Crypto license in South Africa

Requirements for a Crypto License in South Africa

Applicants must meet corporate, personal, technical and documentation criteria:

• Corporate Structure: Incorporate a South African company (usually a private company). A virtual office or mail forwarding address is acceptable. No South African director is mandated, but the entity must register locally and appoint at least one authorized representative (Key Individual). If a foreign company opens in SA, it must register as an external company and maintain a local office.
• Key Personnel: Appoint at least one Key Individual (often the CEO or compliance head) with relevant qualifications/experience, who is approved by the FSCA. Also designate an Independent Compliance Officer. All directors, shareholders and the KI must be “fit and proper” (clean criminal records, financial soundness). FSCA checks these rigorously.
• Policies and Procedures: Prepare comprehensive written policies to satisfy FSCA and FIC. Required policies typically include: risk management framework, AML/CFT policy, customer onboarding and KYC procedures, flow-of-funds diagrams, data protection (POPIA) compliance, cybersecurity measures, disaster recovery/business continuity plans, conflicts-of-interest policy, and client complaint handling procedures. These demonstrate operational ability and consumer protection.
• Technology & Security: The application must detail the trading/payment platform or wallet infrastructure, security controls, and server setup. (While not mandated, some applicants host servers locally to meet “substance” expectations.) Proof of secure custody and transaction controls is essential.
• Documentation: Submit corporate documents (certified copies of founding papers, CIPC certificate, directors’ IDs and addresses, shareholder registers). Provide a detailed business plan describing crypto activities, risk assessments, and financial projections. Include CVs and qualifications of the Key Individual and senior team. Evidence of operational funds (proof of capital/stability) should be included. SB-SB notes the FSCA expects “financial stability” with assets exceeding liabilities.
• Compliance Preparation: Ensure registration or exemption with the Financial Intelligence Centre (FICA) as an accountable institution. Engage a local auditor and legal advisor. Have an internal accountant or audit function ready – audited annual financial statements will be required each year.

Costs, Fees & Taxes

Application Fees: The FSCA charges official fees per category: as of Oct 2024, 135 EUR for a Category I license and 820 EUR for Category II. (If applying for both categories together, pro-rata discounts apply.) These fees are subject to periodic adjustment (they rose 6% in Oct 2024).

State Levies and Renewals: Successful applicants must pay FSCA levies and renewals annually. The renewal process is similar to the initial application, including fee payment. In practice, many applicants engage consultants for licensing (services can cost tens of thousands of EUR/USD as a turnkey solution).

Accounting Costs: Expect ongoing costs for auditing, accounting and compliance reporting. All CASPs must submit audited financial statements to FSCA yearly and file transaction reports under FICA.

Taxation: Crypto businesses pay standard South African taxes. Corporate income is taxed at 27%, and capital gains on crypto assets follow normal CGT rules. There is no VAT on crypto transactions (financial services are VAT-exempt). Employees and executives pay PIT on salaries (up to 45%). In practice, if structured in the export/e-zone regime, the effective corporate tax can be as low as 2% on license income, but most firms pay 27%.

Reporting: CASPs must report suspicious and cash transactions over R50,000 (approx. EUR 2,500) to SA law enforcement. They must also comply with the FATF “Travel Rule” for crypto transfers (effective April 2025), requiring customer-identification information to be exchanged between sending and receiving entities.

Process to Obtain a Crypto License

1. Company Formation: First, incorporate a South African company (often a private limited company). No local director is needed, but all registration paperwork (founders’ passports, proof of address, etc.) must be prepared.
2. Hire Key Personnel: Recruit your local Key Individual and Compliance Officer (if not using a nominee provider). Ensure they have the necessary FSP qualifications or at least are registered with the FSCA.
3. Prepare Application: Develop your business plan, policies (AML/KYC, privacy, risk, IT security, etc.), and documentation package. This includes all corporate documents, team CVs, process diagrams, and letters of good standing.
4. Submit to FSCA: File the FAIS license application online with the FSCA and pay the application fee. FSCA typically schedules a pre-licensing meeting (sometimes called a pre-inspection or assessment).
5. FSCA Review (6–12 months): The FSCA reviews your submission, may request additional information, and conducts due diligence (including background checks on key individuals). Applications submitted after the end of November 2023 enjoy transitional protections, but generally FSCA aims to finalize within a year. Indicative total time: about 10 months.
6. License Issuance: Once approved, the FSCA issues the FSP licence certificate. You are now a licensed CASP and can legally begin offering services.
7. Post-Licensing: After licensing, you must open a corporate bank or payment account in South Africa to handle client funds. Ongoing FSCA levies and compliance reporting commence immediately.

Throughout this timeline, it’s crucial to maintain communication with the FSCA and respond promptly to any queries. Engaging experienced local consultants or lawyers (e.g. SBSB Fintech Lawyers) is common and can streamline the process.

Ongoing Compliance & Renewal

Licensed CASPs must meet continuous obligations:

• Annual Renewal: The FSP license must be renewed every year by paying the FSCA renewal fee and submitting updated company information. Ensure timely renewal to avoid lapses.
• Financial Audits: Submit annual audited financial statements to FSCA. Maintain proper accounting records and employ an internal accountant or external audit firm.
• Regulatory Reporting: File all required FICA reports (Suspicious Activity Reports, Cash Transaction Reports). Conduct customer due diligence and transaction monitoring on an ongoing basis.
• Key Individual Requirements: The appointed Key Individual must fulfill Fit & Proper requirements continuously (e.g. no new criminal issues, maintain professional certifications). From mid-2025, they must pass the regulatory exam or meet experience criteria as per FAIS Notice 25/2023.
• Policy Updates: Update and refresh AML/CFT policies, POPIA (data privacy) compliance, and other risk management frameworks regularly. Submit any material changes (e.g. new services, management changes) to the FSCA as required.
• Corporate Filings: Maintain company registration, hold annual general meetings, and comply with the Companies Act (e.g. hold directors/directors meetings, file annual returns with CIPC). Foreign-controlled CASPs must file as external companies.

Failing to comply (e.g. missing reports or exams) can result in FSCA enforcement – including fines, suspension or license revocation. In fact, the FSCA has already cautioned that non-compliant firms will face action.

Recent Legislative Updates

• FSCA Licensing Window: FSCA began accepting CASP license applications from 1 June 2023. All existing crypto businesses had to apply by 30 Nov 2023. The regulator’s press releases (Dec 2024) report hundreds of submissions (248 approved by Dec 2024).
• FAIS Fit & Proper Changes: FAIS Notice 25 of 2023 initially exempted licensed CASPs and their KIs from passing the RE exam, up to 11 Nov 2023. In late 2024 the FSCA extended this exemption to 30 June 2025, giving licensed firms more time to fulfill educational requirements.
• FICA Guidance: In mid-2023 the Financial Intelligence Centre issued a compliance guide clarifying CASP definitions and AML obligations. This includes the Travel Rule (Directive 9/2024) effective 30 April 2025, requiring customer info on crypto transfers. CASPs must now include detailed originator/beneficiary data in cross-border crypto payments.
• Advertising and Promotion: The South African Advertising Standards Authority updated its code to require crypto ads to carry risk warnings (e.g. “Investing in crypto assets may result in the loss of capital”). Compliance with these rules is now mandatory.

These updates reflect South Africa’s move to align with global crypto norms while building its own framework.