South Africa was one of the first African jurisdictions to formally regulate crypto asset service providers (CASPs) as accountable institutions under its anti-money laundering framework. Since 2022, every crypto exchange, OTC desk, and digital asset platform operating in South Africa must comply with FICA, register with the FSCA, and implement a full KYC programme. This guide explains what that means in practice.
What Is a CASP and Who Must Register?
A Crypto Asset Service Provider (CASP) is any person who, as a regular feature of their business, provides one or more of the following services: exchanging crypto assets for fiat currency or other crypto assets, transferring crypto assets, safekeeping or administering crypto assets, or participating in and providing financial services related to an issuer's offer or sale of crypto assets.
The FSCA issued a declaration in October 2022 designating crypto assets as a financial product under the Financial Advisory and Intermediary Services Act (FAIS). This means CASPs must be licensed as financial service providers (FSPs) by the FSCA. The FSCA set a deadline of 30 November 2023 for existing CASPs to apply for a licence. Operating without a licence is a criminal offence.
Separately, the Financial Intelligence Centre Amendment Act added CASPs to Schedule 1 of FICA as accountable institutions, imposing full KYC and AML obligations.
KYC Obligations for Crypto Exchanges
As accountable institutions, South African crypto exchanges must implement the same core KYC obligations as banks and other financial institutions:
- Customer identification and verification. Exchanges must verify the identity of every customer before allowing them to trade. For individuals, this means verifying name, date of birth, identity number, and address. For businesses, it means verifying the entity and all beneficial owners.
- Beneficial ownership. Exchanges must identify the natural persons who ultimately own or control corporate customers. Shell company structures must be looked through to identify the real beneficial owner.
- PEP screening. Exchanges must screen all customers against Politically Exposed Person (PEP) databases and sanctions lists at onboarding and on an ongoing basis.
- Ongoing monitoring. Exchanges must monitor customer transactions for patterns inconsistent with the customer's known profile and risk rating.
- Suspicious transaction reporting. Exchanges must file Suspicious Transaction Reports (STRs) with the FIC when they suspect a transaction involves the proceeds of crime or terrorist financing.
The Travel Rule
The FATF Travel Rule requires virtual asset service providers to collect and transmit originator and beneficiary information when transferring virtual assets above a specified threshold. South Africa has committed to implementing the Travel Rule as part of its FATF action plan. The applicable threshold and implementation timeline should be verified against current FIC guidance.
In practice, the Travel Rule means that when a South African exchange sends crypto to another exchange, it must include the name, account number, and address of the sender, and the name and account number of the recipient. This creates significant technical challenges for exchanges, particularly for transfers to self-hosted wallets.
Risk-Based Approach for Crypto
The risk-based approach is particularly challenging for crypto exchanges because the pseudonymous nature of blockchain transactions makes it difficult to assess customer risk. Exchanges must develop a documented risk assessment that accounts for the specific risks of their business model, including: the use of privacy coins, peer-to-peer transactions, high-frequency trading, and transactions involving high-risk jurisdictions.
Blockchain analytics tools — which trace the origin and destination of crypto assets on-chain — are increasingly used by exchanges to supplement traditional KYC. These tools can identify transactions linked to known illicit addresses, darknet markets, or sanctioned entities.
Penalties for Non-Compliance
Operating as a CASP without an FSCA licence is a criminal offence under FAIS. Non-compliance with FICA obligations can result in administrative sanctions from the FIC, including financial penalties of up to R10 million per contravention. The FSCA can also suspend or revoke an FSP licence. Given South Africa's FATF grey-list status, regulators are under significant international pressure to enforce compliance strictly.
Frequently Asked Questions
- Does a South African crypto exchange need both an FSCA licence and FICA registration?
- Yes. An FSCA licence is required to operate as a financial service provider dealing in crypto assets. FICA registration as an accountable institution is a separate obligation that imposes KYC and AML requirements. Both are required.
- What KYC is required for small crypto transactions?
- FICA does not set a minimum transaction threshold below which KYC is not required. All customers must be identified and verified regardless of transaction size. However, the risk-based approach allows for simplified due diligence for lower-risk customers and transactions.
- Can a South African crypto exchange accept anonymous transactions?
- No. FICA requires exchanges to verify the identity of all customers. Anonymous or pseudonymous transactions are not permitted for regulated exchanges. Privacy coins that obscure transaction details present particular compliance challenges.
- What is the Travel Rule threshold for South African crypto exchanges?
- South Africa has committed to implementing the FATF Travel Rule. The specific threshold should be verified against current FIC guidance, as the implementation timeline and threshold may have been updated since this guide was published.
- Must a crypto exchange verify the identity of the recipient of a withdrawal?
- Under the Travel Rule, exchanges must collect and transmit beneficiary information for transfers above the applicable threshold. For transfers to self-hosted wallets, exchanges must apply a risk-based approach to determine whether additional verification is required.