Off the grey list, onto the rulebook: South Africa moves crypto into exchange control

South Africa exited the FATF grey list on 24 October 2025, after 32 months of increased monitoring and alongside Nigeria, Mozambique and Burkina Faso (National Treasury; FATF). For Africa's largest financial hub the delisting removed a real institutional barrier: grey-list status was a standing objection in every fund mandate and correspondent-banking review touching South African crypto platforms.

What followed the exit is the actual story. Within six months, National Treasury published the draft Capital Flow Management Regulations, 2026 (17 April 2026, comments closed 30 June 2026), which would replace the Exchange Control Regulations of 1961 and, for the first time, classify crypto assets as "capital" for exchange-control purposes (Treasury draft; gov.za). That classification deliberately reverses a May 2025 Gauteng High Court holding that crypto assets fell outside "capital" under the 1961 regulations and therefore outside exchange control. The draft closes the gap the court opened.

The details deserve attention. Transacting in crypto above a yet-to-be-set threshold would be restricted to licensed intermediaries or require permission. Holdings above a threshold trigger declaration duties. And a draft provision would empower enforcement officers to demand "any password, pin, private key, or other information" needed to access crypto assets, with refusal a criminal offence carrying a fine of up to R1 million or the value of the crypto assets, whichever is greater, or five years' imprisonment (CMS; Polity). That border-search power over private keys is the sleeper issue in the draft, for privacy and for custody design alike.

The rest of the rulebook is already in force. The OECD Crypto-Asset Reporting Framework took effect on 1 March 2026: every reporting crypto-asset service provider with a South African nexus must collect verified identity and tax-residency data on users and report annual transaction totals to SARS for automatic international exchange (SARS). The FSCA, which licenses crypto asset service providers under FAIS, reported 30 supervisory inspections of CASPs between April 2025 and March 2026 (FSCA update, 15 April 2026).

Why it matters. South Africa is executing a specific thesis: use the post-greylist credibility to become the continent's institutionally investable crypto market, and pay for it with comprehensive capital-flow and tax-reporting control. Licensed operators gain (institutional money now has fewer objections); unlicensed and self-custody activity faces the sharpest rules on the continent.

Who is affected. CASPs and their compliance teams (CARF data collection plus incoming CFM reporting); individuals holding crypto above the eventual thresholds, who acquire declaration duties; anyone crossing South African borders with access to significant crypto holdings, once that provision is in force; and treasury teams using crypto rails for cross-border payments, which will sit squarely inside exchange control.

What to do now:

1. Update privacy notices and data inventories for CARF now if not done: the legal basis is statutory, but POPIA's transparency duties still apply to the new collection and international exchange.
2. Model your flows against the draft CFM regulations and file the operational gaps (thresholds, declarations, intermediary routing) while the final text is pending.
3. If the demand power survives into the final text, revisit key-management and travel policies. Whether an employee can be compelled to open corporate custody at a border is now a design question, not a hypothetical.