South Africa sits at the intersection of a rapidly maturing payments regime and a digital-asset environment that is still finding its regulatory footing. For a crypto business seeking fiat rails in the country – whether as an acquirer onboarding merchants, a PSP (payment service provider) routing settlement, or a VASP (virtual asset service provider) needing a banking relationship – the legal question is precise: which instruments are required, who issues them, and what does the cross-border stack look like when the entity, the users and the banking sit in different places? The answers turn on the interplay between the South African Reserve Bank, the Financial Sector Conduct Authority and, increasingly, the FSCA's VASP registration regime.
South Africa regulates payment activity through the National Payment System Act and its subordinate frameworks administered by the South African Reserve Bank (SARB). A business seeking to operate a PSP or acquiring function in South Africa must engage with SARB's oversight over payment system participants, with FSCA supervision where the business touches financial products, and – for crypto-facing operators – with the FSCA VASP registration regime that came into effect when the FSCA designated crypto assets as a financial product. The page below maps each instrument, the application process, the cross-border interaction and the decision points a legal team must clear before committing capital to the South African market.
What is the regulatory perimeter for payment services in South Africa?
Payment activity in South Africa falls under the National Payment System Act, supervised by SARB, and any entity processing, clearing or settling payments on behalf of third parties must fit within that regime's participation framework. The SARB Payment Association of South Africa (PASA) accredits payment system participants across designated categories – including acquirers and third-party payment processors – and no entity may perform those functions without the relevant accreditation or a sponsoring bank relationship. The FSCA sits alongside SARB: where the PSP deals in instruments that qualify as financial products under the Financial Advisory and Intermediary Services Act (FAIS), an additional FSCA authorization layer applies.
For crypto-facing businesses, the picture sharpened materially when the FSCA formally designated crypto assets as a financial product under the Financial Sector Regulation Act. That designation pulled VASPs into the FSCA's supervisory perimeter and created a registration obligation that runs parallel to – and does not substitute for – the payment-system accreditation operated by SARB. Operators who assumed that a VASP registration alone covers payment activity are at risk. The two regimes address different functions and both must be satisfied.
The acquiring side of the equation adds a further layer. An acquirer in South Africa is the entity that contracts with merchants to accept card or digital payments and routes those transactions for settlement. Acquiring activity is a designated function under the national payment system rules. A foreign entity wishing to acquire South African merchants from offshore – a common structure for crypto platforms – must assess whether its activity triggers the local participation threshold, whether a sponsored-bank model is viable, and what cross-border data and settlement obligations follow.
CTA #1The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis. If you are assessing whether a South African PSP or acquiring agreement is viable for your business, OBOLUS maps the licence, the bank-sponsorship structure and the cross-border settlement layer before you commit. Map your options
How does FSCA VASP registration connect to a PSP agreement?
FSCA VASP registration is the threshold obligation for any business that exchanges, transfers, safeguards or administers crypto assets for clients in South Africa – but it does not itself authorize the handling of fiat payments. The two instruments solve different problems: VASP registration governs the crypto-asset activity; PSP accreditation or a payment-system sponsorship arrangement governs the fiat leg. A crypto exchange operating in South Africa needs both, and the sequencing matters.
In our practice, operators frequently underestimate the SARB-side of this stack. The FSCA registration process is procedurally accessible and the FSCA has published clear guidance on the documentation expected. The SARB payment-system pathway is more opaque to first-time entrants. PASA accreditation requires demonstrating operational, technical and governance standards that align with the designated participant category. An entity that cannot meet those standards directly must structure its South African payment activity through a sponsoring bank or an accredited third-party payment processor, which then carries the regulatory relationship.
The sponsoring-bank model is common for inbound digital-asset businesses. The commercial terms of that sponsorship are the pivot point of the whole structure: the bank's de-risking posture (the tendency of banks to exit relationships they assess as higher-risk), the indemnity mechanics, the settlement currency and the reserve or safeguarding requirements that the bank imposes contractually will often be more demanding than the regulatory minimum. We have seen South African banks impose contractual safeguarding requirements well in excess of the statutory floor, particularly where the underlying volume is crypto-related. Negotiating that agreement – and matching it to the entity's VASP registration status and AML/CFT framework – is where counsel adds material value.
What is the inbound-business process for a foreign operator?
A foreign operator entering the South African market through a PSP or acquiring agreement typically follows a sequence: assess the activity trigger, select the access model, satisfy the FSCA and SARB requirements, negotiate the commercial agreement, and go live. Each step has a legal dimension that differs depending on whether the entity is licensing locally, operating through a local subsidiary, or relying on a cross-border service model with a South African-regulated intermediary.
The activity trigger is the first gate. South African law takes a broad view of when a foreign entity is "carrying on business" locally. If the crypto platform's users are predominantly South African, if the settlement occurs in ZAR or against a South African banking relationship, or if the platform markets to South African residents, there is a strong argument that local regulatory obligations apply regardless of where the entity is incorporated. The cross-border footprint question is not resolved by the entity's domicile.
Once the activity trigger is confirmed, the access model determines the regulatory pathway. The principal options are: (i) incorporate a South African entity and seek direct accreditation or registration; (ii) operate through an existing South African-regulated PSP under a white-label or referral arrangement; or (iii) rely on a correspondent or payment-aggregator model where a local accredited entity sponsors the activity. Each carries a different capital, governance and contractual burden. The timeline from structure selection to operational banking varies – qualitatively, businesses that opt for the sponsored model tend to achieve operational status materially faster than those seeking direct accreditation, but that speed comes with a dependency on the sponsor's own regulatory standing and risk appetite.
FSCA VASP registration runs in parallel. The FSCA has prescribed the documentation set – constitutional and ownership documents, AML/CFT program, fit-and-proper information for key individuals, and a description of services. Applications are assessed by the FSCA on a file-completeness basis before moving to substantive review. Incomplete files restart the clock. In practice, operators that engage qualified local counsel to prepare the file move through the process materially faster than those that self-prepare.
What do AML and Travel Rule obligations require from a South African PSP?
South Africa's AML/CFT framework is anchored to the Financial Intelligence Centre Act (FICA) and the FATF Recommendations, including FATF Recommendation 15 on virtual assets and the Travel Rule (the obligation to pass originator and beneficiary identification data alongside a transfer). South Africa has been subject to FATF scrutiny and has undertaken significant AML/CFT reform; the Financial Intelligence Centre and the FSCA both play a role in supervising compliance for VASPs and payment operators.
The Travel Rule obligation applies to virtual-asset transfers above the applicable threshold. In the South African context, the FSCA's VASP registration regime incorporates Travel Rule compliance as an expectation. A PSP handling the fiat leg of a crypto transaction must satisfy itself, under FICA, that its crypto-facing client has adequate KYC/AML controls – this is the correspondent-relationship due diligence obligation that banks apply to PSPs and that PSPs in turn apply to their VASP clients. The due diligence chain is long, and a weak link anywhere in it creates a risk of account closure.
We regularly advise VASPs on structuring their AML/CFT program so that it passes the bank-side due diligence that a South African PSP or sponsor bank will conduct. A strong program – independent audit, clear transaction monitoring methodology, documented Travel Rule compliance, named MLRO with demonstrated experience – materially reduces the risk of a de-risking event. The reverse is also true: in every case where we have seen a South African banking or PSP relationship close, the proximate cause was an AML/CFT documentation gap that the bank could not resolve against its own compliance obligations.
How does the cross-border tax and banking layer interact with a South African PSP structure?
For a foreign operator running a South African PSP or acquiring structure, the tax and banking layers are as consequential as the regulatory regime. South Africa operates exchange controls administered by SARB under the Currency and Exchanges Act, and those controls apply to both residents and non-residents transacting in ZAR or moving capital in and out of the country. A crypto platform settling in ZAR, repatriating funds to a foreign entity, or holding ZAR in trust for clients will engage the exchange-control regime, and the structure must be designed to accommodate it from day one.
The corporate income tax position for a non-resident entity with a South African-registered VASP subsidiary or a South African permanent establishment is a distinct analysis. The South African Revenue Service (SARS) has issued guidance on the tax treatment of crypto assets that characterizes them as assets for capital gains and income tax purposes; the characterization of gains on crypto transactions – whether income or capital – turns on the facts of each case and the nature of the taxpayer's activity. A PSP arrangement that routes settlement through a South African entity may create a taxable presence that was not anticipated at the structuring stage. Counsel and a qualified tax advisor should review this in parallel.
Banking for crypto businesses in South Africa follows global patterns: the major commercial banks have applied de-risking policies to varying degrees, and the willingness to onboard a VASP or a PSP handling crypto transactions varies materially across institutions and across time. Operators we advise routinely find that a well-documented application – including the FSCA VASP registration confirmation, a complete AML/CFT package, audited financials and a clear explanation of the business model and client profile – meaningfully improves the probability of a successful bank onboarding. In the current environment, a refusal from one institution is not the end of the road; the South African market has more than one viable banking path for a well-structured crypto operator.
CTA #2If a prior application stalled or an account was closed, a second read can surface the structural reason and the route back. OBOLUS advises on both the regulatory registration and the commercial negotiation of PSP and bank sponsorship agreements in South Africa. Map your options
A practical illustration: cross-border fiat onboarding for a crypto payments operator
In a recent matter, a payments business incorporated in a European jurisdiction sought to extend its acquiring footprint to South Africa. The company held a MiCA-compliant CASP authorization in its home jurisdiction but had no South African regulatory status. The SARB payment-system sponsorship pathway was identified as the fastest viable route. OBOLUS worked through the contractual structure of the sponsorship agreement, identified an exchange-control exposure in the proposed settlement flow, and advised on the FSCA VASP registration file. The business achieved its first ZAR settlement run within a commercially acceptable window, with the sponsoring bank's compliance sign-off in place. The exchange-control exposure was resolved by restructuring the settlement currency mechanics before go-live – a change that would have been costly to make post-launch.
Who should use a direct PSP licence versus a sponsored model in South Africa?
The choice between direct accreditation and a sponsored model in South Africa turns on four variables: the operator's target transaction volume, its willingness to hold a local presence, its timeline to operational launch, and its ability to meet the capital and governance standards required for direct participation in the national payment system.
Profile A – a large exchange or institutional payment platform with significant ZAR volume, a long-term South Africa commitment and the appetite to build a local compliance and governance function – should assess direct PASA accreditation. The timeline is longer and the ongoing compliance burden is higher, but the commercial dependency on a third-party sponsor is eliminated and the regulatory standing is stronger. This profile also justifies the cost of incorporating a South African subsidiary and staffing it appropriately.
Profile B – a mid-size or early-stage crypto operator testing the South African market, with a shorter runway and a need for operational banking within a commercially realistic timeframe – should structure through an accredited South African PSP or a sponsor bank from the outset. This model trades dependency for speed. The key risk is the sponsor's own regulatory standing and de-risking policy; the contractual agreement must address what happens if the sponsor's status changes or its own bank withdraws. Counsel should negotiate appropriate notice periods, step-in rights and data portability provisions.
Profile C – a foreign operator with no immediate intention to serve South African retail clients but seeking to use a South African acquiring relationship for regional settlement purposes – must assess whether its activity genuinely triggers local obligations. The cross-border service model may be viable, but the activity-trigger analysis must be done with South African law in mind, not solely from the entity's home jurisdiction perspective. A legal opinion at this stage is substantially cheaper than a remediation exercise after a SARB or FSCA inquiry.
What are the most common mistakes in PSP and acquiring agreements in South Africa?
The most consequential mistake is treating the FSCA VASP registration and the SARB payment-system pathway as alternatives rather than complements. They address different functions. A business that registers as a VASP but does not address the payment-system side of its operations is exposed to an enforcement action from SARB or, more practically, to a refusal by any South African bank to process its transactions.
A second common error is negotiating the PSP or sponsorship agreement without legal review of the exchange-control implications. ZAR settlement flows, profit repatriation to a foreign holding entity, and cross-currency netting arrangements each carry exchange-control consequences. South Africa's exchange-control regime is administered with reference to detailed notices and circulars that are not visible to most foreign operators. A commercially sensible settlement structure can become non-compliant in practice if the exchange-control mechanics are not mapped at the design stage.
A third area of risk is the AML/CFT program gap identified in bank due diligence. South African banks conducting correspondent-style due diligence on PSP or VASP clients will assess the AML/CFT program against FICA obligations and FATF standards. Programs built for a lighter European or offshore regulatory environment frequently fail this assessment because they do not address South Africa-specific predicate offences, the FIC registration obligation, or the specific transaction-monitoring requirements that apply to crypto assets under the FSCA framework.
A common assumption is that a single offshore licence – a MiCA CASP authorization, an FCA registration, or a BVI VASP registration – is sufficient to operate a South African payment function on a cross-border basis. That assumption is incorrect. South Africa asserts jurisdiction over operators who serve South African clients or use South African banking infrastructure, regardless of where the operator is licensed. The offshore licence addresses the home-jurisdiction obligations; it does not substitute for the South African regulatory obligations. Operators that structure on the basis of the offshore-only assumption are building on an unstable foundation.
Related at OBOLUS
- Banking, payments and EMI onboarding for digital-asset businesses – how OBOLUS structures fiat access across the full licence and bank stack
- Fiat on/off-ramp banking from a cross-border perspective – the legal architecture behind multi-jurisdiction ZAR and fiat settlement
- KYC and onboarding framework in Switzerland – FINMA's KYC expectations and what they mean for cross-border digital-asset operators
FAQ
Why do banks close crypto company accounts?
Banks close crypto company accounts primarily because of perceived AML/CFT risk that the bank cannot adequately mitigate within its own compliance framework. The most common triggers are an incomplete or undocumented AML/CFT program on the client side, a mismatch between the declared business model and the observed transaction patterns, and the absence of a recognized regulatory registration – such as an FSCA VASP registration – that the bank can point to in its own supervisory file. A well-documented onboarding package substantially reduces this risk, but it does not eliminate it: some banks maintain blanket de-risking policies for the crypto sector regardless of the individual client's compliance posture.
How can a VASP onboard with an EMI?
A VASP onboarding with an EMI (electronic money institution) follows a due diligence process that mirrors, in most material respects, a bank onboarding. The EMI will assess the VASP's regulatory status, AML/CFT program, ownership structure and transaction profile. The key differentiator is that EMIs typically operate under lighter capital and governance requirements than banks, which can make them more willing to onboard VASPs – but their own regulator's expectations regarding high-risk clients are tightening across most jurisdictions. In the South African context, a VASP seeking an EMI relationship for ZAR processing should approach the onboarding as it would a bank: with a complete regulatory file, an independent AML audit and a documented Travel Rule compliance methodology.
What does client-money safeguarding require?
Client-money safeguarding requires that funds held on behalf of clients are kept segregated from the operator's own funds, held with an eligible institution and subject to a designated-account or trust structure that protects those funds in an insolvency. In South Africa, the precise safeguarding obligation depends on the regulated activity: payment system participants have SARB-mandated requirements, while FSCA-regulated entities face FSCA conduct standards. For a crypto business operating across both regimes, the safeguarding structure must satisfy both sets of requirements simultaneously. The contractual terms of the bank or EMI relationship will typically impose additional safeguarding conditions beyond the regulatory minimum.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – so that the structure is sound before the first ZAR clears. Our disputes team also coordinates freezing relief and on-chain tracing across leading common-law forums when assets are at risk. To discuss your South African PSP or acquiring structure, contact info@oboluslaw.com.
By Victor Olsen, Regulatory & Compliance Analyst – specialist in payment-system and VASP regulatory compliance for digital-asset businesses operating across African and emerging-market jurisdictions.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.