FICA Compliance for Crypto Asset Service Providers in South Africa: Registration, Directive 9 and the Travel Rule (2026)
What South African crypto asset service providers must do under FICA: register with the FIC under Schedule 1 item 22 (and item 12 if FSCA-licensed), apply the Directive 9 travel rule from 30 April 2025, screen counterparties, handle unhosted wallets, and report to the FIC.
Short answer: Crypto asset service providers (CASPs) in South Africa are accountable institutions under item 22 of Schedule 1 to the Financial Intelligence Centre Act, 2001 (FICA), and have had to register with the Financial Intelligence Centre (FIC) since 19 December 2022. CASPs that give advice or intermediary services on crypto assets also need a licence from the Financial Sector Conduct Authority (FSCA) and a second FIC registration under item 12. Since 30 April 2025, the FIC's Directive 9 requires CASPs to send originator and beneficiary information with every crypto asset transfer, before or with the transfer, and never afterwards. On top of this sit the duties every accountable institution carries: customer due diligence, a Risk Management and Compliance Programme (RMCP), five-year records and reports to the FIC.
This guide is for founders, compliance officers and money laundering reporting officers at South African crypto exchanges, brokers, wallet providers and other CASPs. It draws on the FIC and FSCA's joint advisory of 17 April 2025, Directive 9 itself and the FIC's 2025 risk assessment of the sector. It is a practical guide, not legal advice.
Registration: item 22, and item 12 as well
| Registration | Who | Supervisor |
|---|---|---|
| FIC, Schedule 1 item 22 | Every CASP located or created in South Africa that transfers crypto assets for clients, in South Africa or elsewhere; required since 19 December 2022 | FIC |
| FSCA licence under the FAIS Act, then FIC item 12 | Anyone who, as a business, gives advice or intermediary services on crypto assets, a financial product since 1 December 2023, including foreign CASPs advising South African residents | FSCA |
The FIC and the FSCA supervise CASPs' FICA compliance jointly, and neither can grant exemptions from Directive 9 or the Act. Registration on the FIC's goAML portal is free; see our FIC registration guide.
Directive 9: the travel rule
The travel rule applies the Financial Action Task Force's wire-transfer standard (Recommendation 16) to crypto asset transfers. Directive 9, issued on 15 November 2024 and in force from 30 April 2025, sets it out for item 12 and item 22 institutions acting as ordering, intermediary or recipient CASPs.
What the ordering CASP sends
| About | Information |
|---|---|
| Originator who is a natural person | Full name; South African identity number, or passport or foreign identity number and date of birth; residential address if readily available, otherwise country of birth |
| Originator that is a legal person | Registered name, registration number and registered address |
| The transfer | The originator's distributed ledger address, and account number with the CASP or a unique transaction reference |
| Beneficiary | Full name, distributed ledger address, and account number with the recipient CASP where one is used |
For a single transfer under R5,000, a reduced set applies (names, ledger addresses and account numbers), and it need not be verified for accuracy unless there is a suspicion of money laundering or terrorist financing.
Rules for the ordering CASP
- Counterparty due diligence. Before sending information to another CASP, identify it and check that it can protect the information and is not an illicit actor or a person or entity listed under a UN Security Council resolution. The check need not be repeated for every transfer, but it must be refreshed periodically, when risk emerges, and whenever there is a suspicion.
- No compliance, no transfer. A CASP may not execute a transfer if it cannot meet these requirements.
- Timing. Information goes "prior to, or simultaneously with" the transfer, in batches if need be. "Post facto transmission of the required information is not permitted."
- Security. Information is transmitted and stored securely, protected from unauthorised disclosure.
Rules for intermediary and recipient CASPs
Intermediaries pass all originator and beneficiary information along the chain. Intermediaries and recipients take reasonable measures, which may include post-event or real-time monitoring, to detect cross-border transfers missing the required information, and keep risk-based policies on when to execute, suspend or return such a transfer and what follow-up action to take. A recipient verifies the beneficiary information on inward transfers under R5,000 from high-risk or other monitored jurisdictions.
Unhosted wallets
Ordering and recipient CASPs keep risk-based policies for transfers to and from unhosted wallets, including how they obtain more information when the risk is higher.
All of these measures belong in the CASP's RMCP. A CASP that fails to comply with Directive 9 faces administrative sanctions under section 45C of FICA, which include financial penalties of up to R50 million for a legal person.
The FICA duties every CASP carries
- Customer due diligence. Identify and verify clients and beneficial owners, understand the relationship, keep due diligence current, and apply the Act's measures to politically exposed persons (sections 21 to 21H).
- RMCP and governance. Document and implement a Risk Management and Compliance Programme (section 42), with board oversight and a competent, senior compliance function (section 42A).
- Records. Keep them for at least five years (section 23).
- Reports. Cash threshold reports above R49,999.99 within 3 days (section 28), terrorist property reports on sanctions matches (section 28A), and suspicious and unusual transaction reports within 15 days of becoming aware of the facts (section 29). The FIC's risk assessment found that most reports from CASPs are STRs and that cash is not prevalent in the sector. See our section 29 guide.
- Sanctions. Screen clients and counterparties against the targeted financial sanctions list whenever the FIC gives notice.
How the FIC sees the sector's risk
The FIC's assessment of CASPs, published on 1 April 2025, counted 256 CASPs registered under item 22 as of 10 February 2025, noting that unregistered operators may exist. It rated the sector's inherent money laundering and terrorist financing risks as "high", and its residual money laundering risk as "medium-high" after registration, licensing, supervision and sanctions.
Compliance checklist for CASPs
- Register with the FIC under item 22, and under item 12 if you are FSCA-licensed.
- Capture the Directive 9 originator and beneficiary data at the point of transfer, and send it before or with the transfer.
- Run due diligence on counterpart CASPs, and refresh it.
- Block transfers you cannot make compliantly, and route incomplete inward transfers through your execute, suspend or return policy.
- Write the unhosted-wallet policy into the RMCP.
- Screen against the targeted financial sanctions list and report matches.
- File STRs within 15 days of becoming aware of the facts, and keep records for five years.
Frequently asked questions
Do crypto asset service providers have to register with the FIC?
Yes. CASPs have had to register as accountable institutions under item 22 of Schedule 1 to FICA since 19 December 2022, and FSCA-licensed crypto financial services providers also register under item 12.
What is Directive 9?
The FIC's directive on the travel rule for crypto asset transfers, issued on 15 November 2024 and in force from 30 April 2025. It requires CASPs to send originator and beneficiary information with each transfer, before or with the transfer, and sets rules for intermediaries, recipients and unhosted wallets.
Is there a threshold for the travel rule in South Africa?
For single transfers under R5,000, a reduced set of information applies and need not be verified unless there is a suspicion. Transfers of R5,000 or more carry the full set.
Who supervises crypto asset service providers in South Africa?
The FIC and the FSCA jointly supervise CASPs' compliance with FICA. The FSCA licenses CASPs that give advice or intermediary services on crypto assets.
What happens if a CASP breaches Directive 9?
It is non-compliant and faces administrative sanctions under section 45C of FICA, which include financial penalties of up to R10 million for a natural person and R50 million for a legal person.
See how Creodata's FICA compliance and AML software in South Africa supports a CASP's RMCP: book a demo.
