Crypto Exchange Setup in South Africa: Legal Requirements for Businesses

Operating a crypto exchange (a platform that facilitates the buying, selling or exchange of virtual assets for fiat or other digital assets) in South Africa without the correct authorisation now carries direct enforcement exposure. The Financial Sector Conduct Authority (FSCA) formally designated crypto assets as a financial product under the Financial Advisory and Intermediary Services Act (FAIS Act) regime, and the South African Reserve Bank (SARB) and the Financial Intelligence Centre (FIC) impose parallel obligations on businesses that handle virtual assets. Any business accepting South African users, holding their assets or facilitating trades must map its activities against this three-regulator matrix before it opens a single trading pair.

This page explains the regulated perimeter, the authorisation process, the cross-border realities that trip most inbound operators, and the structural decision a business needs to make before committing capital to the South African market.

What legal regime governs a crypto exchange in South Africa?

South Africa's crypto exchange regime is layered across three authorities, and getting one right while ignoring another is a common and costly mistake. The FSCA sits at the centre: its 2022 declaration brought crypto assets within the FAIS Act, meaning any person who provides advice on, or intermediary services in, a crypto asset to a client for remuneration or reward requires a Financial Services Provider (FSP) licence with a crypto-asset sub-category endorsement. Operating an exchange platform that takes client orders and executes them falls squarely within intermediary services. The FSCA has been explicit that platforms accepting South African retail or institutional clients are within scope, regardless of where the operator is incorporated.

The FIC governs the anti-money-laundering and counter-terrorism financing layer. Under the Financial Intelligence Centre Act and its 2022 amendments, crypto asset service providers are accountable institutions. That means mandatory registration with the FIC, the implementation of a risk-based AML/CFT programme, customer due diligence, record-keeping and, critically, Travel Rule compliance – the obligation to pass originator and beneficiary data with any virtual asset transfer above the applicable threshold.

The SARB and its Prudential Authority overlay operates through the exchange control regime and through the broader prudential supervision of businesses that hold client assets. Exchanges that take custody of client crypto assets, or that settle in South African rand across their own treasury, should expect the SARB's exchange control rules to bear on cross-border fund flows. In our practice, this is the layer that surprises inbound operators most: a Seychelles-incorporated exchange serving South African users is not insulated from SARB scrutiny on rand-denominated settlement.

Who must register or obtain authorisation to operate?

Any business that provides advice about crypto assets or acts as an intermediary between buyers and sellers in South Africa requires FSCA authorisation as a Financial Services Provider with the relevant crypto-asset endorsement. The test is functional, not jurisdictional. A platform incorporated in Malta, the BVI or the UAE that accepts South African account sign-ups, takes rand deposits and allows trading is providing intermediary services in South Africa. The FSCA has made clear that offshore incorporation does not place a business outside the regulated perimeter if it actively targets the South African market.

Beyond the exchange function itself, three ancillary activities carry their own obligations. First, custody: holding client crypto assets in omnibus wallets or proprietary infrastructure triggers both the FSCA's safeguarding expectations and the FIC's accountable-institution duties. Second, payment settlement: converting trading proceeds into rand and remitting them to client bank accounts touches the National Payment System Act and, in some cases, requires coordination with a licensed payment service provider. Third, referral and advisory services: introducing clients to exchanges or providing market-commentary services for a fee falls within the FAIS Act's definition of financial advice and requires the relevant FSP authorisation category.

The FSCA provided an initial licensing window for existing operators after the 2022 declaration, requiring those already in market to apply for FSP authorisation by a specified deadline. New entrants must obtain authorisation before commencing business. Businesses that missed the transitional window and continued operating face the direct enforcement risk that the FSCA has signalled it will pursue.

For a scoped assessment of your South African licensing exposure, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the banking and custody model – change the analysis. Map your options with our team.

How does the FSP authorisation process work for a crypto exchange?

The FSCA FSP authorisation process for a crypto-asset intermediary follows the standard FAIS Act application pathway, with additional requirements specific to the crypto-asset sub-category. The process begins with a fit-and-proper assessment of key individuals: the representative and the key individual responsible for the business must meet the FSCA's qualification, experience, honesty, integrity and good standing requirements. For a crypto-asset intermediary, this means demonstrating relevant experience in virtual-asset markets – not just general financial-services experience.

The application itself is submitted to the FSCA and requires, among other things, a detailed description of the business model, the products or services to be provided, the technology infrastructure, the client onboarding and AML/KYC procedures, the conflicts-of-interest management framework, and the operational resilience arrangements. The FSCA has been increasing its scrutiny of technology-risk disclosures in particular: an application that treats the platform as a black box will face requests for additional information and extended processing timelines.

Once the FSCA authorisation is in place, the operator must register with the FIC as an accountable institution under Schedule 1 of the FIC Act. Registration is separate from FSCA authorisation; it is not automatic. The FIC registration requires the appointment of a Compliance Officer and the implementation of a written, board-approved Risk Management and Compliance Programme. The programme must address customer identification and verification, enhanced due diligence for higher-risk clients and jurisdictions, transaction monitoring, suspicious transaction reporting and Travel Rule compliance for virtual-asset transfers.

In practical terms, an inbound operator building from scratch should expect the combined FSCA and FIC process to take a number of months, with timeline dependent on the completeness of the initial application, the complexity of the business model and the responsiveness of the applicant. Applications that present a clear entity structure, experienced key individuals and a credible AML programme from the outset move faster than those that require iterative supplementation.

How does the cross-border structure affect a South African exchange?

Most crypto exchanges that enter the South African market do so through an offshore holding structure, and the interaction between that structure and the South African regulatory regime creates a set of tensions that must be planned for, not discovered after launch. South Africa maintains a foreign-exchange control regime administered by the SARB through its Authorised Dealers. Any cross-border movement of value – whether in fiat or crypto – by South African residents has exchange-control implications. An exchange that settles trading profits offshore, or that routes client rand deposits through an offshore treasury before returning them, needs explicit exchange-control analysis.

The cross-border banking question is equally pointed. South African banks have, like their counterparts in many other markets, applied heightened scrutiny to crypto-asset businesses seeking rand settlement accounts. An operator that cannot demonstrate FSCA authorisation and FIC registration will find it difficult – and in many cases impossible – to obtain a working banking relationship with a South African commercial bank. The licensing stack is therefore not just a regulatory compliance item; it is the precondition for a functional banking relationship.

From a tax perspective, the South African Revenue Service (SARS) treats crypto assets as assets of an intangible nature. Profits from exchange operations are subject to corporate income tax in South Africa if the exchange is effectively managed from South Africa or if it has a permanent establishment there. Transfer-pricing rules apply to intra-group transactions between a South African operating entity and an offshore holding or treasury entity. An exchange structured to route all economic substance offshore while retaining South African key individuals and decision-making will likely be re-characterised by SARS.

Where the platform also operates in other markets – the EU under MiCA, the UAE under the VARA regime, or Singapore under the MAS Payment Services Act – the South African entity must be mapped against those licences. A single offshore licence does not travel to South Africa; the FSCA's reach is not neutralised by MiCA authorisation in an EU member state. We regularly advise exchange operators on how to structure the licence, banking and tax stack across multiple operating jurisdictions before they commit capital to any one market.

A recent cross-border exchange structuring matter

In a recent matter, an exchange operator incorporated in a leading common-law offshore jurisdiction sought to launch a rand-denominated trading pair for South African institutional clients. The operator had assumed that its existing VASP registration in that offshore jurisdiction provided sufficient regulatory cover. We identified that the business model – resident South African key individuals, a South African-domiciled clearing bank account and active marketing to South African entities – brought it squarely within the FSCA's regulated perimeter. We structured a separate South African operating entity, mapped the FIC accountable-institution obligations and prepared the FSP authorisation application. The operator launched with both regulators satisfied and a functioning rand banking relationship in place, rather than discovering the exposure after client onboarding had begun.

What are the most common mistakes when setting up a South African crypto exchange?

Treating FSCA authorisation and FIC registration as sequential rather than parallel is the single most common structural error we see. Operators that obtain FSCA authorisation but delay FIC registration find that their banking partners – alerted to the gap – will not open or maintain accounts. The two processes should run concurrently, with the AML programme documentation drafted in parallel with the FSCA application narrative.

A second persistent mistake is under-investing in key-individual qualification evidence. The FSCA's fit-and-proper requirements for the crypto-asset sub-category are specific. A key individual whose experience is entirely in traditional asset management, without documented crypto-market experience, will face additional scrutiny. Operators that build the key-individual profile before submitting an application – rather than trying to satisfy the requirement through supplementary submissions – avoid significant delays.

Third, and closely related to the cross-border section above, is the assumption that a single offshore licence satisfies the South African regulatory requirement. A common assumption among inbound operators is that authorisation in a well-regarded jurisdiction – Malta, Lithuania, or even the UAE – creates a passporting effect into South Africa. It does not. South Africa operates an autonomous licensing regime; FSCA authorisation must be obtained in its own right. Operating under an offshore licence while accepting South African users is precisely the exposure that the FSCA's enforcement programme is designed to address.

If your application stalled or your banking relationship has come under pressure, a second review can surface the structural cause and the path forward. Write to our team at info@oboluslaw.com or map your options.

Which operator profile should prioritise South African authorisation?

Not every business needs a South African FSP licence on day one. The decision turns on the operator's South African nexus, user base and revenue model. Three profiles illustrate the range of positions we see in practice.

Profile A – inbound exchange with South African retail users: a platform that accepts South African resident sign-ups, allows rand deposits and operates crypto-to-rand or crypto-to-crypto trading pairs. This profile requires FSCA FSP authorisation with crypto-asset endorsement, FIC registration and a dedicated South African compliance officer. Exchange-control analysis is mandatory before the first rand deposit is taken. Timeline to compliant launch is typically measured in months from submission of a complete application; the earlier the process starts, the sooner the banking relationship can be established.

Profile B – offshore exchange with incidental South African usage: a platform that geo-blocks South Africa at the IP and onboarding level, accepts no rand deposits and has no South African key individuals. This profile carries substantially reduced FSCA exposure, though it is not zero – the FIC Travel Rule obligations may still arise if the platform processes transfers from South African-domiciled counterparties. Periodic review is advisable as the FSCA's extraterritorial reach continues to develop.

Profile C – institutional-only OTC or prime services desk targeting South African financial institutions: this profile does not involve retail clients but does involve providing intermediary services to South African counterparties. It likely requires FSCA authorisation in the relevant sub-category, and the SARB's exchange-control analysis is central to the structure. The tax permanent-establishment question is particularly acute in this model if the business deploys personnel into South Africa to manage institutional relationships.

Related at OBOLUS

Related at OBOLUS

• Licensing and Registration for Digital Asset Businesses – full-service VASP and CASP licensing across 70+ jurisdictions, from initial scoping to authorisation
• CASP Authorisation under MiCA in Brazil – how MiCA applies to Latin American operators and the cross-border structuring considerations
• De-Risking and Account Closure Defence in ADGM – defending banking relationships and managing de-risking exposure in the Abu Dhabi Global Market

FAQ

How long does a crypto licence take to obtain?

Timeline varies significantly by jurisdiction and by the complexity of the business model. In South Africa, the FSCA FSP authorisation process for a crypto-asset intermediary typically takes a number of months from submission of a complete application, with FIC registration running in parallel. Applications that are complete and well-documented on first submission move materially faster than those requiring iterative supplementation. In other leading hubs, timelines range from weeks to well over a year depending on the regulatory programme and the applicant's profile.

Which jurisdiction is best for licensing my crypto business?

There is no single answer. The right jurisdiction depends on where your users are, where your banking sits, your product type, and your appetite for ongoing compliance cost. South Africa requires authorisation for any business actively serving South African clients, regardless of where the operator is incorporated. Operating from a single offshore licence and treating it as globally sufficient is the most common and costly structural error. We map the full licence, banking and tax stack for each operator before any commitment is made to a particular jurisdiction.

Do I need a separate custody licence?

In South Africa, custody of client crypto assets is treated as part of the intermediary-services regulated perimeter and falls within the FSCA's expectations for an authorised FSP. There is no separate standalone custody licence at this stage, but the FSCA imposes specific safeguarding and operational requirements on FSPs that hold client assets. In other jurisdictions – Singapore, Hong Kong, the UAE and the EU under MiCA – custody is a separately defined regulated activity that may require its own authorisation. A multi-jurisdiction custody model must be mapped against each applicable regime independently.

OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance obligations that sit around them. Digital assets are the entirety of our practice. We map the licence, banking and tax stack across operating, custody and payment layers before you commit, and we act only for businesses – not retail clients. To discuss your situation, contact info@oboluslaw.com.

By Aisha Tan, Licensing & Jurisdictions Analyst – specialist in inbound exchange and VASP authorisation across African and emerging-market regulatory regimes.

This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.