Crypto ATM / kiosk operator in South Africa
Physical kiosks that exchange cash for crypto (and sometimes vice versa). High-cash AML risk profile.
Crypto ATM is conditionally permitted in South Africa with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Registration with the FIC as an accountable institution under FICA (2001, as amended).
- Customer identification and verification (standard CDD) for all customers.
- Enhanced Due Diligence (EDD) for high-risk cases — cash-heavy kiosk operations would almost certainly qualify as high-risk.
- Cash transaction reporting (section 28 of FICA) — cash amounts equal to or exceeding ZAR 49,999.99 must be reported.
- Suspicious transaction reporting (section 29 of FICA) — reportable to the FIC.
- Risk assessments for money laundering, terrorist financing, and proliferation financing required.
- Sanctions screening and ongoing transaction monitoring.
- Travel Rule compliance (effective April 30, 2025) — originator/beneficiary information must be transmitted for crypto transfers.
- Appointment of a compliance officer (a local requirement under the FSP / CASP regime).
Key Restrictions
- Must hold an FSCA Financial Service Provider (FSP) license under the CASP (Crypto Asset Service Provider) category under FAIS Act — kiosk operators are included as they provide a crypto-asset service to the public.
- Local incorporation required — a local key individual and compliance officer must be appointed.
- Capital requirement: ZAR 150,000 to ZAR 1,000,000+ depending on scope of operations.
- Complaint resolution mechanism must be established (included under FSP licensing for custody-type services).
- Exchange Control Regulations (SARB) — although the May 2025 High Court ruling exempted crypto from the 1961 regulations, draft regulations for crypto capital flow management are pending; operators must monitor this.
- No specific standalone 'kiosk license' exists — the operator is regulated under the general CASP/FSP framework.
Key Risks
- High AML/CFT risk profile due to cash-intensive nature — kiosks are a natural target for money laundering, attracting enhanced scrutiny from the FIC and FSCA.
- No dedicated kiosk-specific regulatory framework — operator must interpret how general CASP rules apply to physical kiosks, creating ambiguity.
- Africrypt scandal ($3.6B fraud) has increased regulatory and public scrutiny of crypto operators in South Africa.
- South Africa was briefly on the FATF gray list (removed 2025), indicating past AML/CFT deficiencies; regulators are vigilant.
- Criminal and civil liability risk if cash transaction reporting (ZAR 49,999.99 threshold) or EDD obligations are not met — FICA carries penalties.
- Upcoming COFI Bill may overhaul the conduct-of-business regulatory framework, creating potential licensing and compliance changes.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
FSCA — Crypto assets as financial products under FAIS — first African country to formally regulate crypto
SARB — Prudential authority, exchange controls, CBDC exploration (Project Khokha)
Financial Advisory and Intermediary Services Act (FAIS) — crypto asset declaration (2022) — Crypto assets declared as financial products (effective November 2022)
Financial Intelligence Centre Act (FIC Act) (2001) — AML/CFT compliance
VASP: Financial Service Provider (FSP) License from FSCA — CASP category under FAIS. ZAR 150,000-1,000,000+ capital. 6-12 months. Local key individual and compliance officer required. Luno (acquired by DCG) is major local platform.
CUSTODY: Included under FSP license; complaint resolution mechanism required
EXCHANGE: FSP license. South Africa briefly on FATF gray list (removed 2025). Africrypt scandal ($3.6B fraud). Exchange control regulations (capital flow restrictions) apply to crypto.
FAIS Act 37 of 2002: Regulates CASP services, not issuance.
Upcoming COFI Bill: Potential overhaul for conduct regulation.
Financial Sector Conduct Authority (FSCA): Oversees licensing and supervision of Crypto Asset Service Providers (CASPs) as Financial Service Providers (FSPs) under the Financial Advisory and Intermediary Services Act (FAIS) of 2002; enforces consumer protection and compliance.
South African Reserve Bank (SARB): Monitors financial stability, handles exchange controls, and is developing a framework for cross-border crypto transactions following a May 2025 Pretoria High Court ruling (Standard Bank v SARB) that exempted crypto from 1961 rules.
Financial Intelligence Centre (FIC): Enforces AML/CFT via the Financial Intelligence Centre Act (FICA) of 2001, requiring CASPs to register as accountable institutions and report suspicious transactions.
South African Revenue Service (SARS): Taxes crypto under the Income Tax Act of 1962; clarified in April 2018 that normal income tax rules apply to crypto income.
Financial Advisory and Intermediary Services Act (FAIS), 2002: Classifies crypto assets as financial products, mandating FSP licensing for related services.
Financial Intelligence Centre Act (FICA), 2001: Subjects CASPs to AML/CFT reporting (e.g., suspicious transactions under section 29, cash over ZAR49,999.99 under section 28).
Income Tax Act, 1962: Treats crypto as intangible assets subject to income tax.
Exchange Control Regulations, 1961 (under Currency and Exchanges Act, 1933): Previously applied but ruled inapplicable to crypto in May 2025; draft regulations pending to integrate crypto into capital flow management.
Crypto Travel Rule: Implemented April 30, 2025, for CASPs.
Financial Intelligence Centre Act (FICA), 2001 (as amended): Principal law governing AML/CFT, extended to CASPs via Schedule 1 amendments; mandates registration, risk management, and reporting.
Financial Advisory and Intermediary Services (FAIS) Act: Classifies crypto assets as financial products, requiring FSCA licensing for CASPs.
Money Laundering and Terrorist Financing Control Regulations: Supplements FICA with detailed compliance procedures.
Customer identification and verification.
Standard CDD and Enhanced Due Diligence (EDD) for high-risk cases.
Risk assessments for money laundering, terrorist financing, and proliferation financing.
Sanctions screening and transaction monitoring.
Compliance with the Travel Rule (effective April 30, 2025) for originator/beneficiary information in transfers.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — crypto ATM/kiosk operators are permitted in South Africa but must obtain an FSCA FSP license as a CASP under FAIS, register with the FIC as an accountable institution, comply with FICA AML/CFT obligations (including cash transaction reporting at ZAR 49,999.99), appoint a local key individual and compliance officer, and meet capital requirements of ZAR 150,000–1,000,000+.
Questions this verdict aims to answer
- What money-transmitter / kiosk-specific license is required?
- What cash-transaction reporting thresholds apply?
- What enhanced-KYC obligations attach to cash-in / cash-out?