South Africa was one of the first major economies to bring crypto assets fully within its financial services regulation. Since 2023, businesses that provide crypto asset services to South African clients have needed a licence from the Financial Sector Conduct Authority (FSCA). They must also comply with anti-money laundering rules, including the “travel rule” for crypto transfers.
The regime has matured quickly. By the end of 2025, the FSCA had received 512 applications from crypto asset service providers (CASPs), approved 300 and declined 14, with 121 withdrawn. It has also opened dozens of investigations into businesses operating without a licence.
This article explains who needs a licence, what the licensing process involves and the ongoing compliance obligations that apply.
Crypto assets are financial products
In October 2022, the FSCA declared crypto assets to be financial products under the Financial Advisory and Intermediary Services Act 37 of 2002 (FAIS Act). The consequence is that any person who gives advice or renders intermediary services in relation to crypto assets must be an authorised financial services provider (FSP), or a representative of one. The licensing requirement took effect in 2023.
Who needs a licence?
A licence is generally required by businesses that, for clients in South Africa:
- operate a crypto asset exchange or trading platform;
- buy, sell or exchange crypto assets on behalf of clients, or arrange transactions;
- provide custody or wallet services, where the provider controls clients’ assets or keys;
- give advice or recommendations on crypto assets; or
- manage crypto asset portfolios on a discretionary basis.
Activities that the FSCA has indicated do not currently require a CASP licence include crypto mining and node operation, and most NFT services, although this may change. Crypto derivatives are regulated as securities under the Financial Markets Act and require the appropriate authorisation under that regime.
Foreign platforms that actively market to or onboard South African clients are not exempt simply because they are based offshore.
The licensing process
An applicant must show the FSCA that it meets the FAIS fit and proper requirements, including:
- honesty, integrity and good standing of the business and its key individuals;
- competence: key individuals must have the qualifications and relevant experience for the crypto services offered;
- operational ability: a credible business plan, adequate systems, governance, risk management and IT security, and appropriate arrangements for safeguarding client assets; and
- financial soundness.
According to the FSCA, the most common reasons for declined applications have been inadequate operational ability, such as unclear business models, and insufficient competency of key individuals. Preparing the application carefully, with properly documented policies and a clear description of the services and technology, makes a material difference.
Anti-money laundering: the FIC Act
CASPs are accountable institutions under the Financial Intelligence Centre Act 38 of 2001 (FIC Act). This means they must:
- register with the Financial Intelligence Centre (FIC);
- adopt a risk management and compliance programme (RMCP);
- conduct customer due diligence, including identifying and verifying clients and beneficial owners;
- screen clients against targeted financial sanctions lists;
- keep records;
- report suspicious and unusual transactions, and certain cash and other transactions, to the FIC; and
- appoint a compliance officer and train staff.
The travel rule
The FIC’s Directive 9 implements the Financial Action Task Force’s “travel rule” for crypto transfers. CASPs that send or receive crypto asset transfers must obtain, hold and transmit prescribed information about the originator and the beneficiary of the transfer. Where a transfer involves an unhosted wallet or a CASP in a jurisdiction that does not apply the travel rule, the CASP must apply a risk-based approach and may need to take additional steps or decline the transfer. The FIC has made it clear that there are no blanket exemptions.
Other rules that apply
- Conduct of business. As FSPs, CASPs must comply with the FAIS General Code of Conduct, including rules on disclosure, conflicts of interest, complaints handling and record-keeping, and treating customers fairly.
- Advertising. Crypto marketing must be fair and not misleading, and must not promise returns or downplay risk.
- Exchange control. Moving crypto assets offshore, or using them to transfer value across the border, has exchange control implications. South African residents must stay within their allowances and the reporting rules.
- Tax. SARS treats crypto assets as assets for tax purposes, and gains may be taxed as income or capital gains. International tax reporting for crypto (the OECD’s Crypto-Asset Reporting Framework) is being implemented in South Africa, which will increase SARS’s visibility of crypto holdings.
- POPIA applies to the personal information collected during onboarding and transaction monitoring.
Operating without a licence
Rendering financial services without the required authorisation is a criminal offence under the FAIS Act and can lead to fines, imprisonment and administrative penalties. The FSCA has stated that it will take enforcement action against any entity conducting crypto asset services without a licence, and it publishes warnings about unlicensed providers. Directors and key individuals can be personally affected.
Fintech beyond crypto
Crypto is only one part of fintech regulation. Payments businesses, lenders, insurtech and investment platforms may also need authorisation under the National Payment System Act, the National Credit Act, the Insurance Act or the Financial Markets Act, and may be subject to the Conduct of Financial Institutions (COFI) regime once in force. Mapping the business model against all of these regimes early avoids expensive restructuring later.
Checklist for crypto and fintech businesses
- Have we mapped every service we offer against the FAIS Act and other licensing regimes?
- Are we licensed, or do we operate as a representative of a licensed FSP?
- Are we registered with the FIC, with an up-to-date RMCP?
- Do our systems comply with the travel rule?
- Are client assets properly safeguarded and segregated?
- Have we addressed exchange control, tax and POPIA?
How O’Reilly Law can help
We advise crypto and fintech businesses on regulatory mapping, FSCA licence applications, FIC registration and risk management and compliance programmes, terms of use, client agreements and privacy policies, and capital raising. We also assist with regulatory inquiries and enforcement matters.
Launching or scaling a crypto or fintech business? Contact us for a regulatory review.
Related reading: SaaS: key legal considerations · Data breaches and POPIA
This article is general information and not legal, tax or financial advice. Correct as at October 2026.