Getting a CAC certificate is the start, not the end. After registration, a Nigerian business with staff owes something to several different bodies on a recurring basis: CAC, the tax authorities, PenCom, NSITF, ITF, the health insurance system and the data protection regulator. Most of the penalties we see small employers pay come from missing a repeat duty, not from missing the original registration.
The table below is the map. The sections after it say what each line means in practice and where we stop and tell you to ask the body itself.
The obligations in one table
| Obligation | Body | How often | Who it applies to |
|---|---|---|---|
| Annual returns | CAC | Every year | Registered companies and business names (check the form for your type) |
| Tax ID and tax filings | NRS and state IRS | Per tax type | Every taxable person |
| PAYE deduction and remittance | State IRS of the employee's residence | Monthly, by the 10th of the next month | Employers who pay salaries |
| Annual return of emoluments (Form H1) | Tax authority collecting your PAYE | By 31 January | Employers |
| Pension contributions | PenCom, through each PFA | Within 7 working days of paying salaries | Employers with 3 or more employees |
| Group life insurance | Insurer (required by the Pension Reform Act) | Annual policy | Employers covered by the Act |
| Employees' compensation levy | NSITF | 1% of monthly payroll | Employers |
| Industrial training levy | ITF | 1% of annual payroll | 5 or more employees, or turnover of ₦50 million or more |
| Health insurance | NHIA, or an HMO plan | Ongoing | Meant to be mandatory for residents |
| Personal data duties | NDPC | Ongoing | Anyone handling personal data, including staff data |
Corporate duties: CAC
A company or registered business name is expected to file annual returns with the Corporate Affairs Commission. The main benefit of filing on time is that you stay in good standing, which banks, clients and tender panels check. We cover the purpose and the cost of defaulting in the CAC annual returns guide. We do not quote deadlines or amounts here because they depend on your company type and CAC's current rules, so ask CAC or an accredited filer.
A related point: for tax purposes, a company's CAC registration number is reported to become its Tax ID under the unified system announced in May 2026. Check the latest NRS or Joint Revenue Board notice on registration steps.
Tax duties beyond PAYE
PAYE is only one tax line. For companies, the figures to know are 30% company income tax for larger companies, a 4% development levy on assessable profits, and VAT at 7.5%. Small companies with turnover of ₦100 million or less and fixed assets not above ₦250 million are exempt from company income tax, capital gains tax and the development levy. Being exempt from paying a tax is not always the same as being exempt from filing about it, so ask the tax authority what returns you still owe, in writing if possible.
For staff tax, work out which office you pay. PAYE goes to the state IRS where each employee lives (FCT-IRS in Abuja), and the NRS, which replaced FIRS from 1 January 2026, covers special categories. The how-to is in registering for PAYE with the state IRS.
Employee-linked levies: what each really costs
Bola runs a Lagos agency with 12 staff and a total payroll of ₦2,400,000 a month.
- NSITF at 1% of monthly payroll: ₦24,000 a month, paid by the employer, not deducted from staff.
- ITF at 1% of annual payroll: annual payroll is ₦28,800,000, so ₦288,000 a year. She has more than 5 employees, so it applies.
- Pension: her share depends on staff pensionable pay, worked in the SME pension compliance guide.
So before pension or tax, the two levies alone cost ₦24,000 a month plus ₦288,000 once a year. Put both in the monthly budget.
For how to register and pay NSITF, see NSITF registration and contributions. For ITF, including who qualifies, see ITF compliance. The group life requirement is explained in the group life insurance guide, and a PenCom compliance certificate, which clients and tender panels sometimes ask for, is a separate document you apply for once your remittances are up to date. Do not wait for a client to request it before you check that every pension schedule has actually been paid.
Health insurance and data protection
Health insurance is meant to be mandatory for residents under the National Health Insurance Authority Act 2022, and many employers meet it through an HMO group plan. We do not quote contribution percentages because we have no confirmed figure; see the NHIA and HMO position in our health insurance guide at NHIA and HMO plans and confirm with NHIA.
Under the Nigeria Data Protection Act 2023, employee records count as personal data. If you keep payslips, bank details, NINs and medical certificates, you owe those people reasonable protection and a lawful reason for each item. The regulator is the NDPC.
Which duties arrive first
You do not meet all of these on day one. A sensible order for a new employer:
- Before the first salary. Tax ID for the business, PAYE registration with the state IRS for the states where your staff live, and RSAs for staff if you have 3 or more employees.
- First payroll month. Deduct PAYE and pension, remit both on time, start the NSITF contribution and buy the group life policy.
- First year. File CAC annual returns, pay ITF if you qualify, prepare Form H1 in December and file by 31 January, and settle your health insurance arrangement.
- Every year after. Renew the group life policy, check each employee's tax state and pension details, and confirm your data protection practices still match what you collect.
The registration side is in the employer registration checklist, and nothing on this list should be left for "when we grow". The duties that attach to your first employee are the same ones a 200-person firm has, only the amounts differ.
How small gaps become large bills
Consider a Kano trading company that registered in 2023, hired five people in 2024, and paid PAYE to the state office but never registered with NSITF and never opened pension accounts because "we are small". When a bank asks for a PenCom compliance certificate for a loan, the missing pension remittances for every month since the first hire come to light together. The Pension Reform Act penalty alone is 2% of the unremitted contribution for each month of delay, and it applies to every month and every employee. That is before anyone looks at levies.
Reported penalties for PAYE defaults are 10% of unremitted tax plus interest, and late filing of the annual return costs ₦100,000 for the first month and ₦50,000 for each month after under the Nigeria Tax Administration Act. Confirm current figures with the body concerned; treat the figures here as a guide to scale, not a quotation. The cheapest protection is the calendar in the next section, and an annual check using the common payroll mistakes list.
Record keeping
Every duty above produces paper: PAYE schedules, remittance proofs, pension schedules, levy receipts, contracts. How long each must be kept is set by the specific law or by the tax authority, and we do not have a single reliable number to give you. Ask your accountant or the tax office, and in the meantime keep records for several years rather than deleting them after one.
A calendar to start with
Put the monthly items in a shared calendar tonight: salary day, PAYE by the 10th, pension within 7 working days of salary. Add 31 January for Form H1. Then add your CAC annual return and ITF payment dates after asking each body for its date. The full set is in the payroll compliance calendar.
