SCUML Compliance in 2026: What Every Nigerian Business Owner Needs to Know Before the Deadline

Regulatory Briefing · SME360 Integrated Solutions Ltd
By John Agbo, MBA, ACA, ACTI, ACMA, CGMA · Founder & Managing Director · 8 min read

Where this sits on the Enterprise Readiness Ladder™

01	Corporate Structure	Legitimacy of existence
02	Statutory Compliance	Legitimacy to operate	▸ You are here
03	Governance & Internal Controls	Capacity to grow
04	Managed Fiscal Operations	Understanding
05	Financial & Digital Infrastructure	Visibility
06	Institutional Readiness	Fundability and scale

Each layer carries the one above it. See the full framework →

Key takeaways

SCUML registration is mandatory for designated non-financial businesses (DNFBPs), not just banks and financial institutions.
From 1 January 2026, statutory reports must be filed through the SCUML portal rather than by email.
Registration is free, but the obligations that follow it are ongoing.
Non-registration or lapsed compliance, not certificate expiry, is what blocks banking, funding and contracts.
If you are unsure of your status, verify it before your next reporting cycle.

A missing or lapsed SCUML certificate can stop a Nigerian business from opening a corporate bank account, drawing down development finance, onboarding as a corporate vendor, or bidding for a government contract. Yet thousands of businesses that fall within scope have no idea the requirement applies to them, and many that did register have never filed the ongoing returns the law demands.

Here is the uncomfortable part: the EFCC does not need to prove wrongdoing, only that you were required to comply and did not.

In 2026 this stops being something a business can treat as an afterthought. There is also a genuine change this year that almost nobody is talking about correctly, and it is not the “renewal deadline” circulating on registration-agent blogs. Here is what is actually happening, what it means for your business, and exactly what to do before it costs you money.

First, the change that actually matters in 2026

The Special Control Unit Against Money Laundering (SCUML) has directed that from 1 January 2026, all statutory reports must be filed exclusively through the SCUML online portal. Paper filings, email submissions and the old workarounds are being retired.

If your business is a registered Designated Non-Financial Business or Profession (DNFBP) and you do not yet have your SCUML portal login, you set up or retrieve your credentials on the SCUML portal itself, and contact SCUML support only if you cannot access or recover them. Without portal access, you cannot file the reports the law requires, and a registered business that stops filing is, in practical terms, a non-compliant business.

This is the deadline that belongs on your calendar. It is not a one-off certificate purchase; it is the start of a continuing, digital compliance relationship.

What SCUML actually is

SCUML, the Special Control Unit Against Money Laundering, is a unit of the Economic and Financial Crimes Commission (EFCC). It is the authority responsible for registering, monitoring and supervising DNFBPs under the Money Laundering (Prevention and Prohibition) Act 2022 (MLPPA 2022) and the EFCC/SCUML Regulations 2022. Registration is handled through the official SCUML portal.

In plain terms: the EFCC supervises banks and financial institutions, while SCUML supervises everyone else who handles enough money to be a money-laundering risk: estate agents, lawyers, accountants, car dealers, hotels, jewellers, NGOs, and more. If you fall into one of those categories, SCUML is your regulator whether or not you have ever interacted with it.

Who is legally required to register

Registration obligations are determined by what your business does, not by its size, turnover or structure. A one-person estate agency registered as a business name carries the same obligation as a large limited company in the same sector.

DNFBPs designated under Section 30 of the MLPPA 2022 include:

Real estate agents, developers and property businesses
Legal practitioners and notaries (when handling client funds or designated transactions)
Accountants, auditors and tax advisers
Dealers in jewellery, precious stones and precious metals
Dealers in cars and other luxury goods
Hotels and the wider hospitality sector
Casinos, lottery, betting and other gaming operators
Trust and company service providers
Non-governmental organisations and other civil society organisations
Clearing, settlement and certain logistics operators
Practitioners of mechanised farming
Other cash-intensive or high-risk businesses designated by the regulations

Do you need SCUML? A quick check

If your business operates in any of these sectors, you very likely need to register:

✓ Real estate agents, developers and property businesses
✓ Legal practitioners (when handling client funds or designated transactions)
✓ Accountants, auditors and tax advisers
✓ Hotels, hospitality and event centres
✓ Dealers in cars, jewellery, precious stones and metals, and other luxury goods
✓ Casinos, lottery, betting and gaming operators
✓ NGOs, civil society organisations and foundations
✓ Trust and company service providers
✓ Clearing, settlement and certain logistics operators
✓ Mechanised farming practitioners

This is a guide, not a ruling. Designation under Section 30 of the MLPPA 2022 turns on your actual activities, not your company name or size, so confirm your status rather than assuming you are in or out.

If your sector appears here, or your business routinely handles large cash transactions, assume you are in scope and confirm it rather than assuming you are exempt.

The “renewal window” myth: what really causes lapsed compliance

A lot of content online warns about a SCUML “renewal deadline.” It is worth being precise, because the misconception is itself a risk.

The official position is that the SCUML certificate does not carry a fixed annual expiry the way a CAC annual return or a tax clearance certificate does. Once issued, the registration generally remains valid, and there is no government renewal fee.

So where does “lapsed compliance” actually come from? Not from a certificate quietly expiring on a date, but from a failure to meet the ongoing obligations. The real causes are:

Failing to file the required reports (the obligation that becomes portal-only from 1 January 2026).
Failing to update SCUML when your company details change (name, directors, registered address, or business objectives). A certificate tied to outdated records can be treated as invalid.
Failing to maintain the underlying compliance programme: customer due diligence, records, and a designated compliance officer.

This is precisely where most businesses are let down by how they bought compliance in the first place. A registration agent registers your company and exits. The certificate lands in your inbox, the relationship ends, and the ongoing obligations (the part that actually keeps you compliant) are left to a busy owner who does not know they exist. You do not lose compliance because a clock ran out. You lose it because the certificate was treated as a one-time formality instead of a managed, ongoing function. The practical effect is identical to never registering at all.

What missing or lapsed SCUML compliance costs you

This is where the abstract becomes expensive.

You cannot open or keep a corporate bank account. Nigerian banks are required to obtain a valid SCUML certificate from DNFBPs before opening accounts, and many now re-verify existing customers. A frozen or rejected account stops everything: payroll, supplier payments, collections.

You are locked out of development finance. Development finance institutions (DFIs), grant programmes and intervention funds run anti-money-laundering due diligence as standard. A missing or out-of-date SCUML status is a fast, clean reason to disqualify an applicant, and you rarely get a second look. In practice, compliance status determines eligibility before your merit is ever assessed.

You lose government and large corporate contracts. Procurement and vendor onboarding routinely require proof of SCUML registration. No certificate, no bid.

You expose your business, and yourself personally, to penalties. The MLPPA 2022 and the EFCC/SCUML Regulations 2022 prescribe administrative and criminal penalties for non-compliance, and liability is not limited to the company. Directors, partners and compliance officers can be held personally liable. SCUML can also conduct announced or unannounced inspections, and a business that cannot produce its certificate, AML policy and records faces immediate action.

Penalties snapshot

Where you fall short	What it can trigger
Failure to register when required	Regulatory sanctions; inability to open or keep corporate accounts
Failure to file required reports	Administrative penalties and a record of non-compliance
Weak or absent AML controls	Adverse findings during supervision
Cannot produce records at inspection	Escalated enforcement; possible EFCC or NFIU referral
Director or compliance-officer default	Personal liability, including possible criminal exposure

The regulator does not have to prove you laundered anything. It only has to establish that you were required to comply and did not.

How to register: the process, documents and cost

SCUML registration is done entirely online through the official SCUML portal operated by the EFCC. It is free. No government fee is charged at any stage, and you should never pay anyone for the certificate itself. (You may choose to pay a professional to prepare and file correctly. That is a service fee, not a certificate fee.)

The documents typically required are:

CAC Certificate of Incorporation or Business Name Registration
CAC Status Report
Certified True Copy of the Memorandum and Articles of Association (MEMART), for companies
Tax Identification Number (TIN) registration printout
Bank Verification Number (BVN) of directors or proprietors
Bank details of at least one director or proprietor
A valid means of identification for at least one director or proprietor
Sector-specific professional certification, where applicable

A few practical notes that save weeks:

Match every detail to your CAC records. Inconsistent or incorrect information is the single most common cause of delay or rejection.
Upload clean, legible scans in the required formats.
Expect a verification period. Straightforward applications can clear in days; many take three to four weeks depending on document quality and SCUML’s verification queue.
The certificate is issued as a soft copy. The EFCC no longer issues hard copies, so you print the soft copy for your records.

Newly established DNFBPs are expected to register within three months of commencing operations. If you are past that window, the right move is to register now, not to wait.

Common reasons applications are delayed or rejected

Most hold-ups come down to a short, avoidable list: information that does not match across your CAC documents and the application; mismatched personal details of directors or beneficial owners across their BVN, NIN, means of identification and CAC records; poor-quality or unclear scans; a missing director BVN or means of identification; outdated company particulars such as directors, address or objects; and incorrect sector classification. Check every detail against your current CAC Status Report before you submit, and make sure each director’s and beneficial owner’s name, date of birth and other particulars are consistent across their BVN, NIN and ID, and you avoid weeks of back-and-forth.

After the certificate: your ongoing compliance calendar

Getting the certificate is the beginning, not the end. From 2026 these obligations run through the portal, so portal access is now part of staying compliant, and they are best run as a managed, recurring calendar rather than remembered ad hoc:

Customer Due Diligence (CDD): identify and verify your customers before designated transactions, and keep that documentation.
Currency Transaction Reports (CTRs) / Cash-Based Transaction Reports: report cash transactions above the threshold (in excess of US$1,000 or its equivalent) within seven days of the transaction.
Nil reports: where there are no reportable transactions, you are still expected to file a nil report on a monthly basis, in the format SCUML prescribes.
Suspicious Transaction Reports (STRs): file with the Nigerian Financial Intelligence Unit (NFIU). STRs have no monetary threshold: suspicion alone triggers the duty.
An AML/CFT/CPF programme: maintain written anti-money-laundering policies, designate a compliance officer, conduct risk assessments, and capture beneficial ownership information.
Record-keeping: retain customer and transaction records so they can be produced during an inspection.

Where SCUML fits in your wider business infrastructure

SCUML rarely fails in isolation. It is one obligation inside a stack (CAC annual returns, Tax Clearance Certificate, PENCOM, NSITF, ITF) that together determine whether your business is eligible before anyone assesses how good it is.

In the SME360 Enterprise Readiness Ladder™, SCUML sits in Layer 02, Statutory Compliance: built on a sound corporate structure (Layer 01), and the platform on which governance, fiscal operations and institutional readiness are later stacked. Treat it as a standalone certificate and it lapses quietly. Treat it as one tracked item on a continuously managed compliance calendar, alongside your other statutory obligations, and it stops being a source of nasty surprises. Running that calendar so nothing slips is exactly what our Statutory Compliance Management service line exists to do.

Your pre-deadline action checklist

Work through this before the new portal-only reporting regime catches you out:

Confirm whether you are a DNFBP. If your sector is on the list above, treat yourself as in scope until proven otherwise.
Locate your SCUML certificate, or accept that you need to register.
Get portal access now. If you are registered but have not used the portal, set up or recover your login on the SCUML portal, and contact SCUML support if you get stuck, before reporting goes portal-only.
Reconcile your records. Make sure your name, directors, address and objectives at SCUML match your current CAC records, and update SCUML if anything has changed.
Stand up the basics: name a compliance officer, put a simple written AML policy in place, and start keeping CDD and transaction records.
Set a recurring reminder for your monthly nil/transaction reporting so it never lapses.
Track SCUML alongside your other annual items (CAC annual returns, tax clearance, sector licences) as a single compliance routine rather than scattered fire-fighting.

If you would rather not audit all of this alone, a Business Infrastructure Diagnostic covers your registration status, compliance position and records in one structured review.

A note on accuracy and professional advice

SCUML guidance, thresholds and procedures are updated periodically, and some of the information circulating online (including claims about renewal cycles and exact penalty figures) is inconsistent or out of date. Treat this article as a starting point, verify the current requirements directly via the official SCUML/EFCC portal, and consult a qualified compliance professional for advice specific to your business. This is general information, not legal advice.

Frequently asked questions

Is SCUML registration free?

Yes. SCUML charges no government fee at any stage, and you should never pay anyone for the certificate itself. SCUML has publicly warned that individuals and entities advertising paid SCUML registration on social media and elsewhere are not its agents, affiliates or representatives, and that businesses dealing with them do so at their own risk. You may choose to pay a professional for help preparing and filing the application correctly, but that is a service fee for the work, not a fee for the certificate, and the filing itself is still done on the free official portal.

Does a SCUML certificate expire annually?

Generally, no. The certificate does not carry a fixed annual expiry the way a CAC annual return or tax clearance certificate does. Your reporting and compliance obligations, however, continue, and from 1 January 2026 those reports must be filed through the SCUML portal.

Can I open a corporate bank account without SCUML?

If your business falls within a designated DNFBP category, most Nigerian banks will require a valid SCUML certificate before opening, or continuing to operate, your corporate account.

Who needs to register with SCUML?

Designated Non-Financial Businesses and Professions (DNFBPs) under Section 30 of the MLPPA 2022, including real estate, legal, accounting and tax practice, hospitality, car and luxury-goods dealers, gaming and betting, NGOs, and trust or company service providers.

How long does SCUML registration take?

It varies with the quality of your documentation and SCUML’s verification queue. Straightforward applications can clear in days, while many take three to four weeks.

What happens if I never register?

You risk banking restrictions, exclusion from funding and procurement, and administrative or criminal penalties, with personal liability possible for directors and compliance officers.

Before the Regulator Finds the Gap, Find It Yourself

If you are not certain whether your business is SCUML-registered, whether your records are current, or whether your ongoing reports have ever been filed, that uncertainty is itself the exposure.

Book a Business Infrastructure Diagnostic: a structured review of your registration status, compliance position, governance systems and institutional readiness, with a clear gap summary and recommended next steps. No obligation. Just clarity.

→ Book a Business Infrastructure Diagnostic

SME360’s Statutory Compliance Management service line runs CAC, SCUML, TCC, PENCOM, NSITF and ITF obligations as a managed calendar, so compliance is established and maintained, not registered and forgotten.

→ Explore Statutory Compliance Management · See the Enterprise Readiness Ladder™

💬 WhatsApp: +234 703 598 2158 · +234 703 598 2158

SME360 Integrated Solutions Ltd is a managed business infrastructure partner helping ambitious Nigerian enterprises establish and maintain legal structure, statutory compliance, governance, fiscal operations and digital infrastructure as an embedded, ongoing partnership. Not a registration agent. Insights are informed by operational engagements and research developed through Stratopedia Advisory, our finance-led management consultancy and research platform.

Written by John Agbo, Founder & Managing Director at SME360, a chartered accountant and management accountant (MBA, ACA, ACTI, ACMA, CGMA), Intuit Certified QuickBooks ProAdvisor and Accredited CAC Agent. More on the practice and full credentials on the About page.