South Africa CASP AML Requirements: What Crypto Businesses Must Know

South Africa's crypto-asset market is no longer operating in a regulatory vacuum. Crypto Asset Service Providers (CASPs) are explicitly included as accountable institutions under Item 22 of Schedule 1 of the Financial Intelligence Centre Act (FIC Act). That brings them into South Africa's anti-money laundering, counter-terrorist financing and counter-proliferation financing framework.

The implications are significant. A South African crypto business cannot treat AML compliance as something that happens after obtaining its CASP authorisation. Registration with the Financial Intelligence Centre (FIC), customer due diligence, transaction monitoring, targeted financial sanctions screening, record keeping, regulatory reporting and a documented risk-based compliance programme are all part of the compliance architecture.

And the regulatory pressure is increasing. The FIC's sector-risk assessment found that South Africa's crypto-asset sector has high inherent money-laundering and terrorist-financing risk, with residual risk assessed as medium-high after existing controls. As of 10 February 2025, the FIC recorded 256 CASPs registered under Item 22, while estimating that more than 5.8 million South Africans—approximately 9.44% of the population—owned crypto assets.

For businesses entering this market, understanding the AML framework is therefore not optional. It is part of the operating model.

Why Are CASPs Subject to AML Regulation in South Africa?

Crypto assets create particular financial-crime risks because they can be transferred across borders, transactions can occur without face-to-face interaction, and some blockchain addresses do not directly reveal the identity of the person controlling them. The FIC specifically identifies these characteristics as vulnerabilities that can be exploited for money laundering, terrorist financing and proliferation financing.

This does not mean that cryptocurrency itself is inherently illicit. It means that businesses providing crypto-asset services need systems capable of identifying and managing the risks associated with their products, customers and transactions. The FIC therefore applies a risk-based approach rather than simply requiring every customer and transaction to be treated identically.

Which Law Governs CASP AML Compliance?

The central legislation is the Financial Intelligence Centre Act 38 of 2001, commonly referred to as the FIC Act. The Act establishes South Africa's framework for combating:

• Money laundering
• Terrorist financing
• Proliferation financing

The FIC administers the framework and receives regulatory intelligence from accountable institutions. For CASPs, Item 22 of Schedule 1 is particularly important.

The FIC's Public Compliance Communication 57 explains that CASPs fall within Item 22 and provides guidance on interpreting the sector's FIC Act obligations. The definition covers activities including:

• Exchanging crypto assets for fiat currency and vice versa
• Exchanging one crypto asset for another
• Moving crypto assets between addresses or accounts
• Safekeeping or administering crypto assets
• Certain financial services related to crypto-asset issuances

A business therefore needs to examine what it actually does, rather than relying solely on whether it calls itself an exchange, wallet, fintech or crypto platform.

CASP Registration With the FIC

A CASP falling within Item 22 must register with the FIC. The FIC states that accountable institutions must register through its goAML registration and reporting system, and that registration is free. Registration is required within 90 days from commencement of operations.

Registration is not the same thing as receiving permission to ignore the rest of the FIC Act. It establishes the institution within the FIC's regulatory reporting and supervision framework.

The FIC also states that failure to register, or failure to update registration information, can result in an offence and a fine of up to R10 million. That makes the registration requirement considerably more consequential than a simple administrative formality.

What AML Controls Must a South African CASP Have?

The FIC identifies a number of core compliance obligations for accountable institutions. For CASPs, these include: - Risk-based AML/CFT/CPF controls - Customer due diligence - Beneficial-ownership identification - Targeted financial sanctions screening - Politically exposed person assessments - Transaction monitoring - Regulatory reporting - Record keeping - Risk management and compliance programme - Compliance officer - Employee training

The important point is that these controls are interconnected. A CASP should not have a KYC document sitting in one folder, an AML policy sitting somewhere else and transaction monitoring operating independently. The controls need to form a functioning compliance system.

Customer Due Diligence Is at the Centre

Customer due diligence (CDD) is one of the most important components of the South African AML framework. A CASP needs to understand who its customers are, what risks they present and whether their activity is consistent with the relationship established with the business.

The FIC's guidance explains that the risk-based approach should influence the level of due diligence applied to different customers. That means a CASP should consider factors such as:

• Customer type
• Geographic exposure
• Products and services used
• Transaction behaviour
• Source of funds
• Beneficial ownership
• Sanctions exposure
• Other relevant risk indicators

A low-risk customer and a high-risk customer should not necessarily receive identical treatment.

Beneficial Ownership Matters

Corporate customers can create a particularly important AML challenge. Knowing the registered company name is not necessarily enough. A CASP may need to understand who ultimately owns or controls the customer. The FIC identifies beneficial ownership as one of the core obligations applicable to accountable institutions.

For a crypto business serving companies, this becomes especially important when onboarding:

• Companies
• Trusts
• Investment structures
• Payment businesses
• Crypto funds
• Other financial institutions

A robust onboarding process therefore needs to look beyond the entity's registration certificate.

Enhanced Due Diligence for Higher-Risk Customers

A risk-based AML programme should be capable of escalating higher-risk relationships. The FIC's 2025 guidance on developing an RMCP explains that customer-level risk assessments should help determine whether simplified, normal or enhanced due diligence is appropriate. Higher-risk scenarios may require additional information and stronger controls.

For example, a CASP may identify increased risk based on:

• High-risk jurisdictions
• Complex ownership structures
• Unusual transaction patterns
• Sanctions exposure
• Politically exposed persons
• Unexplained source of funds
• High-risk products
• Certain cross-border activity

The objective is not to automatically reject every higher-risk customer. It is to identify, understand and manage the risk appropriately.

Politically Exposed Persons Need Special Attention

South African AML rules also require accountable institutions to determine whether customers or relevant persons are politically exposed or otherwise subject to heightened risk considerations. The FIC lists determining whether clients are politically exposed persons among the compliance obligations of accountable institutions. For a CASP, PEP screening should therefore form part of the customer-risk framework rather than being treated as a one-time checkbox.

Targeted Financial Sanctions Screening

Sanctions screening is another fundamental component. The FIC requires accountable institutions to determine whether customers are subject to targeted financial sanctions (TFS). It says screening should occur during client onboarding and when new United Nations Security Council targeted-financial-sanctions measures are adopted or expanded. This matters particularly for crypto businesses because transactions can move rapidly across jurisdictions.

A CASP therefore needs systems capable of identifying sanctions exposure before and during the customer relationship, rather than relying on occasional manual checks.

Transaction Monitoring Is Not Optional

KYC alone does not constitute an AML programme. A customer can pass onboarding and subsequently begin behaving in a way that creates significant financial-crime risk. That is why transaction monitoring matters.

The FIC describes transaction monitoring as an essential part of South Africa's AML, CTF and CPF regime. It also issued Directive 5, which addresses requirements for accountable institutions using automated transaction-monitoring systems.

For CASPs, transaction monitoring may need to consider both: Customer behaviour and Blockchain transaction activity. That can create a more sophisticated compliance environment than traditional financial institutions face.

Crypto Transactions Create Additional Monitoring Challenges

A blockchain transaction may provide extensive transaction data without necessarily revealing the real-world identity of the person controlling an address. This creates an important compliance distinction: Blockchain transparency is not the same thing as customer identification.

A CASP may therefore need to connect blockchain intelligence with:

• KYC information
• Wallet addresses
• Transaction history
• Customer risk profiles
• Sanctions screening
• Source-of-funds information

The FIC's CASP guidance specifically highlights the cross-border and pseudonymous characteristics of crypto assets as risk factors.

Suspicious Transaction Reporting

Where transactions or activity create suspicion of money laundering, terrorist financing or related offences, accountable institutions have reporting obligations. The FIC identifies suspicious and unusual transaction reports (STRs) as one of the regulatory reporting categories applicable to accountable institutions.

A CASP therefore needs an internal process for: Detection → investigation → escalation → reporting → record keeping. The compliance team should not wait until the regulator asks questions before establishing this process.

Terrorist Property Reporting

CASPs also need controls around targeted financial sanctions and terrorist property. The FIC states that terrorist property reports are required where a transaction matches one or more parties appearing on relevant United Nations Security Council listings. This is one reason sanctions screening needs to be integrated into the transaction-monitoring environment.

International Funds Transfers

Cross-border activity creates another reporting consideration. The FIC states that accountable institutions that may legally conduct international funds transfers must report qualifying transactions above the prescribed threshold, and its current compliance page identifies R19,999.99 as the threshold referenced for IFTR reporting.

For a CASP operating across borders, this deserves particular attention because international transfers may be an important part of the business model. The exact applicability should be assessed against the institution's activities and current FIC requirements.

The Risk Management and Compliance Programme

One of the most important documents in a CASP's AML framework is its Risk Management and Compliance Programme (RMCP). Section 42 of the FIC Act requires accountable institutions to have an RMCP. The FIC says the RMCP should document the institution's ML, TF and PF risks and explain the systems and controls used to manage those risks.

The FIC's 2025 guidance breaks the risk assessment process into three useful levels: - Business-level risk - What are the overall ML, TF and PF risks created by the business model? - Product and service risk - What risks are created by individual products and services? - Customer-level risk - What risks are associated with particular customers or transactions?

This is important for crypto businesses because an exchange, custody service, OTC desk and cross-border transfer product may not carry identical risk.

The RMCP Must Evolve With the Business

An RMCP should not be treated as a document prepared once for licensing and then forgotten. The FIC states that the RMCP should be updated on an ongoing basis. That becomes especially important when a CASP introduces:

- New tokens - New payment methods - New jurisdictions - New customer categories - New custody arrangements - New settlement partners - New products A change in the business model can create a change in the AML risk profile.

CASPs Must Keep Records

Record keeping is another core FIC Act obligation. The FIC identifies keeping records of customer transactions among the compliance obligations of accountable institutions. For crypto businesses, record keeping can involve more than traditional bank-style transaction records. Depending on the business model, relevant information can include:

• Customer identification records
• Beneficial ownership information
• Transaction records
• Wallet addresses
• Transaction hashes
• Risk assessments
• Screening results
• Suspicious-activity investigations
• Regulatory reports

The objective is to ensure that the CASP can reconstruct and explain relevant activity when required.

The Travel Rule Adds Another Layer

South Africa's crypto regulation's AML framework also includes the Travel Rule. The FIC and FSCA's April 2025 advisory explains that the Travel Rule applies to the transfer and receipt of crypto assets by accountable institutions for customers and concerns information that must accompany those transactions, together with related record-keeping requirements.

The advisory makes an important statement: CASPs are required to comply fully and in a timely manner with the FIC Act and its Directives, with no exemptions from those FIC Act obligations.

This makes Travel Rule capability an important component of the compliance architecture for a CASP handling crypto transfers. It is also a good example of why crypto AML compliance increasingly requires technology rather than simply written policies.

FIC and FSCA: Who Supervises CASP AML Compliance?

South Africa's regulatory structure can initially appear complicated because more than one authority can be relevant. The FIC supervises Item 22 CASPs under Schedule 1 of the FIC Act.

The FSCA supervises relevant financial-services providers under Item 12, including FSPs providing financial services involving crypto assets. The FIC's 2025 CASP sector-risk assessment explains that where CASPs fall under both Item 12 and Item 22, the FIC and FSCA jointly supervise and enforce FIC Act obligations applicable to those activities.

That distinction is important. A CASP should not assume that obtaining FSCA authorisation automatically means its FIC obligations have disappeared.

What Happens If a CASP Ignores Its AML Obligations?

AML compliance is not merely an internal governance exercise. The FIC has supervisory and enforcement powers, and non-compliance can result in administrative action. The FIC also states that failure to register can result in a fine of up to R10 million.

More broadly, failures around:

• Customer due diligence
• Risk management
• Reporting
• Sanctions screening
• Record keeping
• Transaction monitoring

can expose an institution to regulatory enforcement and reputational damage. For a financial business, that can also affect banking relationships, payment partners and institutional counterparties.

What Should a South African CASP Have Before Launch?

A serious CASP should be able to demonstrate that its compliance framework is operational rather than merely documented. At minimum, the business should consider whether it has:

• FIC registration
• An enterprise-wide ML/TF/PF risk assessment
• A current RMCP
• Customer due-diligence procedures
• Beneficial-ownership procedures
• PEP screening
• Targeted financial sanctions screening
• Transaction monitoring
• Suspicious-transaction reporting procedures
• Terrorist-property reporting procedures
• Record-keeping controls
• Travel Rule capability where applicable
• Compliance officer
• Employee AML training
• Periodic compliance testing

These components should work together as a single control environment.

Why AML Is Becoming a Competitive Issue for African Crypto Businesses

There is a temptation to view AML as a regulatory cost. For serious crypto businesses, it can also become a competitive advantage. A CASP with robust compliance infrastructure may be better positioned to establish relationships with:

• Banks
• Payment providers
• Institutional investors
• International counterparties
• Liquidity providers
• Corporate customers

The more crypto becomes integrated with traditional financial infrastructure, the more important trusted compliance becomes. South Africa's regulatory development reflects that transition.

The country's crypto market is moving from an environment where the primary question was whether crypto businesses should be regulated toward one where the question is how regulated crypto businesses should operate safely and sustainably.

And the numbers demonstrate why regulators are paying attention: the FIC estimated more than 5.8 million South Africans owned crypto assets as of its 2025 sector assessment.