reporting, sector-specific licensing, and other applicable obligations.

The EFCC, SCUML, NFIU, CAC, and tax authorities have different responsibilities within Nigeria's regulatory environment. Understanding those distinctions helps businesses identify the right requirements and avoid unnecessary filings or missed obligations. The first step is not to assume that every company must submit a direct filing to the EFCC. It is to establish which legal and regulatory requirements actually apply to your business and take appropriate action.

Is your business fully compliant beyond CAC registration? SkyReign Limited helps businesses understand applicable regulatory requirements, prepare compliance documentation, and navigate relevant registration and filing processes. Whether you are establishing a new company, reviewing an existing business, or seeking clarity on additional compliance obligations, a structured assessment can help you identify the next steps.

Contact SkyReign Limited for a business compliance assessment. Website: https://www.skyreigngroup.com/

Disclaimer: This article is provided for general information and business education. It is not legal advice and does not replace a review of the legislation, current regulatory guidance, or the circumstances of a particular business. Regulatory requirements may change; readers should verify current requirements with the relevant authorities or an appropriately qualified professional.