South Africa’s crypto-asset regime is advancing on two timelines. Financial services licensing and anti-money laundering obligations are already being enforced, while dedicated rules for cross-border crypto flows are still in draft form. In 2022, South Africa brought crypto assets within the definition of financial products under the Financial Advisory and Intermediary Services Act, or FAIS Act. Since then, firms that provide related advice or intermediary services have generally needed to apply for authorization from the Financial Sector Conduct Authority, or FSCA, and meet anti-money laundering obligations with the Financial Intelligence Centre, or FIC.
Licensing, AML compliance and cross-border capital movement are handled under separate systems. At the same time, the South African Reserve Bank, or SARB, and National Treasury published a draft manual in 2026 on cross-border crypto-asset activities. The proposal would bring some transfers involving locally authorized service providers, foreign service providers and unhosted wallets into a reporting framework. For companies, the first task is to separate rules that are already in force from rules that are still open for comment.
There is no single license in South Africa that covers every crypto-asset activity. A trading business may face financial services authorization, customer identification and suspicious transaction reporting, tax data reporting, and cross-border fund flow questions at the same time. Those issues are handled by different authorities under different legal bases. In practice, mapping the relationship between customers, trading platforms, wallets and bank accounts is more useful than starting with the question of whether a general crypto license exists.
FSCA licensing turns on the financial service actually being provided
South Africa’s licensing analysis starts with the financial service a firm actually performs. General Notice 1350 of 2022, published in Government Gazette No. 47334, relied on Section 1 of the FAIS Act 37 of 2002 to include crypto assets in the definition of a financial product. A business that provides related advice or intermediary services in the course of its operations will usually need a financial services provider, or FSP, license and must operate within the approved category and activity scope.
The FSCA reviews an applicant’s business model, operational capacity, and whether key individuals and representatives meet fit-and-proper standards. Trading venues, brokerage functions and asset management services may fall into different authorization buckets, so the relevant category depends on the actual business and the license record. FSCA Communication 29 of 2023 said the application window opened on June 1, 2023, and existing service providers had until Nov. 30, 2023 to file. Before entering the South African market, firms need to check line by line whether they touch client orders, provide investment advice, arrange transactions for clients or manage client assets, then compare that with the public authorization scope.
The service activity determines the licensing perimeter. Product labels matter less than actual function.
A practical review can begin with what the product does. One platform may combine information display, trade matching, custody and investment advice, but those functions can map to different legal roles. Licensing analysis should focus on service contracts, how funds and assets are controlled, fee arrangements and transaction flows. Marketing language on a product page is only background.
The legal entry points are specific. Section 1 of the FAIS Act defines key concepts such as financial product, advice and intermediary service. Once crypto assets were added to the financial product definition in the 2022 notice, the existing licensing structure for financial service providers could extend to related crypto business. Section 7 of the FAIS Act prohibits unauthorized persons from carrying on financial services that require authorization. Firms need to test whether they are in fact giving advice or providing intermediary services, which entity serves South African clients, and whether the activity fits within an existing FSP category. Publishing general market information is not analyzed the same way as arranging trades for a client or giving personalized advice.
Once licensing moved into the implementation stage, staffing and control arrangements also became part of the review. The FAIS fit-and-proper framework covers the competence, honesty and ongoing suitability of key individuals, representatives and other responsible persons. If a platform outsources trading or customer support to an affiliated company, it still needs to explain who contracts with the client, who executes instructions, and who handles complaints and payment errors. Public FSCA license records are the starting point for external counterparties that want to verify status. Internally, firms also need to keep approval letters, authorized activity records, personnel files and change logs so the business does not outgrow the scope reflected in an older license version.
Client protection also appears in product design. A provider that gives investment advice must be able to explain risk, fees, liquidity and conflicts of interest. A provider that arranges trades for clients must be able to reconcile instructions, executions and holdings. Crypto prices move quickly, and a failed transaction may occur at the platform, wallet, bank or client level. Client agreements need to state who holds the assets, who approves withdrawals, whether mistaken transfers can be recovered and how complaints are handled. Those operational details can affect the FSCA’s view of whether a firm can perform the service it is authorized to provide.
FIC AML duties run alongside FAIS licensing
Crypto-asset service providers also face the Financial Intelligence Centre Act, or FIC Act 38 of 2001. Item 22 of Schedule 1 brings relevant CASPs into the category of accountable institutions. A CASP that already has FAIS authorization may also implicate Item 12 of Schedule 1. The FIC requires covered institutions to register and to maintain customer due diligence, record-keeping, risk management and suspicious transaction reporting systems. Its Travel Rule guidance applies those obligations to service providers that send or receive crypto assets on behalf of clients: transaction information must move between the sending and receiving service providers, records must be retained under the rules, and the information must be available when requested by the authorities.
That means a firm may have to deal with both the FSCA and the FIC. The FSCA focuses on financial services authorization, client protection and operational capability. The FIC focuses on money laundering, terrorist financing and related financial intelligence duties. The responsible staff, reporting lines and inspection materials should be coordinated internally, but the legal basis remains separate.
Cross-border services also require firms to identify where the client and the business activity are located. Public FIC guidance says a CASP established in South Africa that handles crypto-asset transfers for domestic or foreign clients falls within the relevant AML perimeter. A foreign service provider that gives advice to South African clients may also need to address local licensing and registration questions. Firms need to assess territorial scope by looking at service type, client location and actual operating arrangements.
The CASP definition in Item 22 of Schedule 1 to the FIC Act needs to be read separately from the FAIS licensing test. The schedule determines whether a firm is an accountable institution, which then triggers registration, risk management and reporting duties. Section 21 of the FIC Act and the provisions that follow form the basis for customer identification and due diligence. Section 42 requires a risk management and compliance program. Section 29 covers suspicious and unusual transaction reports. For a platform, collecting identity documents at onboarding is only the first step. It also needs to monitor account behavior, address links, source of funds and unusual transfers, and record why a transaction was treated as high risk or ordinary risk.
The Travel Rule is the most concrete operational requirement in this set. Directive 9 of 2024 takes effect on April 30, 2025 and requires relevant crypto-asset service providers to handle originator and beneficiary information in the transfer chain. Firms need to determine whether the counterparty is another CASP, which data fields can be transmitted securely, how to pause or complete a transfer when data is missing, and how to handle transfers involving unhosted wallets. A blockchain address usually does not tell the receiving side the customer’s name, so Travel Rule compliance depends on coordination between transaction systems, customer records and service-provider communications.
There is also a real product trade-off here. Clients want fast transfers. Compliance teams may need to stop processing when an address looks unusual or identity information does not match. A platform can move required checks to the order stage or the withdrawal stage so it is not searching for missing data after a transfer has already been initiated. It can maintain controlled lists for frequently used institutional addresses and apply stronger review to first-time wallets. Customer experience and AML controls cannot be designed as separate systems because they meet in the same transaction.
SARB’s draft cross-border manual brings wallet transfers into the discussion
In August 2026, National Treasury and the SARB released a draft Manual on Crypto Asset Cross-Border Activities and said it should be read together with draft Capital Flow Management Regulations. The draft regulations would replace the 1961 Exchange Control Regulations and shift the focus more toward cross-border transaction reporting, monitoring of high-impact transactions and the control of illicit financial flows. The manual identifies trigger points that include transfers of crypto assets between a locally authorized CASP and a foreign CASP, or from a locally authorized CASP to an unhosted wallet, where the activity creates a cross-border inflow or outflow. In those cases, the activity may need to be reported to FinSurv.
The SARB manual and the capital flow regulations remain drafts until they are finalized.
This part of the framework deals with identifying and reporting cross-border capital movement. The SARB said the draft would use an activity-based approach to identify cross-border transfers. The current version applies the same trigger logic across different crypto assets and does not declare crypto assets to be official currency in South Africa. The comment period for the manual ended on Sept. 30, 2026. As of Oct. 20, official explanations still described both the manual and the related regulations as drafts under revision after comments were received.
For operations teams, the draft scenarios affect transaction data design. Systems would need to identify whether each side of a transfer is a locally authorized service provider, a foreign service provider or an unhosted wallet. They would also need to retain client identity, transaction direction and any required reporting information. Firms can compare the proposal against their current systems, run a gap analysis, and mark any new workflow as a draft-stage scenario until the final text confirms the reporting entity, transition arrangements and technical data fields.
SARB explanations add that the draft trigger points include transfers between a locally authorized CASP and a foreign CASP, as well as transfers from a locally authorized CASP to an unhosted wallet that create a cross-border inflow or outflow. The draft currently says individuals could transfer crypto assets through an authorized CASP under a single discretionary allowance or a foreign capital allowance. How companies and other entities would be treated will depend on the final rules and the related licensing conditions. Any description of this regime needs to preserve the draft status of what is only proposed.
If implemented, the framework would give CASPs two separate data tasks. The FIC looks at suspicious funds and information on both sides of a transfer. FinSurv would look at the nature and direction of cross-border movement and the applicable allowance. A single transaction could enter both record systems, but the legal basis, reporting purpose and data fields would not be the same. Product teams may want to establish a unified transaction identifier first, so client identity, wallet addresses, fund movements and reporting status can be traced together, then generate the required data set for each authority. That base record would still be useful once the final text is published.
For that reason, a cross-border review in South Africa should begin with one real transaction. Where is the client located? Which entity signed the contract? Which wallet sent the asset? Does the service provider hold or control the asset? Where is the counterparty? Once that path is mapped, a team can decide where current FIC record-keeping, exchange-control arrangements and proposed FinSurv reporting would sit in the process.
Put business activity, fund flows and responsible persons on one map
South Africa’s regulatory map can be divided into three layers. The first is FSCA licensing: what financial service the firm provides and whether it falls within the license scope. The second is FIC obligations: who handles customer due diligence, Travel Rule information, records and suspicious transaction reports. The third is cross-border capital movement: how assets move from South Africa to another jurisdiction, whether they pass through a locally authorized CASP, whether they move to an unhosted wallet, and whether they may later fall within FinSurv reporting. Existing FAIS and FIC duties continue to operate under laws already in force. The cross-border manual and the new regulations remain proposed arrangements until formally issued.
The division of responsibilities among regulators and the status of each rule need to be tracked separately.
Tax also needs its own review. The South African Revenue Service, or SARS, treats crypto assets based on the facts of holding and trading, including the purpose of acquisition, the manner of disposal and the nature of the income. Tax records should be assembled from exchange data, wallet records and business books. Both companies and individuals also need to coordinate tax filing with AML record-retention requirements.
There is an added tax-reporting layer in 2026. SARS said the Crypto-Asset Reporting Framework, or CARF, took effect on March 2, 2026 and requires relevant service providers to collect and report user and transaction information under the regime. It helps tax authorities obtain cross-platform transaction data, but it does not convert crypto trading into a new tax category. Frequent trading gains with a business character may be treated as ordinary income. Gains from disposing of long-held assets may fall within the capital gains framework. Individuals need to keep acquisition cost, disposal timing and transaction fees. Service providers need to determine whether they are reporting entities and what data collection obligations apply.
How to check statutes and document status before entering the market
The first step is to break the business into specific actions: attracting South African clients, giving advice, matching trades, safeguarding assets, converting fiat and sending assets offshore. The second step is to tag each action with the contracting entity, the place where it occurs and the person or entity in control. The third step is to match each action to the relevant authority: the FSCA for FAIS licensing and fit-and-proper requirements; the FIC for Schedule 1 Item 22, Section 21, Section 29 and Section 42 AML rules; SARS for income tax and CARF reporting; and SARB or FinSurv for current exchange-control arrangements while tracking the 2026 drafts. That index is not a substitute for line-by-line legal advice, but it helps teams send the right question to the right department.
The fourth step is timing. The FSCA’s 2022 financial product declaration, the FIC’s 2022 inclusion of CASPs, the 2025 Travel Rule and the 2026 CARF are all measures that have already taken effect on different dates. The 2026 Capital Flow Management Regulations and the crypto-asset cross-border manual are still being revised after consultation. If legal teams keep a table listing the legal basis in force, the responsible party, the application or reporting authority, current evidence and draft items to watch, management can see which work must be done now and which system changes should wait for the final text.
Platforms that already run cross-border business also need to check the current exchange-control position. SARB public Q&A still says the current Authorized Dealer Manual does not provide a general channel for cross-border foreign exchange transfers made for the explicit purpose of buying crypto assets. A firm cannot treat the proposed CASP route in the draft as if it were already available under current law. If a client wants to buy crypto from a South African bank account and send it to an offshore wallet, the platform needs to check the exchange-control rules and bank handling requirements that apply today before assessing what the draft might change later.
In practical market entry work, a firm can start with a list of business activities and then map each one to licensing, FIC registration and fund-flow paths. For cross-border business, it should manage the already effective FAIS and FIC obligations in one column and the 2026 draft proposals in another, so proposed reporting triggers are not written into current mandatory controls too early. South Africa’s framework is still evolving, especially once the cross-border manual and capital flow regulations move to final form. At that point, service providers may need to adjust customer identification and wallet-transfer processes at the same time.
The order of use for this regulatory map is straightforward. First identify the service actually being provided. Then confirm the licensed entity and AML responsibility. After that, trace whether the asset or fiat leg crosses a border. Tax and data reporting come after that. If different affiliated companies handle different parts of the process, internal owners need to connect transaction identifiers with client contracts so each entity can explain its role in the same transaction.
Disclaimer
This article is for legal, policy and industry research exchange only. It is intended as an objective analysis of digital finance, stablecoins, digital assets and related regulatory developments. It does not constitute investment advice, legal advice, tax advice or any other professional advice, and it does not amount to a recommendation, promotion or solicitation for any financial product, digital asset or commercial project. The regulatory rules, market data and institutional information discussed in the article are mainly drawn from public materials and may change with laws, regulatory policy, market conditions and project developments. Readers should make their own judgment based on the latest public information and comply with the laws and regulations applicable in their own jurisdiction. Neither the author nor the publishing platform accepts responsibility for any investment, trading or other commercial decision made in reliance on this article.
Market risk exists and caution is required. This article does not constitute investment advice. Readers should consider whether any opinion, view or conclusion in the article fits their own circumstances. Any investment decision made on that basis is the reader’s own responsibility.
