South Africa -- AML/CFT Compliance Regulatory Overview

Crypto asset service providers (CASPs), also known as virtual asset service providers (VASPs), in South Africa are classified as "accountable institutions" under the Financial Intelligence Centre Act (FICA) of 2001 (as amended), requiring compliance with AML/CFT obligations including customer due diligence, suspicious transaction reporting, and record-keeping. This classification stems from amendments to Schedule 1 of FICA published in Government Gazette 47596 on November 29, 2022, effective December 19, 2022, alongside recognition of crypto assets as financial products under the Financial Advisory and Intermediary Services (FAIS) Act.[1][2][3]

Key AML/CFT Legislation

• Financial Intelligence Centre Act (FICA), 2001 (as amended): Principal law governing AML/CFT, extended to CASPs via Schedule 1 amendments; mandates registration, risk management, and reporting.[1][2][5][6]
• Financial Advisory and Intermediary Services (FAIS) Act: Classifies crypto assets as financial products, requiring FSCA licensing for CASPs.[1][3]
• Money Laundering and Terrorist Financing Control Regulations: Supplements FICA with detailed compliance procedures.[2]

Customer Due Diligence (CDD) Requirements

CASPs must implement KYC procedures, including:

• Customer identification and verification.
• Standard CDD and Enhanced Due Diligence (EDD) for high-risk cases.
• Risk assessments for money laundering, terrorist financing, and proliferation financing.
• Sanctions screening and transaction monitoring.
• Compliance with the Travel Rule (effective April 30, 2025) for originator/beneficiary information in transfers.[2]

CASPs must also appoint a compliance officer, train staff on FICA, and maintain a risk management program.[2]

Suspicious Transaction Reporting

CASPs are required to submit reports on suspicious or unusual transactions to the Financial Intelligence Centre (FIC), including regulatory reports on cash threshold reports and terrorist property reports as per FICA.[1][2][3]

Record-Keeping Obligations

CASPs must retain records of transactions, CDD, and compliance activities as mandated by FICA and its regulations, supporting audits and investigations (specific duration aligns with FICA's 5-year standard, though not explicitly detailed for CASPs in results).[2][6]

Oversight Authorities

Note: Earlier sources (pre-2022) describe crypto as unregulated, but post-2022 developments via FICA amendments and FAIS have imposed these requirements; compliance is ongoing with Travel Rule in 2025.[4][5][6]