When Exchange Control starts reading like Bank Supervision

South Africa’s exchange control framework is being substantially rewritten for the first time in sixty-five years. The draft Capital Flow Management Regulations, published for comment in April 2026, will replace the Exchange Control Regulations of 1961 in their entirety. Inside this overhaul is something unusual. 

For the first time, cross-border crypto asset transactions will be brought into the exchange control supervisory net. The vehicle for doing this is a new manual known as the draft Crypto Asset Manual for cross-border activities (referred to here as the “draft Manual”). It has been released for comment by the South African Reserve Bank’s Financial Surveillance Department (“FinSurv”). Comments are due from interested parties by 30 September 2026.

Having spent years inside both FinSurv and the Prudential Authority (“the PA”) (Bank Supervision is now a function performed by the PA) at the Reserve Bank, I read this draft Manual differently to how I suspect most commentators will. 

Most of the commentary so far has focused, reasonably, on matters such as what limits apply, which transactions are reportable, how the single discretionary allowance and foreign capital allowance now stretch to cover crypto. This is reasonable for information purposes but there is a more interesting question here, and it is why this draft Manual does not read like any other FinSurv manual I have ever worked with.

Crypto Asset Service Providers (“CASPs”) occupy an awkward place in South Africa’s regulatory framework. They perform functions that look like banking. For example, they take custody of client assets, they net-settle transactions between counterparties, they move value across borders. But they are not licensed or supervised as banks. There is no prudential oversight by the PA in the same way it has oversight of every bank in the country. 

FinSurv was, however, identified as the regulator who will formulate the regulatory framework for CASPs. It has written a manual for this purpose to supervise an entity that behaves like a bank, while being regulated as though it were a non-bank. The strain of this mismatch shows up in the draft Manual. Once you know where to look, it’s clear that FinSurv has borrowed much of the draft Manual’s architecture from Bank Supervision rather than from its own past regulatory frameworks.

What a FinSurv manual is supposed to look like

To understand how this draft Manual is different, it helps to understand what FinSurv manuals have always done, which is set down the rules to be followed. 

The Currency and Exchanges Manual for Authorised Dealers (the “Manual”) and its counterpart for Authorised Dealers with Limited Authority (known as “ADLAs”), set out allowances, transaction limits, permissible purposes and the documentary evidence an Authorised Dealer must obtain before processing a transaction. They tell an Authorised Dealer what a client may do, how much they may do it for, and what must be reported to FinSurv afterwards. This is a rules-based system that is administered by FinSurv. 

The Manual was renamed in August 2016 when the old Exchange Control Rulings, which were in place since 2005, were replaced by the Manual that is currently in use. It was never designed for practitioners to make judgement calls, and only on a limited basis has FinSurv been able to interpret the rules as guidance to the market. In instances outside the mandate given to FinSurv by the Minister of Finance and National Treasury it too is required to refer matters up to the Minister of Finance for an interpretive decision and policy guidance. None of what FinSurv’s framework is designed to do is based on judgement.

Even down the line and from the point of view of practitioners such as Authorised Dealers, they have always been required in terms of the Manual to approach FinSurv with an application prepared on behalf of their client for an interpretive decision where the Manual is not specifically clear. The particular section of note in the Manual is section A.3(B), headed “Procedures to be followed by Authorised Dealers in administering the Exchange Control Regulations”, and states that where an Authorised Dealer is uncertain or cannot approve a transaction under the authorities set out in the Manual, an application must go to FinSurv via the Authorised Dealer’s head office. 

Based on a strict interpretation of this section of the Manual, there is no allowance for judgement by the Authorised Dealer. This means that there can only ever be an application submitted to FinSurv to obtain its interpretation. If FinSurv is unable to do this, then it is required to redirect the request to the Office of the Minister of Finance for his guidance before reverting back to the Authorised Dealer.

Clearly, the intention of the Manual has never changed after its renaming in 2016. The application process remains even though the renaming modernised the title of the Manual, its purpose as a repository of rules that are enforceable is unchanged. 

In practice, the renaming of the Manual may be interpreted to better align it with the International Monetary Fund’s (“IMF”) restatement of its position on Capital Controls. The IMF issued this position in a statement, “The Liberalization and Management of Capital Flows: An Institutional View,” that it published in 2012 after the market turmoil of the Global Financial Crisis. The rules-based approach to FinSurv’s regulatory framework has never changed; it was only renamed.

The purpose of the FinSurv Manuals has never been to assess whether an Authorised Dealer itself is a sound, well-governed, or adequately capitalised institution capable of bearing risk on its own balance sheet. That judgement and responsibility have never been FinSurv’s job. 

This responsibility is the PA’s, which licenses, supervises and, where necessary, intervenes in banks under the Banks Act. It uses tools built specifically for that purpose such as capital adequacy ratios tied to risk-weighted assets, fit and proper vetting of directors and controlling shareholders, and an intervention regime that can end in curatorship or the liquidation of a bank.

FinSurv, by contrast, has traditionally been a flow-monitoring function. Its Manuals answer the question “is this transaction permitted, and has it been reported correctly”, not the question “is this institution safe”. 

The distinction matters because it reflects an institutional division of responsibility inside the Reserve Bank that has held up effectively for decades. Exchange control administers rules and permissions. Bank Supervision judges soundness. The two functions rarely overlap because they have never needed to.

Where CASPs fall between the divisions

The draft Manual sets out what CASPs are actually permitted to do, and their functional resemblance to banking is hard to miss even if they seem to not fit comfortably with either FinSurv or the PA.

A Category One CASP settles remittance transactions with clients in Rand while net-settling with its offshore counterpart in crypto, which is functionally identical to what a correspondent bank does when it clears cross-border payments on a net basis rather than transaction by transaction. The client never owns or takes possession of the crypto asset that carries the value across, and the amounts are tightly confined, R5,000 per transaction per day and R25,000 per applicant per month. The limits keep the category firmly in small retail remittances.

A Category Two CASP may open South African custodial wallets for residents, non-residents and foreign nationals, taking custody of client crypto assets in a wallet whose private keys the CASP holds, not the client. The client has the beneficial claim to the asset but cannot move it without instructing the CASP who has the private keys. This is a similar relationship a depositor has with a bank. Only individuals may send those assets offshore, and then only within the annual single discretionary allowance of R2,000,000 and the annual foreign capital allowance of R10,000,000. A resident company or business may hold a wallet and deal domestically with crypto, but may not move crypto across the border at all. Cross-border crypto is therefore an individual matter only, routed entirely through the two personal allowances.

A Category Three CASP is authorised to conduct both activities, holding client assets in custody and net-settling remittances domestically and abroad. The regulatory restrictions follow the activity performed by the CASP rather than the licence, so combining the two does not relax the restrictions applied to any of the categories. In effect, there are three categories but only two activities to supervise, and the obligations attaching to each are the same whatever the licence combination is. Category Three is just a licence label rather than a third activity.

In practice, I would expect most applicants to apply for whichever single category matches the business they already run, with Category Three run mainly by an established platform, not by a new entrant.

CASP clients deposit value with these entities, trust them to hold it safely, and expect it back, or transferred onward, on demand. That is the basic economic function of a deposit-taking, payments-processing institution.

Even though a CASP looks so much like a bank, the regulatory framework around it looks nothing like the framework around a bank. 

The Financial Sector Conduct Authority (“FSCA”) licenses CASPs under the Financial Advisory and Intermediary Services Act (“FAIS”), which governs conduct towards clients, not balance sheet soundness. The Financial Intelligence Centre (“FIC”) requires CASPs to register as accountable institutions and comply with anti-money-laundering and counter-terrorist-financing obligations. 

Neither the FSCA, who licenses and governs conduct towards clients, nor the FIC, who monitors for money laundering contraventions, will ask whether a CASP holds enough capital to absorb losses, or whether its operations are adequate to protect client assets if something goes wrong. There is no prudential regulator for CASPs at all. The PA’s mandate stops at the door of licensed banks, insurers, and other prudentially regulated entities, and CASPs are not among them.

The draft Manual was written to fill this gap, whether by design or by default. FinSurv, as the designated regulator, needs to bring an entity that behaves like a bank inside a regulatory framework. To do this it has reached for the only set of tools available that deal seriously with institutional soundness, the tools developed in the related field of bank supervision and prudential regulation.

Previously, FinSurv’s traditional allowance system for individuals, known as the single discretionary allowance and also the foreign capital allowance available each calendar year, was built around foreign exchange moving through a bank acting as an Authorised Dealer, an institution already prudentially supervised by the PA. The soundness of the institution executing the transfer was never FinSurv’s problem, because someone else was responsible for supervising it. 

The draft Manual now extends those same allowances to crypto assets moved through an Authorised CASP, but without a PA equivalent standing behind the CASP in the way one stands behind every bank. 

FinSurv has kept its own half of the arrangement, the allowance limits and reporting categories, mostly unchanged, but has had to find a solution to address the need to ensure that the institution licensed by the FSCA executing the transfer will not simply lose or misappropriate the client’s assets. 

The Bank Supervision DNA inside the draft Manual

The borrowing is visible in specific, identifiable places.

1. The draft Manual requires a personal declaration from every individual who is a beneficial owner, director or prospective office holder of an Authorised CASP (requirement set out in Annexures B and C of the draft Manual). It asks about previous regulatory censure, disciplinary action, insolvency history, criminal convictions, involvement in money laundering or sanctioned activity, and directorships in other entities that have been wound up or placed under administration. 

This is almost the same as the fit and proper vetting the PA applies to bank directors and controlling shareholders under its fit and proper standards, which trace their origin back to the Basel Committee on Banking Supervision’s Core Principles for Effective Banking Supervision issued in 1997. It has been used internationally in many different jurisdictions since 1997 and is still being used today mostly unchanged.

• Then there is the minimum capital requirement the draft Manual requires for every Authorised CASP (section B.2(B) of the draft Manual). 

Every Authorised CASP must maintain a minimum unimpaired capital amount, calculated as the higher of 15 per cent of its average positive annual gross income over the past three years, or R5,000,000. It must be held in a segregated Rand account that cannot be pledged, ceded or used as collateral. 

This is not the same as the risk-weighted capital ratios the PA uses with banks to calculate its capital adequacy ratio. It is considerably simpler, but the underlying logic, requiring an institution to hold buffer capital proportional to the scale of its business as protection against loss, is drawn from prudential regulation, not from exchange control. 

Authorised Dealers and ADLAs have never been subject to anything comparable under FinSurv’s own manuals, and the problem with relying on this buffer is that it has no relationship to the riskiness of the underlying assets or business activity. 

• The draft Manual’s compliance and remedial action framework tells the same story. It sets out a graduated ladder running from an official warning, through temporary suspension of specific business activities, or of the CASP’s whole authority to operate, to a full external audit at the CASP’s own expense, to the invoking of remedies available under the draft Regulations, and ultimately to permanent withdrawal of authorisation (section B.2 of the draft Manual). 

It is structurally similar to the graduated response the PA can apply to a bank showing signs of distress, moving from heightened supervisory monitoring through formal directives to, in extreme cases, curatorship. 

This process works if there is ongoing close monitoring of the bank’s operations, particularly over the bank’s risk management effectiveness and accuracy of its regulatory reporting. Good corporate governance is also a critical component of the monitoring, because the numbers an institution reports are only as reliable as the governance that produces them.

Lehman Brothers is the clearest illustration of what reported figures are worth without that regulatory closeness. It reported $28.4 billion of equity capital a fortnight before it filed for Chapter 11 (bankruptcy) in September 2008, and on the reported numbers that was correct, which is precisely the difficulty. Only a supervisor close enough to the institution to keep asking questions would have seen what was coming, and an enforcement ladder is worth nothing if the information that should trigger it only arrives with the next periodic return. 

FinSurv’s own enforcement tradition for exchange control breaches has typically been narrower, entailing administrative sanctions and penalties tied to specific contraventions, not an escalating supervisory relationship with an institution over time.

• Perhaps the clearest example sits in the draft Manual’s requirements around offshoring and cloud computing. 

An Authorised CASP that wants to offshore data, infrastructure or systems must conduct a documented risk assessment, maintain business continuity and disaster recovery arrangements that are regularly tested, ensure data is encrypted with properly managed cryptographic keys, and satisfy FinSurv that regulatory access to data will not be compromised by the jurisdiction in which it is stored. 

The uneasiness and reluctance of the PA to allow information, infrastructure and systems critical to the operations to be kept outside its jurisdiction in South Africa and supervisory net are well founded, with sound reasons to support its reluctance. 

The circumstances under which FinSurv is comfortable with this arrangement for CASPs even with safeguards are unusual, particularly because FinSurv has in the past experienced difficulty obtaining cooperation from various other regulators in certain offshore jurisdictions.

What is borrowed, and what is missing

It would be incorrect to describe this as a full prudential regime that has been made to look like traditional FinSurv. What the draft Manual borrows is merely the “form” of prudential supervision. 

There is no risk-weighted capital framework calibrated to the actual risk profile of crypto assets held in custody or the settlement business, only a flat formula tied to gross income.

The obvious reason to me is that if a proper risk-weighting regime were implemented, these assets would, due to their inherent riskiness, receive the highest possible risk weighting attracting the maximum capital allocation as a buffer for the risk. This would prevent the CASPs from conducting any meaningful business and is why it is capped in the way it has been.

This calculation of a capital buffer is a simplification and not a proper risk-weighting methodology. It is a flat percentage that looks rigorous without actually being calibrated to anything remotely related to the actual risk inherent in crypto assets.

Even though banks are heavily regulated, bank depositors in South Africa do enjoy protection provided through the Corporation for Deposit Insurance, which the Reserve Bank launched in 2024. It protects qualifying depositors up to R100,000 of their deposit if that bank fails. 

There is no deposit insurance scheme covering crypto assets held with a CASP, and no evidence at all that a similar scheme is or will be considered in future. The draft Manual is silent, which suggests that even if the idea was considered during the drafting, it was never taken far enough to be made public, for reasons that have not been disclosed. It is also difficult to see an insurer taking on that uncertain risk except at a premium high enough to make the cover impractical.

Additionally, there is no apparent active and ongoing close prudential supervision proposed that is similar to how the PA performs its supervisory programme for banks. The PA’s supervisory programme follows the Basel Committee on Banking Supervision’s minimum standards, set out by the Bank for International Settlements in Basel and adopted by regulators worldwide. It’s meant to reduce the risk of bank failure. It consists in principle of an independent prudential regulator who exercises ongoing supervisory judgement over a regulated entity.

In practice, that judgement is assembled from two sources. The regulatory returns supply the static picture, submitted at set intervals and telling the supervisor what the position was on a reporting date. The ongoing dialogue with the bank’s risk managers, executives and board committees supplies what the returns cannot, which is why the numbers moved, what the bank believes its own risk appetite to be, and whether that stated appetite matches what the business is actually doing. 

Out of the two sources, the supervisor forms a picture of how well the bank manages risk and its appetite for risk. The supervisory programme is calibrated to that view. Riskier activity attracts closer attention, more frequent engagement and a heavier burden on the bank to show it has the risk under control.

A CASP will file returns. There is no clear evidence in the draft Manual that there will be a counterpart to the dialogue, and therefore no mechanism by which the intensity of supervision rises as a CASP’s risk-taking rises.

The draft Manual’s own client-asset safeguards do, however, require an Authorised CASP to keep separate Rand-denominated accounts to ensure that client money is not intermingled with the CASP’s own funds. That segregation requirement is about the regular Rand currency passing through the CASP, not the crypto assets sitting in the custodial wallets themselves. Nothing in the draft Manual requires client crypto holdings to be ring-fenced from the CASP’s own crypto holdings. 

A bank, however, is also not required to segregate deposits at all, and could not operate if it were because ownership of the money passes to the bank when it’s deposited. The depositor is left with a personal claim, protected structurally through capital, liquidity limits, continuous supervision and deposit insurance rather than through any ring-fence. 

The concept of segregation is actually a fiduciary duty taken out of the Financial Institutions (Protection of Funds) Act and the FAIS General Code of Conduct, and the draft Manual has borrowed the Rand-account duty from that legislation and the capital and enforcement provisions from the banking one. This leaves the CASP client without an enforceable claim on the crypto held by the CASP or an institution whose soundness is being continually tested through ongoing prudential supervision.

This means that if a CASP becomes insolvent, is hacked, or otherwise fails to make good on its commitments, a wallet holder has no compensation scheme to fall back on, and no resolution regime governing an orderly return of assets. The wallet holder will become a concurrent creditor on liquidation with only whatever is left after the liquidators have worked through the CASP’s affairs. This is a risk that a bank depositor in South Africa is not exposed to so long as the deposit is within the insured limit of R100,000.

There is also no wind-down regime specifying what happens to client wallets if a CASP closes, beyond a general requirement to retain records for five years after cancellation of the licence or the CASP ceasing to do business, for whatever reason. 

I would rank this as the single largest practical risk in the whole framework, ahead of the capital formula because a capital buffer exists, even if it is poorly calibrated. The crypto ring-fence does not exist at all. 

Wallets denote custody and record-keeping; they don’t of themselves denote a proprietary claim. A wallet is merely a technical container. The only way around this risk to crypto holders would be if the draft Manual expressly says that the assets in the wallets are held in trust and are insulated from the CASP’s own assets. But the draft Manual doesn’t say that at all. Even if you recast the relationship as one of agency, with the CASP as agent and the wallet holder as principal, that would not get around this challenge. Agency avoids the formation requirements of a trust, but it runs into the same limit that turns a bank deposit into a claim as a concurrent creditor. The agency route closes on exactly the same gap as the trust route. The outcome is a CASP client has far fewer regulatory protections when compared to a bank client, and this is the main difference. 

Critically, FinSurv is applying static, manual-based rules to a function that, in the banking world, is overseen through a continuous, judgement-based form of supervision. That mismatch is itself a regulatory problem, not just a gap worth noting.

I spent enough years inside and working closely outside the PA’s supervisory process to have seen a judgement call made by the PA on the strength of a conversation that no periodic return would ever have triggered on its own.

Exposure to risk of this kind does not show up on a return. It becomes visible in a crisis, and at that point the only thing of any use is what the supervisor already knows about the institution and the market it operates in. That knowledge is built by continuous engagement over years, and there is no way to acquire it once the crisis has started. 

A fixed rulebook can tell an entity what it may and may not do at the moment the rule is written, but it cannot weigh a new risk it did not anticipate, adjust as a business model shifts, or step in early when something looks wrong but has not yet breached a specific requirement.

That gap between form and substance is why FinSurv has had to reach for the vocabulary and structure of prudential regulation because it needed some way to address institutional soundness in an entity performing bank-like functions. But it has not been given, and does not have, the institutional apparatus that makes prudential supervision work in practice.

What has emerged is a document that looks like bank supervision on the page but functions, procedurally, like an exchange control manual. You apply once, comply with static requirements, report periodically, and face a defined enforcement ladder if something goes wrong.

Why this matters going forward

Applying the prudential supervisory process is potentially a smart way to manage interim risk while actual regulatory policy catches up with the fast-developing crypto market. It is likely that FinSurv simply did not have the time to wait for a custom-built regulatory framework to be developed. Crypto’s cross-border footprint is already large enough to matter for both exchange control and illicit cross-border flow monitoring purposes.

However, the choices made now have future consequences that the draft Manual does not address.

South Africa has been here before, and the cost was not borne by the entity that failed. Consider Saambou Bank, which was placed under curatorship in February 2002 in terms of section 69 of the Banks Act, with a balance sheet of about R16 billion and a depositor base skewed heavily toward small balances made up of some 292,000 accounts with balances of R4,000 or less. 

The Registrar of Banks recorded at the time that Saambou was not insolvent, only that an abnormal outflow of funds had made its liquidity position unsustainable. A rescue proposed by Investec, its largest shareholder, to address this liquidity shock was declined. 

There was no deposit insurance in 2002, so depositors were left as concurrent creditors of a bank the regulator did not regard as insolvent. The potential for contagion risk manifesting was raised by the regulator but was not acted upon. The Registrar’s assessment reached the Minister. The decision by the Minister not to act on it rested on criteria the prudential process itself does not recognise. 

No shareholder rescue package was ever agreed with Investec, and no financial support from either the Reserve Bank or, more importantly, the Minister of Finance was forthcoming.

The consequences of the decision arrived within weeks. In March 2002, BOE Bank, which was then the sixth-largest bank in South Africa, lost most of its deposits in a matter of days, and on 14 March, the Reserve Bank and the Ministry of Finance were forced by the circumstances to guarantee its deposits and provided emergency liquidity support to counter the contagion effect spreading across the banking sector in South Africa. 

Nothing in BOE’s own numbers had changed, and BOE was not particularly exposed to the unsecured lending that had brought Saambou down. By the end of 2003, about half of South Africa’s registered banks had deregistered, the combined market share of the smaller banks had roughly halved, and competition in the mortgage market was impacted for years afterwards. 

BOE did not survive as an independent bank, it was absorbed into what became Nedbank Limited on 1 January 2003. The state ended up extending the very support it had declined to give to Saambou a month earlier.

That is what it costs when a decision is taken without a working understanding of how the market will read it. Depositors treated the failure of one mid-sized bank as information about every other bank of similar size, and the state paid the price. The argument at the time was never whether Saambou deserved rescuing, it was about consequences.

What stayed with me from that period is how quickly a decision about one bank became a fact about every other bank of similar size. That is the same dynamic a CASP market framework without a knowledgeable prudential regulator would be exposed to.

A CASP failure today would be a small market event. If the sector grows into a significant channel for cross-border value transfer, the question will not be whether the draft Manual’s enforcement ladder was correctly applied to the CASP that failed. It will be whether anyone had enough knowledge of the market to anticipate how that CASP’s clients, its competitors’ clients and its offshore counterparties would respond. That knowledge has to be accumulated in advance, or it does not exist when it is actually needed. 

That is exactly what played out in the Saambou failure. The Registrar of Banks had warned the Minister, who, for reasons that remain unclear, did not act until the run on BOE made the risk impossible to ignore. By which point, the response was late and far costlier. Saambou, on the Registrar’s own account, was solvent, and could have been saved by timeous intervention.

Authorised CASPs are going to be required to comply with quasi-prudential standards. The smart question should be why this supervisory function has been assigned to FinSurv rather than the PA, and whether FinSurv is resourced and staffed with sufficient experience to exercise ongoing supervisory judgement of the kind prudential regulation requires. FinSurv’s natural strength has always been administering a fixed set of rules and not prudential regulation judgements. 

Having observed both departments from the inside and through a long ongoing close relationship with both departments from the outside, my expectation is that whichever one ends up with formal responsibility (in this instance it is understood to be FinSurv), the other will end up doing a meaningful share of the actual work informally, because that is how the Reserve Bank has handled overlapping mandates before.

It also raises a longer-term question about what happens if the CASP sector grows. A patchwork of borrowed prudential concepts, applied through a document that by its own admission “has no statutory force” but “has the effect of law”, is only a stopgap for an emerging industry. It will be less adequate if in the future CASPs become a systemically significant means for cross-border value transfer, at which point the absence of a dedicated prudential regulator, real capital adequacy standards, and a proper resolution framework stops being a stopgap and starts being a real gap in financial stability regulatory oversight.

Confirming the time pressure already flagged, National Treasury and the Reserve Bank have both acknowledged that the draft Manual was published before comments on the draft Regulations were fully worked through. What matters now is how effective an adopted version of the PA’s prudential toolkit can be when applied by a regulator built for permissions and reporting rather than institutional judgement. 

Having been involved for many years with both FinSurv and the PA, I have no doubt that irrespective of who becomes the eventual official supervisor of CASPs in South Africa, either department is very capable of managing the challenge, however fragmented and improvised the framework may look from the outside.