South Africa: A Working Framework With One Unanswered Question

South Africa licenses crypto businesses under a clear framework: crypto assets have been financial products since 2022, and the FSCA had approved 310 of 533 licence applications by March 2026. What it has not done is say whether a crypto ATM belongs inside that framework. In its April 2025 sector risk assessment the Financial Intelligence Centre recorded that the legality of bitcoin ATMs was under consideration by itself and the FSCA, and no South African authority has published a position since. Machines operate in the meantime. That open question, not the licence, is what to resolve before committing capital.

● Orange

South Africa licenses crypto businesses under a clear, working framework. It has not said in public whether a crypto ATM belongs inside it.

South Africa is one of the most methodically regulated crypto markets in Africa. Crypto assets have been financial products since October 2022, the Financial Sector Conduct Authority has been licensing Crypto Asset Service Providers since June 2023, and the Financial Intelligence Centre has brought the sector inside the anti-money-laundering regime that governs banks. For most crypto business models the path is clear. For a machine that takes banknotes and sells bitcoin over a counter nobody staffs, it is not — and that is not an inference drawn from silence. In its April 2025 sector risk assessment the FIC wrote that the legality of bitcoin ATMs was under consideration by itself and the FSCA.¹ No South African authority has published a position since.

Last updated: September 2026

A Framework That Works, For Everything Except This

South Africa chose integration over invention. In October 2022 the FSCA declared crypto assets to be financial products under the Financial Advisory and Intermediary Services (FAIS) Act, which brought businesses providing financial services in relation to crypto inside an existing licensing perimeter rather than a new one. Licensing opened on 1 June 2023, and crypto businesses became accountable institutions under the Financial Intelligence Centre Act two months earlier. Crypto is not legal tender, and in May 2026 the Reserve Bank and the FSCA confirmed jointly that crypto assets used for domestic payments are not money, funds or legal tender and fall outside the National Payment System Act — while noting that a party providing intermediary services in a crypto transaction does need FAIS authorisation.²

That is the closest any South African authority has come to a framework that would capture an ATM operator, since an operator buys from and sells to the customer rather than merely connecting two parties. The regulators did not apply it to machines, and did not mention them.

“The legality of bitcoin ATMs is under consideration by FIC and FSCA.”
FINANCIAL INTELLIGENCE CENTRE, SECTOR RISK ASSESSMENT, 1 APRIL 2025

The same paragraph counted nineteen bitcoin ATMs in the country, a figure the FIC took openly from a crowdsourced public directory rather than from a register of its own, and listed the use of a crypto ATM among the indicators that may point to suspicious activity — qualifying that a single use is not a red flag alone, but becomes one alongside factors such as a high-risk location or repeated small transactions.¹ That is the supervisory starting position an operator should expect, and it is not hostility.

The Licence: FSCA Authorisation Under FAIS

The licence is a Financial Service Provider authorisation covering crypto asset services. Applicants must satisfy fit-and-proper requirements: a credible business plan and operational framework, demonstrated competence, a Key Individual and a Compliance Officer, and registration with the Financial Intelligence Centre. The exemption that allowed representatives and key individuals to defer the FSCA regulatory examinations ran until 30 June 2025, and the FSCA has stated that no further extensions have been granted.³

The published numbers describe the sector, not this business. As at 31 March 2026 the FSCA had received 533 CASP licence applications, approved 310 and declined 17, with 124 voluntarily withdrawn after engagement with the regulator about the suitability of business and operating models.³ Three cautions follow. The 310 are cumulative approvals since June 2023, not a current headcount. The withdrawals are not neutral: they are applications that did not survive a conversation about the model. And the FSCA licenses by FAIS category rather than by delivery channel, so it publishes no breakdown identifying which approvals, if any, belong to ATM operators. A claim in either direction is unsupportable from public records.

There is no separate ATM licence and no kiosk-specific guidance. Whether a given machine falls inside a licence, and in which category, depends on who is buying and selling, who acts for whom, how the money moves and who holds or transfers the asset — a question for South African counsel against the specific configuration. Nor is it safe to assume a hardware and software vendor sits outside the perimeter in every arrangement; where the vendor's role goes beyond supply, that needs testing against the contracts.

On capital, Board Notice 194 of 2017 sets no fixed minimum sum for the category an ATM operator would most likely hold. It imposes a continuous solvency test — assets must at all times exceed liabilities — with liquid-asset requirements expressed as a fraction of annual expenditure. The R3 million surplus that circulates in market commentary attaches to Category IIA and III providers, which are hedge fund and administrative FSPs, and would not ordinarily apply here.⁴

Enforcement is genuine but worth describing accurately. The FSCA has opened 81 investigations into potentially unlicensed CASP activity; 30 were closed without enforcement, mainly because the parties had ceased trading or were dormant, and 51 remain open. The figure stood at 81 in December 2025 as well, so it is not rising.³ Unlicensed financial services carry, on conviction under section 36 of the FAIS Act, a fine of up to R10 million or imprisonment of up to ten years, or both — a criminal sanction imposed by a court, distinct from the administrative penalties the FSCA issues itself.⁵

What the Travel Rule Actually Requires

This is the point most often stated wrongly in market summaries. The FIC's Directive 9 brought the FATF Travel Rule into force for CASPs on 30 April 2025, and the threshold for a qualifying crypto transfer is any value above zero.⁶ That does not mean every customer must be identity-verified from the first rand. The Travel Rule governs the originator and beneficiary information that accompanies a transfer between service providers; customer due diligence is a separate obligation with a separate trigger.

Directive 9 is itself tiered. At or above R5,000 the full originator dataset applies, including identity number or passport with date of birth and address. Below that, a single transaction carries a reduced dataset, and the directive states that the ordering provider need not verify it for accuracy unless money laundering or terrorist financing is suspected.⁶ On the due-diligence side, the FIC's revised Guidance Note 7A confirms that full due diligence is not required for single transactions below the threshold — while section 20A of the FIC Act continues to prohibit dealing with an anonymous client or one using an apparently false name, and at least some identifying information must still be obtained and recorded.⁷

The practical reading is neither extreme. There is no anonymous tier; there is a lighter tier below R5,000 that still requires a name and a record. Design for identification at the machine, and build the economics on convenience, cash access and location rather than on an anonymity premium.

Cash Reporting and the New Tax Layer

Two obligations matter disproportionately to a cash business and are missing from most market summaries. An accountable institution that physically receives or pays out cash of R50,000 or more must file a Cash Threshold Report with the FIC, in both directions.⁸ Separately, South Africa's Crypto-Asset Reporting Framework took effect on 1 March 2026, with the first period closing on 28 February 2027 and the first return due to SARS by 31 May 2027.⁹ Neither SARS nor the regulations mention ATMs, but a business exchanging fiat for crypto reads naturally onto the definition of a Reporting Crypto-Asset Service Provider; confirm scope rather than assume it.

Banking and Bringing the Hardware In

The banking picture has improved. Absa launched institutional digital asset custody built on Ripple technology in September 2026, for corporate and institutional clients rather than retail.¹⁰ That signals a sector willing to touch the asset class; it does not establish that banks will open accounts for cash-intensive ATM operators, and no public source supports a general claim that they will. Treat bankability as a question to answer bank by bank, in parallel with licensing.

On imports, the EU–SADC Economic Partnership Agreement is a real advantage but not an automatic one. The Southern African Customs Union removes duties on roughly 86% of imports from the EU, and preference requires a EUR.1 movement certificate or a qualifying origin declaration.¹¹ Three things must hold together: the tariff line must sit in the liberalised part of the schedule, the machine must satisfy the agreement's rules of origin — assembly in the EU is not the same as EU origin where components are imported — and the shipment must carry valid proof. A crypto kiosk has no settled classification, so the only safe basis is a binding tariff determination from SARS. Import VAT of 15% applies on a value that includes a 10% uplift over customs value, and is recoverable only by a registered vendor that is also the importer.¹²

One note that has aged in the operator's favour: national load-shedding has not occurred since 16 May 2025, a run now past 490 consecutive days.¹³ Localised load reduction, municipal outages and cable theft remain real, so site-level backup is still prudent, but it is no longer the defining South African constraint.

What Is Changing

Two drafts are open and neither is law. The Reserve Bank and National Treasury published draft Capital Flow Management Regulations in April 2026 to replace the 1961 exchange control regime, and a draft Crypto Assets Manual on cross-border activity followed in August 2026.¹⁴ The Manual concerns transfers between local providers, foreign providers and non-custodial wallets. It does not mention ATMs and creates no restriction on buying crypto with cash domestically. The Conduct of Financial Institutions Bill was approved by Cabinet for submission to Parliament in 2026 but has not been passed, assented to or commenced, and no commencement date exists.¹⁴

The demand case is real but smaller than the figures usually quoted. South Africa placed ninth in Chainalysis's 2026 global adoption index, an on-chain measure weighted by purchasing power that says nothing about the number of holders or about demand for machines; it ranked fourth for peer-to-peer transfers and third for cross-border.¹⁵ Bitcoin made up 74% of crypto purchases on centralised exchanges in the year to June 2025, a figure Chainalysis expressly limits to that venue, excluding informal, business-to-business and over-the-counter activity.¹⁶ Bitcoin can be spent at Pick n Pay stores nationally through a QR-based flow.¹⁷ Estimates of crypto ownership vary widely and none carry published methodology, so this article gives none.

Machine numbers are equally soft. Public counts range from single digits to the high twenties depending on source and month, no official register exists, and the nineteen recorded by the FIC came from a crowdsourced directory. The market is certainly thin relative to the population — but it is not possible to say precisely how thin, and the ratio of one machine per million inhabitants that circulates in market write-ups does not survive the arithmetic against any published count.

“The framework here is better than in most comparable markets, and that is precisely why the unanswered question matters. A regulator that has built a careful regime and has not yet said where machines sit in it is a regulator worth asking before installing, not after.”

The recommended sequence is therefore inverted from the usual one. Before hardware, before site agreements, obtain South African counsel's view on whether the intended configuration falls inside a CASP licence and in which category, and put the question to the FSCA and the FIC directly. An operator who does this and receives a workable answer enters a market with a stable framework, preferential import terms, a large cash economy and very little competition. An operator who assumes the answer is building on the one part of this market that nobody has yet written down.

Sources and references:

1. Financial Intelligence Centre — Assessment of the Money Laundering and Terrorist Financing Risks: Crypto Asset Service Providers (1 April 2025), section 6.2.4, 2. SARB and FSCA — Joint Communication: Crypto assets for domestic payment purposes (28 May 2026), 3. FSCA — Update on licensing and supervision of crypto asset service providers (15 April 2026), figures as at 31 March 2026; text reproduced at FAnews, 4. FSCA Board Notice 194 of 2017 — Determination of Fit and Proper Requirements, sections 46–48 and Table B, 5. Financial Advisory and Intermediary Services Act 37 of 2002, section 36, 6. FIC Directive 9 of 2024 — Travel rule relating to crypto asset transfers (in operation 30 April 2025; tiering at paragraphs 4.2–4.6), 7. FIC Revised Guidance Note 7A (1 September 2025), paragraphs 79–81, 8. FIC — What is a Cash Threshold Report?, 9. SARS — Crypto-Asset Reporting Framework, 10. Absa launches institutional digital asset custody (September 2026), 11. European Commission Access2Markets — EU–SADC Economic Partnership Agreement, 12. SARS — VAT levied on the importation of goods into South Africa, 13. SAnews — Eskom reports consecutive days without load shedding (run unbroken since 16 May 2025), 14. SARB and National Treasury — draft Crypto Assets Manual (August 2026) & draft Capital Flow Management Regulations (17 April 2026), 15. Chainalysis — 2026 Global Crypto Adoption Index (data 1 July 2025 – 30 June 2026), 16. Chainalysis — Sub-Saharan Africa, 2025 (July 2024 – June 2025; centralised exchange purchases only), 17. VALR — Bitcoin payments at Pick n Pay

Legal Disclaimer: This article by GENERAL BYTES is for informational purposes only and does not constitute formal legal, financial, or investment advice. The legality of crypto ATMs in South Africa was recorded by the Financial Intelligence Centre in April 2025 as under consideration by itself and the FSCA, and no public position has been issued since; the exchange control and conduct reforms described here remain in draft. Always consult specialised South African legal counsel, and confirm the position directly with the FSCA and the FIC, before considering market entry.