Custodial wallet / SaaS in South Africa
Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).
Custodial SaaS is conditionally permitted in South Africa with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Register as an accountable institution with the Financial Intelligence Centre (FIC) under FICA, 2001
- Conduct customer identification and verification (standard CDD)
- Apply Enhanced Due Diligence (EDD) for high-risk cases (e.g., PEPs, complex structures)
- Conduct risk assessments for money laundering, terrorist financing, and proliferation financing
- Sanctions screening and transaction monitoring
- Comply with the Travel Rule (effective April 30, 2025) — originator/beneficiary information on transfers
- Report suspicious transactions under section 29 of FICA
- Report cash transactions over ZAR 49,999.99 under section 28 of FICA
- Appoint a compliance officer — required under the FSP license
- Maintain a complaint resolution mechanism — required under custody provisions of the FSP license
Key Restrictions
- Must hold an FSCA Financial Service Provider (FSP) license under FAIS (crypto assets declared as financial products, November 2022)
- Local key individual and compliance officer required; operator must have a local entity in South Africa
- Capital requirement: ZAR 150,000–1,000,000+ depending on scope
- Custody is included under the FSP license, not a separate standalone custody license
- Exchange control regulations historically applied but May 2025 High Court ruling (Standard Bank v SARB) exempted crypto from 1961 Exchange Control Regulations; new draft regulations pending to integrate crypto into capital flow management
- The COFI Bill (upcoming) may overhaul conduct regulation — licensing framework subject to change
Key Risks
- Regulatory ambiguity: COFI Bill could materially reshape CASP licensing requirements, including for custodial wallets
- Enforcement precedent: Africrypt USD 3.6B fraud case has heightened regulatory and law enforcement scrutiny of crypto custodians in South Africa
- Capital-flow restrictions: SARB is developing a new cross-border crypto framework post-May 2025 — compliance requirements for cross-chain/offshore transfers remain in flux
- Tax exposure: SARS treats crypto as intangible assets under Income Tax Act 1962 — custodial SaaS operators may face complex withholding or reporting obligations for white-label clients
- Dual-liability risk: In a white-label SaaS model, both the SaaS provider (as the licensed CASP holding keys) and the white-label client may have overlapping AML/FAIS obligations — regulatory guidance on allocation is limited
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
The Financial Sector Conduct Authority declared crypto assets a financial product under the Financial Advisory and Intermediary Services Act 37 of 2002 by General Notice 1350 of 2022, published in Government Gazette No. 47334 of 19 October 2022 and signed by Commissioner Unathi Kamlana, and it licenses crypto asset service providers as financial services providers under that Act.
The South African Reserve Bank administers exchange control through its Financial Surveillance Department and ran Project Khokha, a June 2018 proof of concept that built a distributed ledger between participating banks for wholesale interbank settlement on Quorum, followed by Project Khokha 2; its Prudential Authority supervises banks and insurers under the Financial Sector Regulation Act 9 of 2017 and holds no crypto asset licensing mandate, which belongs to the Financial Sector Conduct Authority under the FAIS Act 37 of 2002.
Crypto assets were declared a financial product under the Financial Advisory and Intermediary Services Act 37 of 2002 with effect from 19 October 2022, the date General Notice 1350 of 2022 was published in Government Gazette No. 47334, and not in November 2022.
The Financial Intelligence Centre Act 38 of 2001 carries South Africa's anti-money-laundering and counter-terrorist-financing obligations, and crypto asset service providers have been accountable institutions under item 22 of its Schedule 1 since 19 December 2022, which obliges them to register with the Financial Intelligence Centre and to report suspicious transactions under section 29.
A crypto asset service provider in South Africa must hold a FAIS financial services provider licence from the Financial Sector Conduct Authority in Category I, II, IIA or III, with approved key individuals and, where required, an approved compliance officer; the fit and proper determination in Board Notice 194 of 2017 sets no rand capital band of R150 000 to R1 000 000 but requires liquid assets of 4/52 of annual expenditure for Category I, 8/52 for Category II and 13/52 for Categories IIA and III, with Categories IIA and III also maintaining assets exceeding liabilities by at least R3 million.
Safekeeping and administration of crypto assets is carried on under the same FAIS financial services provider licence rather than a separate custody licence, and it is separately listed at item 22(d) of Schedule 1 to the Financial Intelligence Centre Act 38 of 2001; every FAIS licensee must operate an internal complaints procedure and its clients may refer unresolved complaints to the Ombud for Financial Services Providers established by section 20 of the FAIS Act.
A crypto asset exchange in South Africa requires a FAIS financial services provider licence from the Financial Sector Conduct Authority, and the Exchange Control Regulations of 1961 continue to apply to crypto: crypto assets are excluded from foreign currency, regulation 10(1)(c) prohibits the export of capital or the right to capital without National Treasury permission, and repatriation of value into South Africa through crypto assets is not permitted. South Africa was removed from the FATF list of jurisdictions under increased monitoring on 24 October 2025, having been listed on 24 February 2023.
The Financial Advisory and Intermediary Services Act 37 of 2002 regulates the rendering of advice and intermediary services in relation to financial products, including crypto assets since the declaration of 19 October 2022, and does not reach the issuance of those products, so issuing a crypto asset is not by itself a licensable activity under FAIS.
The Conduct of Financial Institutions Bill, published by National Treasury for public comment in December 2018, would establish a consolidated, comprehensive and consistent regulatory framework for the conduct of financial institutions, and it has not been brought into force: the FAIS Act 37 of 2002 remains the statute under which the Financial Sector Conduct Authority licensed and supervised crypto asset service providers through its reporting date of 31 March 2026.
The Financial Sector Conduct Authority licenses and supervises crypto asset service providers as financial services providers under the Financial Advisory and Intermediary Services Act 37 of 2002; as at 31 March 2026 it had received 533 crypto asset service provider licence applications, approved 310, declined 17 and recorded 124 voluntary withdrawals, and had opened 81 investigations into unlicensed crypto asset service provider activity, of which 51 remained open.
The South African Reserve Bank administers exchange control through its Financial Surveillance Department and is building a cross-border crypto asset framework: the draft Capital Flow Management Regulations, 2026 were published for comment on 17 April 2026 and a draft Crypto Assets Manual for cross-border activities followed on 31 July 2026, both still drafts. Crypto assets remain outside the definition of foreign currency, and regulation 10(1)(c) of the Exchange Control Regulations of 1961 still prohibits exporting capital or the right to capital through crypto assets without National Treasury permission.
The Financial Intelligence Centre supervises anti-money-laundering and counter-terrorist-financing compliance under the Financial Intelligence Centre Act 38 of 2001; crypto asset service providers have been accountable institutions under item 22 of Schedule 1 since 19 December 2022, must register with the Centre and must file suspicious transaction reports under section 29, and 256 of them were registered under item 22 as at 10 February 2025.
The South African Revenue Service taxes crypto assets under the Income Tax Act 58 of 1962, treating them as assets of an intangible nature rather than as currency, and its media release of 6 April 2018 confirmed that normal income tax rules apply, with income taxed on revenue account under gross income or, where the gain is capital in nature, under the Eighth Schedule as a capital gain.
Crypto assets are a financial product for the purposes of the Financial Advisory and Intermediary Services Act 37 of 2002 because the Financial Sector Conduct Authority, and not the Minister of Finance, declared them so in General Notice 1350 of 2022, Government Gazette 47334 of 19 October 2022, acting under paragraph (h) of the definition of financial product in section 1 of that Act, so a crypto asset service provider must hold an FSP licence.
Crypto asset service providers are accountable institutions under item 22 of Schedule 1 to the Financial Intelligence Centre Act 38 of 2001, inserted by the Minister of Finance through the Schedule amendment published in Government Gazette 47596 of 29 November 2022 and effective 19 December 2022, and they must register with the Centre, apply customer due diligence, maintain a Risk Management and Compliance Programme under section 42, report suspicious and unusual transactions under section 29 and file cash threshold reports under section 28.
SARS treats crypto assets as assets of an intangible nature rather than as currency, and under the Income Tax Act 58 of 1962 a gain is either included in gross income and taxed at marginal rates or taxed as a capital gain under the Eighth Schedule, according to ordinary South African revenue-versus-capital jurisprudence.
The Exchange Control Regulations of 1961 made under the Currency and Exchanges Act 9 of 1933 still govern crypto asset flows: the SARB Financial Surveillance Department applies Regulation 10(1)(c), neither the Currency and Exchanges Manual for Authorised Dealers nor the ADLA manual permits cross-border transfers to purchase crypto assets, and repatriation of value into South Africa through crypto assets is not permitted, while the draft Capital Flow Management Regulations, 2026 published as Government Notice 54520 in Government Gazette 7375 of 17 April 2026 are proposed to replace them and to close the gap on cross-border crypto asset transactions.
The crypto asset travel rule came into operation in South Africa on 30 April 2025 under clause 9.1 of FIC Directive 9, issued under section 43A(2) of the Financial Intelligence Centre Act 38 of 2001 and published as Notice 5543 in Government Gazette 51556 of 15 November 2024.
The Financial Intelligence Centre Act 38 of 2001 governs South African AML/CFT, and crypto asset service providers became accountable institutions at item 22 of Schedule 1 through the Schedule amendment published in Government Gazette 47596 of 29 November 2022 with effect from 19 December 2022, rather than through the General Laws Amendment Act 22 of 2022.
The Financial Sector Conduct Authority Commissioner declared a crypto asset to be a financial product under paragraph (h) of the definition in section 1 of the Financial Advisory and Intermediary Services Act 37 of 2002 by General Notice 1350 of 2022, published in Government Gazette 47334 of 19 October 2022, and it is that declaration rather than the Act itself that brings crypto asset service providers into financial services provider licensing.
The Money Laundering and Terrorist Financing Control Regulations are made under the Financial Intelligence Centre Act 38 of 2001 and were amended by Government Notice 2638 in Government Gazette 47302 of 14 October 2022, which raised the cash threshold reporting figure to R50 000 with effect from 14 November 2022.
Customer identification and verification.
Standard CDD and Enhanced Due Diligence (EDD) for high-risk cases.
Risk assessments for money laundering, terrorist financing, and proliferation financing.
Sanctions screening and transaction monitoring.
South African crypto asset service providers have had to comply with the travel rule since 30 April 2025 under Financial Intelligence Centre Directive 9, issued on 15 November 2024 under section 43A(2) of the Financial Intelligence Centre Act 38 of 2001 and published as Notice 5543 in Government Gazette No. 51556, which requires originator and beneficiary information to accompany every crypto asset transfer.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a custodial wallet / SaaS operator must obtain an FSCA FSP license under FAIS (capital ZAR 150k–1M+), establish a local entity with a key individual and compliance officer, comply with full FICA AML/CTF obligations including the Travel Rule, and navigate evolving exchange-control and COFI Bill reforms.
Questions this verdict aims to answer
- What custody license / qualified-custodian status applies?
- What segregation, insurance, and proof-of-reserves rules apply?
- What AML obligations attach to the SaaS vs the white-label client?