Operating a digital-asset business in South Africa without the right authorisation is no longer a calculated risk — it is an enforcement exposure. South Africa's Financial Sector Conduct Authority (FSCA) brought crypto asset service providers (CASPs) under the country's Financial Advisory and Intermediary Services Act regime in late 2022, making South Africa one of the first African jurisdictions to formalise a licensing requirement for digital-asset businesses. Any exchange, broker, custodian or advisory operation touching South African clients or domiciled in the country must now hold — or be actively pursuing — a CASP licence under the FSCA regime. The sections below map that regime, explain who is caught, and set out what an inbound operator should expect.
The Regulator and the Regime
South Africa's digital-asset licensing regime sits within the Financial Sector Conduct Authority (FSCA), the country's market-conduct regulator. The FSCA designated crypto assets as a financial product under the Financial Advisory and Intermediary Services Act (FAIS) — a move that brought digital-asset businesses into the same supervisory architecture as investment advisers, brokers and other regulated financial services providers. A separate but related stream runs through the Financial Intelligence Centre (FIC), which applies anti-money laundering (AML) and counter-terrorism financing (CTF) obligations under the Financial Intelligence Centre Act to crypto asset service providers.
The two regulatory tracks are not alternatives. A South African CASP must satisfy both: the FSCA FAIS authorisation for market-conduct purposes and FIC registration for AML/CFT purposes. Operators we advise sometimes assume that FIC registration alone is sufficient. It is not. The FSCA FAIS licence is the primary gate for any business offering investment, advisory or intermediary services in digital assets to South African clients.
The FSCA's decision to use the FAIS architecture — rather than a bespoke digital-asset statute — was deliberate. It meant the compliance toolkit already existed: fit-and-proper requirements for key individuals, ongoing reporting, conflict-of-interest management and client-protection obligations. For an inbound operator, this has a practical consequence: the South African licensing process looks less like a greenfield crypto authorisation and more like a traditional financial-services application with digital-asset-specific overlays.
To discuss how the South African CASP regime applies to your specific structure, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts — the entity's domicile, the user base's location, the specific services offered — change the analysis significantly.
Who Needs a CASP Licence?
Any business that provides, as a regular feature of its operations, advice or intermediary services in relation to crypto assets to clients in South Africa requires CASP authorisation under the FSCA regime. The definition of "advice" and "intermediary services" under FAIS is broad: it reaches entities that execute transactions on behalf of clients, manage portfolios that include crypto assets, facilitate purchases or sales, or operate an exchange or trading venue. Custody-only operations have a distinct regulatory footprint and may require separate assessment.
The jurisdictional reach of the South African regime extends beyond entities incorporated in South Africa. An exchange incorporated offshore but actively marketing to, onboarding or servicing South African retail or professional clients is exposed to the FSCA's supervisory perimeter. The cross-border angle is critical: a business licensed in a European Union jurisdiction under the MiCA (Markets in Crypto-Assets Regulation) regime, or in Singapore under the Payment Services Act administered by the Monetary Authority of Singapore (MAS), does not obtain any automatic passport into South Africa. Each jurisdiction stands alone.
The carve-outs are narrow. Entities that hold crypto assets purely on their own account, with no client-facing intermediary function, generally fall outside the CASP perimeter. Technology providers and infrastructure vendors that do not interact with the underlying asset may also fall outside the scope — but the analysis is fact-specific and the FSCA has taken a broad view of what constitutes "intermediary services."
Licence Categories and the Application Process
Under the FAIS-based CASP regime, authorisation is granted as a category of FAIS licence, with the specific crypto-asset activities listed as permissible product endorsements on the licence. The applicant must identify the precise activities it intends to conduct — for example, advice and intermediary services in buying, selling, managing or safekeeping crypto assets — and demonstrate competency across each.
The fit-and-proper assessment is central. The FSCA requires that key individuals and representatives meet prescribed experience, qualification and honesty and integrity standards. This is not a box-checking exercise. The FSCA scrutinises the background and track record of those nominated to hold the licence. For an offshore group seeking South African authorisation, the choice of key individual — typically a South African resident director with relevant financial-services experience — is one of the most consequential early decisions.
The application involves: a completed FSCA application form; a business plan describing the crypto-asset activities, client types and risk management approach; a compliance framework aligned to FAIS and the General Code of Conduct; evidence of professional indemnity or fidelity insurance; and proof of FIC registration. The timeline from a complete application submission to an authorisation decision varies — the FSCA has not published a fixed statutory clock — and depends materially on application quality, the complexity of the business model and the FSCA's queue at the time of submission. Operators in our practice should plan for a process measured in months rather than weeks.
A key procedural consideration is that the FSCA granted a transitional period for operators who were already conducting crypto-asset business before the CASP designation. That window has closed. Businesses that failed to file within the transitional period are now operating outside the authorised perimeter and face heightened enforcement risk.
AML/CFT and the FATF Travel Rule
South Africa's AML/CFT obligations for crypto-asset businesses run through the Financial Intelligence Centre (FIC) and are grounded in the Financial Intelligence Centre Act. CASPs are designated accountable institutions, which means they carry the full suite of customer due diligence, record-keeping, transaction monitoring and suspicious-activity reporting obligations that apply to banks and other regulated financial institutions.
South Africa is a member of the Financial Action Task Force (FATF) and has been under FATF's enhanced follow-up process following a 2021 mutual evaluation report. The country made significant legislative and supervisory reforms to achieve greylisting removal — and its inclusion of CASPs as accountable institutions was part of that remediation effort. For an inbound digital-asset operator, the implication is direct: the FSCA and FIC will apply heightened scrutiny to CASP applications and ongoing supervision, precisely because the country is demonstrating to FATF that its digital-asset supervision is substantive.
The Travel Rule — the FATF obligation to pass originator and beneficiary data with virtual asset transfers — applies to South African CASPs under the FIC framework. The practical implementation of the Travel Rule requires technical infrastructure (a VASP-to-VASP messaging solution), internal policies and a counterparty due-diligence program. Operators entering South Africa for the first time frequently underestimate the Travel Rule build-out as a go-live dependency.
Banking and the Cross-Border Reality
Securing a South African CASP licence does not guarantee a banking relationship — and the banking question is, in many cases, the harder operational problem. South African banks have been cautious in onboarding crypto-asset businesses, and several major institutions have imposed de-facto restrictions on CASP accounts. A licence is necessary but not sufficient; the bank's own risk appetite and AML requirements govern independently of the regulatory authorisation.
For a business sitting between a South African operating entity and an offshore group — a common structure for exchanges and custodians — the interplay of the South African CASP licence, the offshore regulatory status, the group AML framework and the local bank's correspondent banking requirements creates a multi-layered compliance stack. The bank will want to see the FSCA authorisation, the FIC registration, the AML policies and, typically, evidence of the group's AML standing in its primary regulatory home.
The tax dimension adds a further layer. South Africa's South African Revenue Service (SARS) has published guidance treating crypto assets as assets for income tax and capital gains purposes. A business operating a South African CASP must account for the tax treatment of its own trading, its income and, where relevant, any transfer-pricing implications of transactions with affiliated offshore entities. Cross-border remittances in crypto assets also engage South Africa's exchange-control regime, administered by the South African Reserve Bank (SARB). In our cross-border practice, we routinely see exchange-control analysis treated as an afterthought — it should be part of the initial structuring work.
If your banking or exchange-control analysis is stalling the South African build, write to OBOLUS at info@oboluslaw.com. If a prior application stalled or an account was closed, a second read can surface the structural reason and the route forward.
How South Africa Compares for an Inbound Operator
South Africa occupies a distinct position among African jurisdictions: it has a functioning, codified CASP licensing regime, an active and capable regulator, and a meaningful domestic digital-asset market. For a business targeting the African continent, South Africa is often the anchor jurisdiction — the licence that anchors local credibility, enables bank account opening and supports regulatory dialogue with other African regulators that look to South Africa as a model.
Compared with EU-based licensing under MiCA and ESMA oversight, South Africa offers a narrower passporting perimeter (it is a domestic licence only) but a potentially faster entry path for businesses focused on sub-Saharan Africa rather than the European Economic Area. Compared with offshore common-law registrations in the BVI or Cayman Islands, a South African CASP licence carries more supervisory weight — a FAIS-authorised entity has ongoing FSCA oversight, which some institutional counterparties and banks value as a proxy for compliance quality.
The risk profile for an inbound operator is genuine. The FSCA is not a passive regulator. The post-greylisting supervisory posture means that CASP authorisations will be scrutinised carefully, and ongoing compliance obligations — annual reporting, key-individual changes, product changes requiring licence variation — demand a live compliance function, not a shelf document. Operators who treat the South African licence as a one-time administrative exercise consistently encounter the most difficulty.
In a recent licensing matter, a payments-adjacent business sought to enter South Africa as part of a broader African expansion. The initial structure proposed an offshore holding company acting as the licenced entity. After reviewing the FSCA's fit-and-proper requirements and the FIC accountable-institution obligations, we restructured the approach around a South African operating subsidiary with a locally resident key individual, integrated the group AML framework to satisfy FIC standards and coordinated the bank onboarding in parallel with the FSCA application. The entity received its authorisation and the banking relationship was established within the same quarter.
Self-Assessment: Is Your Business Ready for CASP Authorisation?
Before committing to a South African CASP application, a business should be able to answer the following questions affirmatively. Each represents a common failure point in our practice.
- Do you have a South African legal entity, or a clear plan to establish one, that will hold the CASP licence?
- Have you identified a key individual with the FSCA-prescribed experience and fit-and-proper profile who can be nominated on the application?
- Does your business plan clearly delineate the specific crypto-asset activities you will conduct, the client types you will serve and the risk management approach you will apply?
- Is your AML/CFT framework documented, tested and aligned to the FIC's accountable-institution requirements, including a Travel Rule solution?
- Have you assessed the exchange-control implications of your cross-border flows with SARB in mind?
- Have you engaged at least one South African bank at the pre-application stage to gauge account-opening feasibility?
- Have you reviewed the FAIS General Code of Conduct and mapped your operational procedures to its requirements?
A "no" on any of these is a gap that the FSCA will identify. Addressing them before filing — rather than in response to requisitions from the regulator — shortens the process materially.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – how we structure multi-jurisdiction licence stacks for exchanges, custodians and token issuers
- Economic Substance for Licensed VASPs in Germany under BaFin – the substance requirements that VASP-licensed entities face in a leading EU jurisdiction
- VAT Treatment of Crypto Services: What Recent Enforcement Tells Operators – tax exposure sitting alongside the licence obligation for service providers
FAQ
How long does a crypto licence take to obtain?
In South Africa, the FSCA has not published a fixed statutory decision clock for CASP authorisations. In practice, the timeline depends on the completeness and quality of the application, the complexity of the business model and the regulator's current caseload. Operators should plan for a process measured in months rather than weeks. A well-prepared application — with a complete compliance framework, a credible key individual and a clear business plan — moves materially faster than one that requires multiple rounds of FSCA requisitions.
Which jurisdiction is best for licensing my crypto business?
There is no single answer. The right jurisdiction turns on where your clients are located, where your banking and infrastructure sit, and which regulatory profile your institutional counterparties and investors require. South Africa is the natural anchor for businesses targeting sub-Saharan Africa. EU-regulated businesses serving European users need MiCA CASP authorisation. Businesses with a global user base typically require a layered licence stack across two or more jurisdictions. We map those options before you commit to any single structure.
Do I need a separate custody licence?
Under the South African CASP regime, custody of crypto assets is a regulated activity that must be listed as a permissible endorsement on your FAIS CASP licence. It is not automatically included in a general crypto-advisory or intermediary authorisation. If your business model includes holding client assets — whether as an exchange wallet, a standalone custodian or a fund administrator — you must ensure the custody activity is explicitly covered in your licence scope. Failing to do so is one of the most common structural gaps we identify in operator builds entering South Africa.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance obligations that sit around them. Digital assets are the whole of our practice. We map the licence, custody and payment stack across operating layers before you commit — not after a problem emerges. To discuss your South African or broader African licensing position, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst — specialising in CASP authorisations, inbound operator structuring and multi-jurisdiction digital-asset licence stacks across Africa, the Gulf and Asia-Pacific.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.