Remote VASP serving residents in South Africa
Foreign-incorporated entity that offers exchange, custody, or transfer services to residents of a jurisdiction without establishing a local entity or office.
Remote VASP is conditionally permitted in South Africa with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Register as an accountable institution with the Financial Intelligence Centre (FIC) under the FIC Act (mandatory since December 19, 2022).
- Implement Customer Identification and Verification (CIV) per FICA.
- Conduct standard CDD and Enhanced Due Diligence (EDD) for high-risk cases.
- Perform risk assessments for money laundering, terrorist financing, and proliferation financing.
- Screen against sanctions and conduct transaction monitoring.
- Comply with the Crypto Travel Rule (effective April 30, 2025) — zero-threshold applies to all transfers; collect, verify, and transmit originator/beneficiary data for all crypto asset transfers, including cross-border and unhosted-wallet transactions.
- Report suspicious transactions under Section 29 of the FIC Act.
- Report cash/pseudo-cash transactions over ZAR 49,999.99 under Section 28 of the FIC Act.
- Develop and enforce a Risk Management and Compliance Programme (RMCP) under Section 42 of the FIC Act.
- Register for Travel Rule compliance with FIC Directive 9 and Joint Advisory of April 17, 2025.
- Comply even in 'sunrise' scenarios where counterparty foreign CASPs lack equivalent Travel Rule rules.
Key Restrictions
- A local entity is required — the operator must obtain an FSP (Financial Service Provider) license from the FSCA as a Crypto Asset Service Provider (CASP) under FAIS.
- A local key individual and compliance officer are required.
- Capital requirement: ZAR 150,000–1,000,000+ depending on scope.
- Exchange control regulations (capital flow restrictions) apply to crypto, though the May 2025 High Court ruling exempted crypto from the 1961 Exchange Control Regulations; draft replacement regulations are pending.
- The Travel Rule applies at zero threshold — no minimum transaction value exempt.
- Licensing process takes 6‑12 months.
Key Risks
- Enforcement risk is high for unlicensed remote operators — the FSCA has active supervisory authority over CASPs and has taken enforcement actions; Africrypt scandal ($3.6B fraud) has heightened regulatory scrutiny.
- South Africa was on the FATF gray list (removed 2025), signaling prior AML/CFT gaps; regulators are actively tightening enforcement.
- The upcoming COFI Bill may introduce an additional conduct-regulatory overhaul.
- Tax treatment (SARS treats crypto as intangible assets under the Income Tax Act) creates reporting complexity for cross-border operators.
- Travel Rule compliance is mandatory even when counterparty foreign CASPs lack equivalent rules, creating operational friction for remote service models.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
VASP: Financial Service Provider (FSP) License from FSCA — CASP category under FAIS. ZAR 150,000-1,000,000+ capital. 6-12 months. Local key individual and compliance officer required. Luno (acquired by DCG) is major local platform.
EXCHANGE: FSP license. South Africa briefly on FATF gray list (removed 2025). Africrypt scandal ($3.6B fraud). Exchange control regulations (capital flow restrictions) apply to crypto.
CUSTODY: Included under FSP license; complaint resolution mechanism required
Financial Sector Conduct Authority (FSCA): Oversees licensing and supervision of Crypto Asset Service Providers (CASPs) as Financial Service Providers (FSPs) under the Financial Advisory and Intermediary Services Act (FAIS) of 2002; enforces consumer protection and compliance.
Financial Intelligence Centre (FIC): Enforces AML/CFT via the Financial Intelligence Centre Act (FICA) of 2001, requiring CASPs to register as accountable institutions and report suspicious transactions.
Financial Advisory and Intermediary Services Act (FAIS), 2002: Classifies crypto assets as financial products, mandating FSP licensing for related services.
Financial Intelligence Centre Act (FICA), 2001: Subjects CASPs to AML/CFT reporting (e.g., suspicious transactions under section 29, cash over ZAR49,999.99 under section 28).
Exchange Control Regulations, 1961 (under Currency and Exchanges Act, 1933): Previously applied but ruled inapplicable to crypto in May 2025; draft regulations pending to integrate crypto into capital flow management.
Crypto Travel Rule: Implemented April 30, 2025, for CASPs.
Financial Intelligence Centre Act (FICA), 2001 (as amended): Principal law governing AML/CFT, extended to CASPs via Schedule 1 amendments; mandates registration, risk management, and reporting.
Customer identification and verification.
Standard CDD and Enhanced Due Diligence (EDD) for high-risk cases.
Risk assessments for money laundering, terrorist financing, and proliferation financing.
Sanctions screening and transaction monitoring.
Compliance with the Travel Rule (effective April 30, 2025) for originator/beneficiary information in transfers.
Travel Rule adopted — threshold: ZAR 25,000
Threshold Amounts: There is a zero transaction threshold, meaning the Travel Rule applies to all crypto asset transfers without minimum value limits.
Covered VASPs: Applies to all registered CASPs providing services in South Africa, regardless of transaction type (CASP-to-CASP, CASP-to-unhosted wallets) or location (domestic/cross-border). CASPs must register with the FIC (mandatory since December 19, 2022) and hold FSCA licenses where applicable. No exemptions are available.
Enforcement and Penalties: Non-compliance triggers administrative sanctions under Section 45C of the FIC Act. FSCA Communication 44 of 2024 notified supervised institutions.
CASPs must collect, verify, and transmit required data (e.g., originator/beneficiary identities per FIC Act) for all transfers.
Develop and enforce a Risk Management and Compliance Programme (RMCP) under Section 42 of the FIC Act, including risk-based policies for executing, rejecting, or suspending non-compliant/suspicious transactions.
Comply even in "sunrise" scenarios where counterparties (e.g., foreign CASPs) lack equivalent rules.
FAIS Act 37 of 2002: Regulates CASP services, not issuance.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a remote VASP serving South African residents must establish a local entity, obtain an FSP license from the FSCA as a CASP (6–12 months, ZAR 150k–1M+ capital), register with the FIC, and comply with full AML/CFT obligations including a zero-threshold Travel Rule; unlicensed remote service carries significant enforcement risk.
Questions this verdict aims to answer
- May a non-resident provider serve residents from abroad?
- Does cross-border service trigger licensing, registration, or AML obligations?
- What enforcement risk exists for unlicensed remote operators?