Compliance control plane for Nigerian payment groups to localize data, track share caps, and restructure flows before CBN deadlines.

1. Cross-side market-share caps turn payments growth strategy into a live compliance constraint, so operators need daily visibility into how issuing and acquiring volumes interact.
2. A January 1, 2027 local-storage deadline forces payment groups to inventory and migrate transaction datasets now rather than defer infrastructure cleanup.
3. Monthly reporting requirements create a recurring workflow with a natural software budget, because legal teams cannot manually rebuild cap calculations every month.
4. Named exposure for Paystack, Flutterwave, Moniepoint, and large banks shows the rule affects the operators most able to buy a control plane immediately.

Catalyst. The CBN has paired structural market-share limits with a hard onshore-data deadline and monthly reporting, making compliance an immediate systems problem instead of a slow policy discussion.

The product ingests issuing, acquiring, switch, merchant, and cloud-storage events into a Nigeria-resident ledger that normalizes volume by legal entity, product line, and rail. It calculates regulator-facing share metrics, tracks beneficial-ownership evidence, and produces a monthly compliance pack with the exact transactions behind each figure. Operators get forecasts that show how a new merchant segment, issuer partnership, or M&A move would push them toward the 25% and 15% thresholds before they commit capital. The same control plane maps which datasets still sit outside Nigeria and orchestrates migration priorities, retention policies, and audit logs for local-storage compliance. Over time, it becomes the operating system for market-structure decisions, not just a reporting tool.

What's different. Local cloud vendors can host data in Nigeria, and generic GRC software can store policies, but neither product computes payment-market concentration the way a regulator will see it across entities and rails. Merchant analytics dashboards also stop at business intelligence rather than filing-grade evidence. This startup wins by combining a Nigeria-resident transaction ledger, cap-specific market-share logic, ownership disclosure workflows, and remediation scenario modeling in one system. Its moat compounds from normalized transaction history, regulator-ready denominator models, and the workflow data around how operators actually stay compliant while still growing.

Jobs to be done

flowchart LR
  Buyer[Compliance and payments ops leader] --> Pain[Cannot prove share-cap and data-localization compliance]
  Pain --> Product[Payments cap compliance OS]
  Product --> Outcome[File on time and keep growing without breaching CBN limits]

Executive takeaways

• The wedge is real: the regulation turns concentration monitoring and data residency into dated operating work, not abstract policy risk.
• The beachhead is commercially urgent but logo-constrained; Nigeria works as a sharp entry wedge, not a complete standalone market story.
• The best buyers are payment groups broadening across both merchant and consumer sides because structural risk rises as they add banking, cards, and POS footprint.
• Execution risk is as much about integrations and migration sequencing as legal interpretation, so cloud and advisory partnerships matter early.

Market definition

Nigeria-first software and workflow tooling for regulated payment groups that need to measure cross-side concentration, evidence in-country payment-data storage, and defend monthly filings at transaction level.

Customer and buyer

The practical buyer is a chief compliance officer, COO, or group CTO inside a large Nigerian payment group. The deal closes when one person has to own filing accuracy, infrastructure repatriation, and entity-level market-share exposure at the same time.

Buying triggers

• The new circular converts concentration monitoring into monthly market-share returns with a year-end 2026 market-structure deadline and a January 2027 storage deadline. [1][2]
• Expansion from merchant payments into banking, deposits, cards, and consumer finance raises the chance that one group now straddles both sides of the network. [22][23][24][25]
• Local-cloud and data-centre buildouts create natural budget cover for repatriation and compliance programs that a control plane can attach to. [32][33][34]

Willingness to pay

This looks like an enterprise-budget problem, not SMB SaaS. Buyers already absorb recurring compliance work, migration spend, and payment-ops risk, so a tool that shrinks monthly return effort and de-risks onshore readiness can sell as part of a broader remediation program. [1][4][5][33][34]

Category dynamics

Growth signal 39% increase in NIP transaction value in H1 2024 versus H2 2023

Validation signals

• The CBN has converted concentration risk into a dated monthly workflow, which is the kind of forcing event that usually creates software budgets.
• Large operators are actively broadening across issuing, acquiring, and banking layers, making group-level exposure more complex over time.
• Local infrastructure vendors and telcos are already spending heavily to repatriate workloads, indicating that onshore-storage projects are budgeted now.
• Merchant-side infrastructure remains strategic, with banks still deploying tens of thousands of POS terminals to compete with fintech acquirers.

Regulatory & technical constraints

• Any production system must model share caps across related entities because the circular is aimed at institution and group-level market power, not just one product line.
• Payment data generated in Nigeria must be stored and managed locally from 2027, so architecture choices become compliance decisions.
• Monthly returns rely on PTSA, processor, and terminal-routing visibility rather than general-ledger data alone.
• UBO and automated AML obligations widen onboarding, audit, and governance expectations around counterparties and control persons.

Direct Nigeria-specific cap-compliance software still appears sparse, but buyers can already assemble partial substitutes from horizontal GRC, data governance, local hosting, processor dashboards, and advisory work. The winning product therefore has to collapse those fragments into one regulator-grade workflow rather than compete on a generic dashboard.

Why incumbents do not win by default

• Cloud platforms. Local hosting solves only the sovereignty layer; it does not compute CBN-style market-share math or monthly filing evidence by entity and rail.
• Generic GRC suites. Horizontal IRM and GRC products bring workflow depth, but they still need heavy customisation before they resemble Nigerian payments supervision logic.
• Data governance suites. Cataloging and lineage are useful inputs, yet they stop short of regulator-ready denominator models, remediation scenarios, and filing packs.
• Payment rails and processors. Processors own valuable transaction data, but buyers may resist relying on a market participant as the neutral arbiter of group-level concentration exposure.
• In-house BI and manual ops. Internal dashboards can reproduce one report, but recurring routing changes, agent rules, and monthly filings turn the problem into workflow software rather than one-off analytics.

Payments Cap Compliance OS should be built as a Nigeria-first compliance control plane for payment groups that now have to prove both market-share discipline and local data storage under new CBN deadlines. The most credible first customer is a large Nigerian payments group that operates across issuing and merchant acquiring, stores some payment data outside Nigeria, and has already launched a board-level remediation program for December 2026 readiness. The immediate pain is not generic GRC; it is the monthly work of reconciling processor, merchant, entity, and hosting data into one regulator-grade view that can survive audit and still inform commercial decisions. The strongest wedge is therefore a paid diagnostic and filing workflow that computes cap exposure by entity and rail, produces the first monthly filing pack, and identifies which datasets must be moved onshore first. Research supports a real timing catalyst, but it also shows the market is logo-constrained, with an estimated $9.0M TAM, $3.8M initial SAM, and $1.5M year-3 SOM unless the company expands into adjacent geographies or rule sets. Product, pricing, and channels must all stay aligned to that constraint: founder-led sales into compliance and CTO buyers, onboarding tied to one high-risk group structure, and annual pricing by legal entities plus monitored payment volume. The main reason to believe is that incumbents each solve only one slice of the problem, while the new regulation forces customers to unify compliance math, data lineage, and remediation workflow in one place. The main reason to doubt is that the underlying circular PDF was not fetched in research, so exact denominator definitions, aggregation logic, and sanctions still need confirmation before the product hard-codes policy assumptions.

Problem

• Dual-sided Nigerian payment groups often cannot calculate issuing and acquiring exposure across subsidiaries, rails, and partner flows with enough precision to file monthly regulator-grade reports.
• The same operators must now repatriate payment data into Nigeria and document beneficial ownership under deadline, but those workstreams usually sit across separate compliance, engineering, legal, and infrastructure teams.

Solution

• Provide a Nigeria-resident compliance ledger that ingests payment, entity, and storage-footprint data, normalizes it by legal entity and rail, and computes CBN-style market-share exposure with transaction-level evidence.
• Start with a paid diagnostic plus first filing workflow, then expand into remediation scenarios, onshore-data migration tracking, and recurring monthly compliance operations for the whole payment group.

Why we win

• The wedge sits exactly where substitutes break down: local hosting vendors do not compute share-cap math, generic GRC tools do not model payment rails, and internal BI cannot sustain versioned monthly filings plus remediation workflow.
• Each filing cycle compounds proprietary value in entity mapping, denominator assumptions, remediation playbooks, and onshore-data lineage that make the system harder to replace than a one-off consulting project.

Milestones

flowchart LR
  Wedge[Paid cap-compliance diagnostic] --> MVP[Read-only filing and evidence ledger]
  MVP --> Proof[Trusted monthly filings and remediation plans]
  Proof --> Expansion[Multi-entity and multi-market compliance OS]

Founding team

Experiment roadmap

Risk assessment

What must be true

• At least 40% of qualified beachhead accounts must already reconcile cap exposure or storage readiness through spreadsheets, manual exports, or fragmented advisory work.
• The first filing-grade diagnostic must convert to annual production in at least half of early deployments because the workflow repeats monthly.
• Rules versioning must absorb primary-circular ambiguity without turning every customer into a custom policy implementation.
• One Nigerian payment group must support annual ACV in roughly the $180k-$300k range once entities and monitored volume are live.
• Nigerian proof points must transfer into adjacent African sovereignty or market-structure rules before the initial logo pool saturates.

Open diligence questions

• What exact denominator, rail, and related-party definitions does the primary CBN circular use for the 25% and 15% tests?
• Who inside the first target account actually controls budget when compliance, data migration, and payments operations all touch the same problem?
• How many source systems and cloud regions must be mapped before one filing-grade model is credible enough for production use?
• Will buyers accept a read-only evidence ledger first, or do they expect deeper workflow automation before signing annual software?
• Which partner channel sources the fastest qualified opportunity: local counsel, audit firm, AML vendor, or cloud migration partner?

Model sanity

• Revenue engine. The base case reaches about $1.54M of Y3 revenue by filling the six-logo SOM ceiling and lifting blended revenue per group from $156K to $264K as diagnostics convert and entity expansions attach.
• Must go right. Two of the first three diagnostics need to convert and the sixth logo must land by Q1Y3, because the model deliberately avoids building a large sales team.
• Model breaks if. If the company tops out at five active groups and $240K mature annualized revenue per group, downside cash dips slightly negative before the end of Y3.
• Next-round proof. A credible seed story is five active logos, two entity expansions, repeatable connectors, and one adjacent-jurisdiction pilot without missing the 70% steady-state gross-margin target.

Scenarios

Sensitivity

flowchart LR
  DiagnosticsAndReferrals --> ActiveGroups
  ActiveGroups --> BlendedARPU
  BlendedARPU --> Revenue
  Revenue --> GrossProfit
  GrossProfit --> Cash

Flags: The immediate Nigeria-only logo universe is small, so the model depends on expansion revenue per group rather than large customer-count growth. · Research did not fetch the primary CBN circular PDF, so filing denominators and aggregation logic still need counsel validation before the rules engine is hard-coded. · The base case stays EBITDA-negative through Y3; if delivery work proves more bespoke than planned, the $2.0M ask will need to move toward the middle of the BP range. · No hires are added after M18, so execution risk rises if implementation, support, or adjacent-jurisdiction work requires more local staffing than the plan assumes.

• Regulatory ambiguity. Because the underlying circular PDF was not directly fetched, the exact calculation method or enforcement details may shift after operators read the primary text. Mitigation: Pilot with configurable rules, validate early with local counsel and design partners, and treat every formula and filing template as versioned policy rather than hard-coded logic.
• Limited initial logo count. Only a relatively small set of Nigerian operators are large and complex enough to feel immediate pain from both share caps and data-localization rules. Mitigation: Target the highest-risk groups first, then expand into banks, switches, and nearby African markets where the same control plane solves adjacent sovereignty and concentration rules.
• Heavy integration burden. The product must ingest fragmented transaction, entity, and cloud-storage data before it can prove ROI, which can slow deployment. Mitigation: Start with read-only connectors and a reporting-only diagnostic, then phase into deeper data-localization and scenario modules once the compliance baseline is trusted.