South Africa's Draft Crypto Regulations

South Africa has entered a new phase in its approach to regulating digital assets. In mid-September 2025, the Minister of Finance released draft regulations that will bring the OECD's Crypto-Asset Reporting Framework (CARF) into domestic law. Once finalised, these rules will take effect on 1 March 2026 and will significantly expand the reporting obligations on crypto-asset service providers. In practice, this will move the South African crypto industry closer to the type of global tax transparency already familiar in banking under the Common Reporting Standard (CRS).

For business owners, investors, and especially for the country's largest crypto exchanges and institutional trading platforms, the implications are far-reaching. The days when crypto operated in a regulatory grey zone are firmly behind us. SARS is aligning with international norms, and compliance will become a core operating requirement for anyone providing crypto services in South Africa.

This shift is not just a matter of fine-tuning. Reports suggest that as many as six million South Africans with crypto exposure could be targeted when the new rules take effect, with SARS expected to pursue compliance "hard" from 2026 onward. The scale of this enforcement drive underlines the seriousness of the draft regulations and the need for early preparation.

Who Must Comply?

The new rules apply to what the draft terms "Reporting Crypto-Asset Service Providers". This is a broad category that captures both local and international players. If an exchange, broker, trading platform or wallet provider is incorporated, managed, or has a place of business in South Africa, it falls within scope. Even individuals providing crypto services as a business will not escape the net.

For the country's major exchanges and trading firms, there is no doubt about inclusion. They will be at the forefront of compliance, expected to develop the systems to capture and report customer data to SARS. For SMEs that accept crypto payments or run smaller trading desks, the obligations may not be as extensive, but they will still feel the effects indirectly through stricter onboarding, more detailed verification requirements, and potentially higher service costs as providers pass on compliance expenses.

What Must Be Reported?

The reporting obligations are detailed and demanding. Each year, service providers will have to submit to SARS comprehensive information about their reportable users. In other words, customers who are tax resident in South Africa or in another participating jurisdiction. This includes personal details such as names, addresses, dates of birth and tax identification numbers.

More importantly, the information also extends to the transactions themselves. Providers will need to report on acquisitions and disposals of crypto against fiat currencies, crypto-to-crypto swaps, transfers between wallets, and even large retail transactions where crypto is used to buy goods or services. Crucially, transfers to private wallets not linked to regulated exchanges or financial institutions must also be captured. This is a clear signal that regulators want to close the so-called "off-exchange gap" where tax authorities historically had little visibility.

Due Diligence and Customer Onboarding

Alongside the reporting duties, the regulations impose rigorous due diligence requirements. Service providers must obtain self-certifications from users confirming their tax residence and must keep sufficient records to back this up. If the information is not provided within 90 days, the provider may have to suspend or terminate the customer relationship. For major exchanges, this is more than a box-ticking exercise — it means redesigning onboarding processes, training compliance teams, and integrating systems that can handle cross-border reporting obligations in real time.

The regulations also make it clear that relying on third parties for due diligence does not relieve the provider of responsibility. In other words, if an outsourced KYC or verification service fails, liability will still sit with the exchange or platform. For global players active in South Africa, this is a reminder that compliance cannot be delegated away.

What Does This Mean for Large Exchanges and Trading Firms?

For the country's biggest exchanges and institutional trading firms, these regulations represent both a challenge and an opportunity. On the one hand, compliance costs are likely to rise substantially. Reporting under CARF requires sophisticated IT systems capable of aggregating transaction data, converting values consistently into rand, and monitoring wallet-to-wallet movements that were previously off the radar. This will not be a once-off exercise; it will require ongoing investment in technology and staff training.

On the other hand, exchanges that move quickly to align themselves with the rules can position themselves as trusted, compliant partners. In an industry where credibility is increasingly vital, being able to demonstrate full compliance with SARS and OECD standards could become a competitive advantage. Large institutional investors, corporate treasuries, and even banks are more likely to engage with platforms that are demonstrably on the right side of regulation.

There is also a broader strategic consideration. By adopting the OECD's framework, South Africa signals to the world that its crypto market is maturing. Exchanges and firms that adapt early will be better placed to attract international clients who demand regulatory certainty.

The Impact on SMEs and Investors

While the compliance burden falls most heavily on service providers, SMEs and individual investors will still be affected. Businesses using crypto for payments may face stricter verification requirements from their providers. Investors who previously moved assets into private wallets may find those transactions reported to SARS when conducted through a South African exchange. The overall message is clear - transparency is the new baseline.

For some, this may appear daunting. But there is also an upside. By formalising reporting and aligning with international standards, South Africa reduces the perception of regulatory risk. Over time, this could make it easier for legitimate businesses to integrate crypto into their operations without fear of sudden clampdowns or legal uncertainty.

Looking Ahead

The draft regulations are open for public comment, which means industry players still have a chance to influence the final wording. Exchanges and service providers should not miss this opportunity. Once the rules are finalised, non-compliance will carry real consequences, including the possibility of suspensions, fines, or even termination of customer relationships.

For large players, the priority should be to assess current systems against the CARF requirements, identify gaps, and begin planning the upgrades needed for 2026. For SMEs and investors, the focus should be on understanding how these changes will affect access to platforms and the level of information shared with SARS.

South Africa's adoption of CARF is part of a global move toward transparency in digital assets. Those who adapt early will be better placed to thrive in this new regulatory environment.