Centralized exchange in South Africa
Order-book exchange that takes custody of user assets and matches trades between users.
CEX is conditionally permitted in South Africa with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Registration as an accountable institution with the Financial Intelligence Centre (FIC) under FICA (mandatory since December 19, 2022).
- Customer identification and verification (standard CDD and EDD for high-risk cases).
- Risk assessments for money laundering, terrorist financing, and proliferation financing.
- Sanctions screening and transaction monitoring.
- Suspicious transaction reporting under Section 29 of FICA.
- Cash transaction reporting over ZAR 49,999.99 under Section 28 of FICA.
- Travel Rule compliance (effective April 30, 2025) — zero-threshold, applies to all transfers regardless of value or counterparty type; collect, verify, and transmit originator/beneficiary information.
- Develop and enforce a Risk Management and Compliance Programme (RMCP) under Section 42 of FICA.
- Compliance with FIC Directive 9 and Draft PCC 123 guidance.
- Comply even in sunrise scenarios where foreign counterparties lack equivalent Travel Rule regimes.
Key Restrictions
- Must hold a Financial Service Provider (FSP) license from the FSCA under FAIS (crypto assets declared as financial products) — this covers both exchange and custody services.
- Capital requirement: ZAR 150,000–1,000,000+ depending on license category.
- Local key individual and compliance officer required.
- Complaint resolution mechanism must be maintained.
- Exchange Control Regulations (1961) previously applied to crypto but ruled inapplicable in May 2025 (Standard Bank v SARB); draft regulations pending to integrate crypto into capital flow management — cross-border flows remain a regulatory risk.
- Travel Rule applies to ALL transfers (ZAR 0 threshold), including CASP-to-unhosted wallet and cross-border transfers.
Key Risks
- Africrypt $3.6B fraud scandal creates heightened regulatory scrutiny and enforcement precedent in South Africa.
- South Africa was briefly on FATF gray list (removed 2025), signaling ongoing AML/CFT vigilance.
- Exchange control uncertainty — the May 2025 Pretoria High Court ruling exempted crypto from 1961 regulations, but new draft capital-flow rules are expected, creating transitional compliance risk.
- Upcoming COFI Bill could overhaul conduct regulation for financial institutions including CASPs.
- Travel Rule technical implementation complexity — zero-threshold and sunrise-scenario obligations require robust cross-origin data systems.
- Tax treatment by SARS under Income Tax Act (intangible asset subject to income tax) creates reporting and withholding complexity.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
FSCA — Crypto assets as financial products under FAIS — first African country to formally regulate crypto
SARB — Prudential authority, exchange controls, CBDC exploration (Project Khokha)
Financial Advisory and Intermediary Services Act (FAIS) — crypto asset declaration (2022) — Crypto assets declared as financial products (effective November 2022)
VASP: Financial Service Provider (FSP) License from FSCA — CASP category under FAIS. ZAR 150,000-1,000,000+ capital. 6-12 months. Local key individual and compliance officer required. Luno (acquired by DCG) is major local platform.
CUSTODY: Included under FSP license; complaint resolution mechanism required
EXCHANGE: FSP license. South Africa briefly on FATF gray list (removed 2025). Africrypt scandal ($3.6B fraud). Exchange control regulations (capital flow restrictions) apply to crypto.
FAIS Act 37 of 2002: Regulates CASP services, not issuance.
Financial Sector Conduct Authority (FSCA): Oversees licensing and supervision of Crypto Asset Service Providers (CASPs) as Financial Service Providers (FSPs) under the Financial Advisory and Intermediary Services Act (FAIS) of 2002; enforces consumer protection and compliance.
South African Reserve Bank (SARB): Monitors financial stability, handles exchange controls, and is developing a framework for cross-border crypto transactions following a May 2025 Pretoria High Court ruling (Standard Bank v SARB) that exempted crypto from 1961 rules.
Financial Intelligence Centre (FIC): Enforces AML/CFT via the Financial Intelligence Centre Act (FICA) of 2001, requiring CASPs to register as accountable institutions and report suspicious transactions.
Financial Advisory and Intermediary Services Act (FAIS), 2002: Classifies crypto assets as financial products, mandating FSP licensing for related services.
Financial Intelligence Centre Act (FICA), 2001: Subjects CASPs to AML/CFT reporting (e.g., suspicious transactions under section 29, cash over ZAR49,999.99 under section 28).
Exchange Control Regulations, 1961 (under Currency and Exchanges Act, 1933): Previously applied but ruled inapplicable to crypto in May 2025; draft regulations pending to integrate crypto into capital flow management.
Crypto Travel Rule: Implemented April 30, 2025, for CASPs.
Financial Intelligence Centre Act (FICA), 2001 (as amended): Principal law governing AML/CFT, extended to CASPs via Schedule 1 amendments; mandates registration, risk management, and reporting.
Financial Advisory and Intermediary Services (FAIS) Act: Classifies crypto assets as financial products, requiring FSCA licensing for CASPs.
Customer identification and verification.
Standard CDD and Enhanced Due Diligence (EDD) for high-risk cases.
Risk assessments for money laundering, terrorist financing, and proliferation financing.
Sanctions screening and transaction monitoring.
Compliance with the Travel Rule (effective April 30, 2025) for originator/beneficiary information in transfers.
Travel Rule adopted — threshold: ZAR 25,000
Threshold Amounts: There is a zero transaction threshold, meaning the Travel Rule applies to all crypto asset transfers without minimum value limits.
Covered VASPs: Applies to all registered CASPs providing services in South Africa, regardless of transaction type (CASP-to-CASP, CASP-to-unhosted wallets) or location (domestic/cross-border). CASPs must register with the FIC (mandatory since December 19, 2022) and hold FSCA licenses where applicable. No exemptions are available.
Technical Implementation Requirements:
Enforcement and Penalties: Non-compliance triggers administrative sanctions under Section 45C of the FIC Act. FSCA Communication 44 of 2024 notified supervised institutions.
FIC Directive 9 (referenced in sources; effective April 30, 2025).
Joint Advisory (April 17, 2025): https://www.fic.gov.za/wp-content/uploads/2025/04/2025.4-GN-Advisory-Travel-Rule-17-April-2025-2-1.pdf
CASPs must collect, verify, and transmit required data (e.g., originator/beneficiary identities per FIC Act) for all transfers.
Develop and enforce a Risk Management and Compliance Programme (RMCP) under Section 42 of the FIC Act, including risk-based policies for executing, rejecting, or suspending non-compliant/suspicious transactions.
Beneficiaries must verify identities and monitor for incomplete data; intermediaries must relay data.
Comply even in "sunrise" scenarios where counterparties (e.g., foreign CASPs) lack equivalent rules.
Align with Draft Public Compliance Communication (PCC) 123 for guidance on Directive 9 (authoritative under FIC Act).
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — Centralized exchanges (order-book, custodial) may operate in South Africa but must obtain an FSCA Financial Service Provider (FSP) license under FAIS, register as an accountable institution with the FIC, comply with full AML/CFT obligations including the zero-threshold Travel Rule (effective April 30, 2025), maintain local key individuals and compliance officers, and navigate evolving exchange-control rules following the May 2025 court ruling on crypto exemptions.
Questions this verdict aims to answer
- What exchange / VASP license applies?
- What custody segregation rules apply to user assets?
- What market-conduct and listing rules apply?
- What travel-rule obligations apply on withdrawals?