South Africa's FSCA Tightens CASP Supervision as Licensing Backlog Clears
By 31 March 2026 the FSCA had received 533 crypto-asset licence applications, approving 310 and declining 17. The regulator is now shifting from onboarding to enforcement.
What Changed
As at 31 March 2026, the Financial Sector Conduct Authority (FSCA) reported it had received 533 Crypto Asset Service Provider (CASP) licence applications since the regime took effect on 1 June 2023, of which 310 were approved and 17 declined, with the balance under review or withdrawn. The FSCA declared crypto assets financial products in October 2022, requiring providers to hold a Financial Services Provider licence with the crypto-asset subcategory. In parallel, the Financial Intelligence Centre (FIC) Directive 9, effective 30 April 2025, applies the FATF Travel Rule to every crypto-asset transfer regardless of value. Declines have centred on fit-and-proper and operational-capability failings.
Who It Affects
Crypto exchanges, custodians, brokers, and any firm intermediating virtual-asset transactions for South African clients, all of which need an FSCA CASP licence and FIC accountable-institution registration. Unlicensed operators still trading are now squarely exposed. With most applicants either approved or withdrawn, the FSCA has moved past the onboarding phase, meaning the compliance bar for those already licensed becomes the enforcement standard others are measured against.
What to Do
If you are still operating without an FSCA CASP licence, cease non-compliant activity and lodge an application, ensuring your business plan and operational framework satisfy the fit-and-proper test that has tripped up declined applicants. Confirm FIC accountable-institution registration and implement Directive 9 Travel Rule data collection on every transfer, with no value threshold. Build originator and beneficiary verification, sanctions screening, and record-keeping into the transaction flow so each transfer produces a defensible, audit-ready trail.
What is deepidv?
Not everyone loves compliance — but we do. deepidv is the AI-native verification engine and agentic compliance suite built from scratch. No third-party APIs, no legacy stack. We verify users across 211+ countries in under 150 milliseconds.
Learn More