---
title: "South Africa FSCA Crypto Licensing: The CASP Declaration and Africa's Largest Regulated Market"
slug: south-africa-fsca-crypto-licence
publishedAt: 2026-06-02T13:30:00Z
author: Finconduit Editorial Team
tags: FAIS Act, FIC Act, FATF
canonicalUrl: https://finconduit.com/resources/south-africa-fsca-crypto-licence
---
# South Africa FSCA Crypto Licensing: The CASP Declaration and Africa's Largest Regulated Market

How the FSCA licenses crypto in South Africa: the 2022 FAIS-Act declaration, the FSP licence, the FIC Act AML overlay, and when SA beats Mauritius.

**South Africa** did something no other African state did. In **October 2022**, the [Financial Sector Conduct Authority](https://www.fsca.co.za/Regulated%20Entities/Pages/Crypto-Assets.aspx)¹[^1] \(**FSCA**\) declared **crypto assets a financial product** under the **FAIS Act** — and forced every crypto provider to obtain an **FSP licence** or stop trading.

The deadline was hard: applications had to be in by **30 November 2023**. Firms that missed it were operating **unlawfully**. The result is that the **FSCA** now supervises **the continent's largest regulated crypto market** — the anchor licence for any firm serving **African retail at scale**.

This guide maps **The FSCA CASP Pathway**: the **2022 declaration**, the **FSP licence categories** a crypto provider must hold, the **fit\-and\-proper** tests, the **FIC Act** AML overlay, and the **FATF grey\-list** context that shapes banking. If you are weighing **South Africa against Mauritius** for an Africa play, this is the comparison nobody hands you upfront.

> **Note:** This guide covers the FSCA / FAIS\-Act route in South Africa. Crypto providers are regulated as financial services providers, not under a bespoke crypto statute — the licence is the FSP licence, with the FIC Act layered on top for AML.

## Why South Africa Is the Anchor for African Crypto

**South Africa** is the **most developed financial market on the African continent**, with deep capital markets, a mature banking sector, and the **rand** \(**ZAR**\) — one of the most actively traded emerging\-market currencies. Crypto adoption is **among the highest in the world by population share**, concentrated in retail trading and remittances.

The decisive move was regulatory. Rather than write a new crypto law, the **FSCA** folded crypto into its **existing financial\-services perimeter** under the **FAIS Act**. That choice matters: it means crypto providers are supervised by a **conduct regulator with a 20\-year track record**, not an untested crypto\-specific authority. For institutional counterparties, that reads as **credibility**.

The reach extends beyond one country. South Africa anchors the **Southern African Development Community** \(**SADC**\) and serves as a **gateway to sub\-Saharan markets**. A firm licensed by the **FSCA** gains a base that signals **the highest regulatory bar on the continent** — the single most useful credential when opening banking or partnering across Africa.

> **Tip:** South Africa's appeal is not low tax or speed. It is regulatory credibility plus the largest, deepest African market. An FSCA licence is the anchor credential for serving African retail at scale.

## The 2022 Declaration: Crypto as a Financial Product Under FAIS

On **19 October 2022**, the **FSCA** published its [declaration of crypto assets as a financial product](https://www.fsca.co.za/Regulatory%20Frameworks/Pages/Crypto-Assets.aspx)²[^2] under the [Financial Advisory and Intermediary Services Act 37 of 2002](https://www.fsca.co.za/Regulatory%20Frameworks/Pages/FAIS-Act.aspx)³[^3]. The legal effect was immediate and far\-reaching.

Once crypto is a **financial product** under the **FAIS Act**, anyone who **furnishes advice** or renders an **intermediary service** in relation to it is, by definition, a **financial services provider**. And a financial services provider must hold an **FSP licence**. There is no opt\-out for crypto.

The definition is deliberately broad. **Advice** means any recommendation, guidance, or proposal of a financial nature. **Intermediary services** means buying, selling, dealing, or otherwise transacting in the product on behalf of a client — or even **operating a platform** that does so. Most **exchanges**, **brokers**, **OTC desks**, and **crypto advisers** are captured.

Crucially, the declaration was **not a registration regime** — it was a **full licensing regime**. A crypto provider is held to the **same conduct, disclosure, and fit\-and\-proper standards** as any other **FSP** advising on shares, retirement products, or insurance.

## The FSCA CASP Pathway — Overview

A **Crypto Asset Service Provider** — **CASP** — is the working term for a firm whose business is crypto under the **FSCA** regime. The pathway to lawful operation has **three connected layers**, and a provider needs all three.

- First, the **FAIS\-Act FSP licence** — the conduct authorisation that lets you advise on or intermediate in crypto as a financial product.

- Second, the **FIC Act registration** — registration as an **accountable institution** with the Financial Intelligence Centre, which triggers AML obligations.

- Third, **ongoing supervision** — the FSCA's conduct oversight and the FIC's AML oversight run in parallel for the life of the business.

The licence is **activity\-scoped**. You apply for the **categories and subcategories** of financial product and service that match what you actually do. A pure **adviser** holds a narrower licence than a firm that also **intermediates** — buys and sells crypto for clients. Scope your application to your real activities; over\-scoping invites scrutiny, under\-scoping leaves you operating outside your permission.

> **Warning:** The FSP licence and the FIC Act registration are separate steps. Holding one without the other still leaves you non\-compliant. A CASP needs the conduct licence AND accountable\-institution status before it can lawfully operate.

## The FSP Licence Categories: What Crypto Providers Must Hold

The **FAIS Act** sorts providers into **categories**. The category that matters for almost every crypto firm is **Category I** — the **advice and intermediary\-services** licence. This is the standard authorisation for **exchanges, brokers, and advisers** dealing in crypto as a financial product.

Within a category, the licence is broken into **subcategories by product type**. Crypto assets are their own **product subcategory**, so a firm adds **crypto assets** to its FSP licence as a specific authorisation. A firm already licensed for shares or derivatives must **apply to add crypto** — the existing licence does not cover it automatically.

Higher categories exist for **discretionary and intermediary management**. **Category II** covers **discretionary FSPs** managing client assets under mandate; **Category III** covers **administrative FSPs**. A crypto **fund manager** running discretionary crypto mandates would look at **Category II**, a materially heavier authorisation.

Every licence carries **operational requirements**: a **key individual** who manages the business, **representatives** who deal with clients, **professional indemnity cover**, and **operational ability and financial soundness**. The licence is not a one\-time grant — it is a **standing set of obligations**.

## The Fit\-and\-Proper Requirements: Honesty, Competence, and Key Individuals

The heart of the **FAIS Act** regime is the **fit\-and\-proper** standard. Every **key individual** and **representative** must satisfy the **FSCA** on four dimensions before — and throughout — authorisation.

- **Honesty, integrity, and good standing** — no relevant criminal record, no disqualifying conduct, no history of dishonesty.

- **Competence** — minimum qualifications, relevant experience, and completion of **regulatory examinations** \(the **RE exams**\) within set timeframes.

- **Operational ability** — the systems, governance, and resources to run the business and meet client obligations.

- **Financial soundness** — the firm must not be insolvent and must hold adequate assets over liabilities.

The **key individual** is the load\-bearing role. This is the person who **manages or oversees** the financial\-services activities of the licensed business. The **FSCA** assesses the key individual personally — **competence, experience, and honesty** — and a weak or under\-qualified key individual is a **common reason applications stall or fail**.

For crypto firms, the **competence bar is the practical sticking point**. Many crypto founders have deep technical knowledge but **no recognised financial\-services qualification**. The fix is to appoint a **suitably qualified key individual** — often a regulated\-industry veteran — rather than assume a technical founder will satisfy the test.

## The FIC Act AML Overlay: Accountable Institutions, RMCP, and the Travel Rule

The conduct licence is only half the regime. The [Financial Intelligence Centre Act 38 of 2001](https://www.fic.gov.za/the-fic-act/)⁴[^4] — the **FIC Act** — brought **crypto asset service providers** into its scope as **accountable institutions**.

Becoming an **accountable institution** carries a defined AML obligation set. A CASP must **register with the Financial Intelligence Centre**, appoint a compliance function, and run a full **anti\-money\-laundering** and **counter\-terrorist\-financing** programme.

The centrepiece is the **Risk Management and Compliance Programme** — the **RMCP**. This is the documented framework setting out how the firm **identifies, assesses, and mitigates** money\-laundering and terrorist\-financing risk. It governs **customer due diligence** \(**CDD**\), **enhanced due diligence** \(**EDD**\) for higher\-risk clients, **ongoing monitoring**, and **record\-keeping**.

Reporting obligations are concrete. A CASP must file **suspicious and unusual transaction reports** \(**STRs**\) and **cash threshold reports** to the FIC, screen against **targeted financial sanctions** lists, and identify **politically exposed persons** \(**PEPs**\).

The **Travel Rule** applies. In line with **FATF** Recommendation 16, a CASP must **collect and transmit originator and beneficiary information** on qualifying crypto transfers. South Africa has moved to **operationalise the Travel Rule** for crypto providers, and a credible **Travel Rule solution** is now part of the baseline compliance stack — not an optional extra.

## FSCA Licence Application Stages: What's Submitted, Who Reviews, How Long

The application is **document\-heavy** and runs through distinct stages. The **FSCA** reviews conduct and competence; the **FIC** governs the AML registration that runs alongside. The table below sets out the **typical sequence**.


*Table: Indicative FSCA crypto \(CASP\) licence application stages — submissions, reviewer, and timing.*

| Stage | What's submitted | Reviewer | Indicative duration |
| --- | --- | --- | --- |
| 1. Pre\-application | Structure, key individual CVs, business plan scoping | Applicant / advisers | 2–6 weeks |
| 2. FSP application | FAIS application form, KI competence evidence, PI cover, financials | FSCA Licensing | 3–6 months |
| 3. Fit\-and\-proper review | RE\-exam results, qualifications, honesty checks | FSCA | Runs within stage 2 |
| 4. FIC registration | Accountable\-institution registration, RMCP | Financial Intelligence Centre | Parallel, weeks |
| 5. Grant & conditions | Licence issued with category/subcategory scope | FSCA | On approval |
| 6. Ongoing supervision | Annual returns, conduct reporting, AML reporting | FSCA \+ FIC | Continuous |

Total elapsed time for a crypto **FSP licence** typically runs **6–12 months** from a clean, well\-prepared application — longer if the **key individual competence** is queried or the **RMCP** needs rework. **Preparation quality is the single biggest driver of timeline**.

## The 2023 Licensing Deadline and Its Aftermath

The **FSCA** set an **exemption window**: existing crypto providers could keep operating **provided they applied for an FSP licence by 30 November 2023**. The deadline created a **wave of applications** — well over a hundred firms filed in the run\-up.

The aftermath separated the market into **three groups**. Firms that filed and were **granted** became the **regulated core**. Firms that filed but had **applications refused or withdrawn** had to **stop** or remediate. Firms that **never filed** became **unlawful operators** exposed to enforcement.

The **FSCA** has been clear that operating **without authorisation is an offence**, and it has the power to **act against unlicensed providers**. For a new entrant, the lesson is direct: **there is no informal grace period left** — the exemption window has closed, and you must be licensed before you intermediate in crypto.

The upside of the deadline is a **cleaner, more credible market**. A **granted FSP licence** is now a genuine differentiator — it tells banks, partners, and institutional clients that the firm has **passed the continent's most demanding crypto authorisation**.

## South Africa's FATF Grey\-List Context: The Path Out and What It Means for Banking

In **February 2023**, the [Financial Action Task Force](https://www.fatf-gafi.org/en/countries/detail/South-Africa.html)⁵[^5] added **South Africa** to its **grey list** — the list of jurisdictions under **increased monitoring**. The greylisting followed a 2021 mutual evaluation that flagged weaknesses in **AML/CFT effectiveness**.

Greylisting is **not a sanctions designation**. It does not bar transactions. But it raises the **compliance cost of dealing with South African institutions**: foreign banks apply **enhanced due diligence** to correspondent relationships, and onboarding can slow. For a crypto firm, that translates into **harder banking and more scrutiny on cross\-border flows**.

The crypto regime is part of the **path out**. One of the **FATF action items** South Africa committed to was **supervising virtual asset service providers** — exactly what the **FSCA declaration and FIC Act inclusion** deliver. The country has made **steady progress against its action plan**, and exiting the grey list is a stated policy priority.

The practical takeaway for a CASP: **hold an impeccable AML programme**. While the grey\-list overhang persists, a **South African crypto firm with a strong RMCP, Travel Rule capability, and clean correspondent story** is far easier to bank than one without. **Compliance is the banking strategy**.

## South Africa FSCA vs Mauritius VAITOS vs Nigeria SEC

For an Africa play, three jurisdictions dominate the structuring conversation: **South Africa** \(**FSCA**\), **Mauritius** \(the **VAITOS Act** regime\), and **Nigeria** \(the **SEC** digital\-asset rules\). They differ on **supervisor, AML model, banking access, customer\-base fit, and tax**.


*Table: Africa crypto\-licensing comparison — South Africa, Mauritius, and Nigeria.*

| Dimension | South Africa \(FSCA\) | Mauritius \(VAITOS\) | Nigeria \(SEC\) |
| --- | --- | --- | --- |
| Supervisor | FSCA \(conduct\) \+ FIC \(AML\) | FSC under the VAITOS Act | Securities & Exchange Commission |
| Legal basis | FAIS Act — crypto a financial product | Virtual Asset & Initial Token Offering Services Act | SEC digital\-asset rules |
| AML overlay | FIC Act, accountable institution, Travel Rule | FIATF\-aligned, FSC AML framework | Nigerian AML regime, EFCC |
| Banking access | Domestic banking deep; grey\-list EDD friction | Offshore\-oriented, GBC banking | Constrained; volatile bank stance |
| Customer\-base fit | African retail at scale, ZAR settlement | Offshore / Africa\-gateway holding | Large domestic Nigerian market |
| Tax posture | Standard SA CIT, crypto taxed as income/CGT | Low\-tax GBC regime | Standard Nigerian CIT |

The pattern is clear. **Mauritius** wins as an **offshore Africa\-gateway holding and licensing base** with a **low\-tax regime**. **South Africa** wins where you need **real on\-the\-ground access to African retail**, **ZAR settlement**, and the **deepest banking market on the continent**. They are **complementary, not interchangeable** — many serious Africa plays use **Mauritius for structure and South Africa for market access**.

## Banking and Exchange\-Control Reality: SARB, the ZAR, and Correspondent Access

**South Africa** operates an **exchange\-control regime** administered by the [South African Reserve Bank](https://www.resbank.co.za/)⁶[^6] — the **SARB**. Cross\-border flows of capital are **regulated**, and crypto sits in an evolving relationship with these rules.

Historically, the **SARB** treated crypto cautiously, and **cross\-border crypto movements** raised **exchange\-control questions**. The regulatory direction is toward **bringing crypto into a clearer framework**, but a CASP moving value across the South African border must understand that **exchange control still applies to the fiat legs**.

The **ZAR question** is a genuine advantage. A South African CASP can offer **native rand on\-and\-off ramps** through the domestic banking system — something offshore structures cannot replicate. For a business serving **South African and SADC retail**, **ZAR settlement is the moat**.

**Banking access** is the recurring constraint. Local banks are cautious on crypto, and the **FATF grey\-list overhang** adds correspondent\-banking friction on the cross\-border side. The firms that bank successfully are the ones that present a **granted FSP licence**, a **robust RMCP**, and **clean transaction monitoring** — the licence is the door\-opener.

## When South Africa Wins

- Choose **South Africa** when your customer base is **African retail at scale** — particularly South African and **SADC** users who need **native ZAR rails**.

- Choose **South Africa** when you need the **deepest, most developed banking market on the continent** and value **domestic fiat settlement**.

- Choose **South Africa** when **regulatory credibility** matters to your partners — a **granted FSP licence** is the **highest crypto bar in Africa**.

- Lean to **Mauritius** instead when you want an **offshore, low\-tax Africa\-gateway holding and licensing base** without the need for on\-the\-ground South African market access.

The sophisticated answer is often **both**: a **Mauritius** structure for **tax\-efficient holding and offshore licensing**, paired with a **South African FSCA licence** for **direct access to the continent's largest regulated market**. That is the structuring question worth getting right before you file anywhere.

## Frequently Asked Questions

### Do you need a licence to operate a crypto business in South Africa?

Yes. Since the **FSCA** declared crypto a financial product under the **FAIS Act** in 2022, any firm advising on or intermediating in crypto must hold an **FSP licence** and register with the **FIC** as an accountable institution. Operating without authorisation is an offence.

### What is a CASP under FSCA rules?

A **CASP** — crypto asset service provider — is a firm whose business is buying, selling, dealing, advising on, or operating a platform for crypto assets. Under the **FSCA** regime, a CASP must hold a **FAIS\-Act FSP licence** and be registered as an **accountable institution** under the **FIC Act**.

### Is South Africa on the FATF grey list?

South Africa was added to the **FATF grey list** in **February 2023** and has been working through an action plan to exit. Greylisting is not a sanction, but it raises **enhanced\-due\-diligence** friction on correspondent banking. Supervising crypto providers is one of the items on the path out.

### How long does an FSCA crypto licence take?

A well\-prepared crypto **FSP licence** application typically takes **6–12 months** end to end. The biggest variables are **key\-individual competence** and the quality of the **RMCP**. Weak preparation on either front extends the timeline materially.

> **Call to action:** Serving the African crypto market? Finconduit scopes the FSCA CASP licence and the Mauritius\-vs\-South\-Africa structuring question for your customer base. Book a free Africa scoping call.

## Related Guides

- [Mauritius VAITOS: The Africa\-Gateway Crypto Licence](/resources/mauritius-vaitos-crypto-licence): the offshore counterpart — when an offshore low\-tax base beats an on\-the\-ground South African licence.

- [EEA/UK/Offshore Crypto Incorporation](/resources/eea-uk-offshore-crypto-incorporation): where to incorporate when you are weighing an African base against EEA, UK, or offshore options.

- [The Non\-EU VASP Banking Stack](/resources/non-eu-vasp-banking-stack): the banking architecture that keeps a non\-EU regulated crypto firm — including a South African CASP — bankable.

- [The 2026 Substance Bar](/resources/substance-bar-2026): the operational substance now expected of any licensed crypto entity, wherever it sits.

Africa's crypto market will be won on the ground, and **South Africa** holds the largest, best\-regulated piece of it. The **FSCA CASP pathway** is demanding by design — but a **granted FSP licence** is the anchor credential for any firm serious about the continent. Get the structuring question right first, and the licence becomes a moat rather than a hurdle.

## Footnotes

[^1]: FSCA — Crypto Assets, Financial Sector Conduct Authority, Regulated Entities. <https://www.fsca.co.za/Regulated%20Entities/Pages/Crypto-Assets.aspx>
[^2]: FSCA Declaration of crypto assets as a financial product under the FAIS Act, 19 October 2022. <https://www.fsca.co.za/Regulatory%20Frameworks/Pages/Crypto-Assets.aspx>
[^3]: Financial Advisory and Intermediary Services Act 37 of 2002 \(FAIS Act\), Republic of South Africa. <https://www.fsca.co.za/Regulatory%20Frameworks/Pages/FAIS-Act.aspx>
[^4]: Financial Intelligence Centre Act 38 of 2001 \(FIC Act\), Financial Intelligence Centre, Republic of South Africa. <https://www.fic.gov.za/the-fic-act/>
[^5]: FATF — South Africa, Jurisdictions under Increased Monitoring, Financial Action Task Force. <https://www.fatf-gafi.org/en/countries/detail/South-Africa.html>
[^6]: South African Reserve Bank \(SARB\) — crypto regulation position and exchange\-control framework. <https://www.resbank.co.za/>


---
Source: https://finconduit.com/resources/south-africa-fsca-crypto-licence