Custodial wallet / SaaS in South Africa
Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).
Custodial SaaS is conditionally permitted in South Africa with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Register as an accountable institution with the Financial Intelligence Centre (FIC) under FICA, 2001
- Conduct customer identification and verification (standard CDD)
- Apply Enhanced Due Diligence (EDD) for high-risk cases (e.g., PEPs, complex structures)
- Conduct risk assessments for money laundering, terrorist financing, and proliferation financing
- Sanctions screening and transaction monitoring
- Comply with the Travel Rule (effective April 30, 2025) — originator/beneficiary information on transfers
- Report suspicious transactions under section 29 of FICA
- Report cash transactions over ZAR 49,999.99 under section 28 of FICA
- Appoint a compliance officer — required under the FSP license
- Maintain a complaint resolution mechanism — required under custody provisions of the FSP license
Key Restrictions
- Must hold an FSCA Financial Service Provider (FSP) license under FAIS (crypto assets declared as financial products, November 2022)
- Local key individual and compliance officer required; operator must have a local entity in South Africa
- Capital requirement: ZAR 150,000–1,000,000+ depending on scope
- Custody is included under the FSP license, not a separate standalone custody license
- Exchange control regulations historically applied but May 2025 High Court ruling (Standard Bank v SARB) exempted crypto from 1961 Exchange Control Regulations; new draft regulations pending to integrate crypto into capital flow management
- The COFI Bill (upcoming) may overhaul conduct regulation — licensing framework subject to change
Key Risks
- Regulatory ambiguity: COFI Bill could materially reshape CASP licensing requirements, including for custodial wallets
- Enforcement precedent: Africrypt USD 3.6B fraud case has heightened regulatory and law enforcement scrutiny of crypto custodians in South Africa
- Capital-flow restrictions: SARB is developing a new cross-border crypto framework post-May 2025 — compliance requirements for cross-chain/offshore transfers remain in flux
- Tax exposure: SARS treats crypto as intangible assets under Income Tax Act 1962 — custodial SaaS operators may face complex withholding or reporting obligations for white-label clients
- Dual-liability risk: In a white-label SaaS model, both the SaaS provider (as the licensed CASP holding keys) and the white-label client may have overlapping AML/FAIS obligations — regulatory guidance on allocation is limited
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
FSCA — Crypto assets as financial products under FAIS — first African country to formally regulate crypto
SARB — Prudential authority, exchange controls, CBDC exploration (Project Khokha)
Financial Advisory and Intermediary Services Act (FAIS) — crypto asset declaration (2022) — Crypto assets declared as financial products (effective November 2022)
Financial Intelligence Centre Act (FIC Act) (2001) — AML/CFT compliance
VASP: Financial Service Provider (FSP) License from FSCA — CASP category under FAIS. ZAR 150,000-1,000,000+ capital. 6-12 months. Local key individual and compliance officer required. Luno (acquired by DCG) is major local platform.
CUSTODY: Included under FSP license; complaint resolution mechanism required
EXCHANGE: FSP license. South Africa briefly on FATF gray list (removed 2025). Africrypt scandal ($3.6B fraud). Exchange control regulations (capital flow restrictions) apply to crypto.
FAIS Act 37 of 2002: Regulates CASP services, not issuance.
Upcoming COFI Bill: Potential overhaul for conduct regulation.
Financial Sector Conduct Authority (FSCA): Oversees licensing and supervision of Crypto Asset Service Providers (CASPs) as Financial Service Providers (FSPs) under the Financial Advisory and Intermediary Services Act (FAIS) of 2002; enforces consumer protection and compliance.
South African Reserve Bank (SARB): Monitors financial stability, handles exchange controls, and is developing a framework for cross-border crypto transactions following a May 2025 Pretoria High Court ruling (Standard Bank v SARB) that exempted crypto from 1961 rules.
Financial Intelligence Centre (FIC): Enforces AML/CFT via the Financial Intelligence Centre Act (FICA) of 2001, requiring CASPs to register as accountable institutions and report suspicious transactions.
South African Revenue Service (SARS): Taxes crypto under the Income Tax Act of 1962; clarified in April 2018 that normal income tax rules apply to crypto income.
Financial Advisory and Intermediary Services Act (FAIS), 2002: Classifies crypto assets as financial products, mandating FSP licensing for related services.
Financial Intelligence Centre Act (FICA), 2001: Subjects CASPs to AML/CFT reporting (e.g., suspicious transactions under section 29, cash over ZAR49,999.99 under section 28).
Income Tax Act, 1962: Treats crypto as intangible assets subject to income tax.
Exchange Control Regulations, 1961 (under Currency and Exchanges Act, 1933): Previously applied but ruled inapplicable to crypto in May 2025; draft regulations pending to integrate crypto into capital flow management.
Crypto Travel Rule: Implemented April 30, 2025, for CASPs.
Financial Intelligence Centre Act (FICA), 2001 (as amended): Principal law governing AML/CFT, extended to CASPs via Schedule 1 amendments; mandates registration, risk management, and reporting.
Financial Advisory and Intermediary Services (FAIS) Act: Classifies crypto assets as financial products, requiring FSCA licensing for CASPs.
Money Laundering and Terrorist Financing Control Regulations: Supplements FICA with detailed compliance procedures.
Customer identification and verification.
Standard CDD and Enhanced Due Diligence (EDD) for high-risk cases.
Risk assessments for money laundering, terrorist financing, and proliferation financing.
Sanctions screening and transaction monitoring.
Compliance with the Travel Rule (effective April 30, 2025) for originator/beneficiary information in transfers.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a custodial wallet / SaaS operator must obtain an FSCA FSP license under FAIS (capital ZAR 150k–1M+), establish a local entity with a key individual and compliance officer, comply with full FICA AML/CTF obligations including the Travel Rule, and navigate evolving exchange-control and COFI Bill reforms.
Questions this verdict aims to answer
- What custody license / qualified-custodian status applies?
- What segregation, insurance, and proof-of-reserves rules apply?
- What AML obligations attach to the SaaS vs the white-label client?