Crypto recap for 2026
If you’re a crypto asset service provider (CASP) licensed by the Financial Sector Conduct Authority (FSCA), now is a good time to check that your compliance basics are in order.
The Regulatory Examination (RE) exemption is over
When crypto licensing began, CASPs and their key individuals (KIs) were temporarily exempted from the Regulatory Examinations (REs) required under Board Notice 194. That exemption was extended to 30 June 2025, and has not been extended again as confirmed in a press release earlier this year.
Other competence requirements:
Class of business training: not currently required, as no crypto class of business training exists yet.
Qualifications: CASPs, KIs and representatives must hold a qualification on the FSCA’s list of recognised qualifications.
Experience: no minimum period is prescribed for crypto, but you still need adequate and appropriate experience. Be ready to show practical crypto experience, ideally gained at a business that offers crypto services.
CPD: CASPs, KIs and representatives must complete at least 6 hours of crypto-related CPD per cycle (1 June to 31 May). These hours are in addition to your normal CPD, so if you also offer other financial products, you need your usual hours plus 6 more for crypto.
Keep your AML controls up to date
Your FSCA licence is only half the picture. Since December 2022, CASPs have been accountable institutions (AIs) under the Financial Intelligence Centre Act (FIC Act), which means you’re also supervised for anti-money laundering (AML) and counter-terrorist financing compliance. As a reminder, you need to:
Be registered with the Financial Intelligence Centre (FIC) and keep your registration details current.
Maintain a Risk Management and Compliance Programme (RMCP) that reflects how your business actually operates, and review it regularly as your products, customers and risks change.
Carry out customer due diligence, including verifying your clients’ identities and applying enhanced checks to higher-risk customers.
Report to the FIC, including suspicious and unusual transactions, within the required timeframes.
Train your staff so they understand their AML obligations and know how to spot red flags.
Keep proper records of customer information and transactions.
During September 2026, the FIC issued Directive 12, which requires certain AIs, including CASPs, to submit their RMCP to the FIC every year through the goAML platform. Until now, you only had to produce your RMCP when the FIC asked for it, usually during an inspection. This has now changed and for CASPs, the first submission is due by 31 October 2026, and annually after that. For more info read our blog.
Update your location details
Directive 10, which took effect on 31 July 2026, requires CASPs to give the FIC details of every head office, branch and subsidiary through which they operate, both in South Africa and abroad. This includes each location’s name, address, any licence or registration numbers, and the contact details of the person responsible for compliance there. Existing CASPs must update their goAML registration by 29 October 2026, and any later changes, such as opening or relocating a branch, must be updated within 90 days. Failing to comply could lead to administrative sanctions, including fines. For more info read our read our blog.
Check that your Travel Rule process is working
Since April 2025, the FIC’s Directive 9 has required CASPs to collect and pass on information about the sender and recipient of crypto asset transfers. During March 2026, the FIC issued Public Compliance Communication 61 (PCC 61), which clarifies what it expects in practice. As a reminder:
Timing: originator and beneficiary information must be sent securely before or at the same time as the transfer. Sending it afterwards is not permitted.
Scope: the Travel Rule applies to all crypto transfers within an established business relationship, with no minimum amount. It covers domestic and cross-border transfers as well as transfers involving unhosted wallets, but not fiat currency transfers.
Missing information: if the required information is missing, the transfer should be suspended or rejected, and funds should not be released to the client while you wait for it.
Sanctions screening: all transfers should be screened against the United Nations Security Council targeted financial sanctions list, and assets linked to a sanctioned person or entity must be frozen immediately.
Counterparty due diligence: you should carry out risk-based due diligence on other CASPs before transacting with them.
Monitoring: because crypto transfers move quickly, the FIC strongly encourages automated, real-time monitoring and blockchain analytics to pick up non-compliant activity.
If you haven’t reviewed your Travel Rule process against PCC 61 yet, now is a good time to do so.
Remember what licensing does and doesn’t cover
FSCA licensing applies to the financial services around crypto, such as advice, intermediary services and investment management. It doesn’t make crypto legal tender, and the South African Reserve Bank does not recognise crypto assets as currency.
Your year-end checklist
As 2026 draws to a close, take a few minutes to confirm that:
your RMCP is approved and submitted on goAML by 31 October 2026
your head office, branch and subsidiary details are updated on goAML by 29 October 2026
your licence is valid and up to date
your KI has passed their Regulatory Examinations
everyone required is on track with their crypto CPD for the current cycle
your FIC registration is current
your Travel Rule process is in line with PCC 61
If you need help with your RMCP submission or any other part of your compliance, give us a call. We’re here to help.
