Bitcoin and FICA: What South African Investors Need to Know About Anti-Money Laundering Compliance

FICA is not paperwork that stands between you and your Bitcoin. It is the paperwork that proves the Bitcoin is yours. The Financial Intelligence Centre Act asks a licensed provider to know who you are, understand where your money came from and flag anything that looks wrong. Most clients meet it as a form. What it actually builds is a clean record you will be glad to own the day someone official asks a hard question.

Picture a Thursday morning last year. A retired engineer from Somerset West wants to move roughly R2 million from a business sale into Bitcoin. He arrives at onboarding expecting to argue about the price of a coin and instead spends twenty minutes talking about a sale agreement he closed in 2019. He is mildly irritated. Then I explain that this same conversation is what lets him sell one day and put the rand back into his bank without a single query, and the mood shifts. That is FICA doing its real job, quietly, before he has bought anything.

When did FICA start applying to Bitcoin?

There is a hard date. Amendments to the schedules of the FIC Act came into effect on 19 and 31 December 2022, and a new Item 22 of Schedule 1 named crypto asset service providers as accountable institutions. That single change dropped the full weight of the anti-money-laundering rulebook onto anyone brokering Bitcoin for South Africans. It did not come out of nowhere. It answered a 2019 review by the Financial Action Task Force, the global body that sets these standards, which found South Africa was not regulating the sector.

Being an accountable institution is not a light touch. It means dual supervision by both the Financial Intelligence Centre and the FSCA for money-laundering and terrorist-financing risk. A licensed Bitcoin provider now carries the same core duties as your bank. I walk through how the whole system fits together in my guide to regulatory compliance for Bitcoin in South Africa, but FICA is the part you feel first, on day one, before you own a single satoshi.

What FICA requires of a licensed provider

The obligations come down to a handful of things done properly and repeatedly. A provider must verify your identity through government-issued ID, confirm your residential address and, for an entity, work out who the real human owners and controllers are. It must understand your occupation, the source of your funds and what you intend to do with the account. Where a client or a transaction looks higher risk, it goes further and asks for more. If something crosses the line into suspicious, it reports that to the Financial Intelligence Centre rather than sitting on it. And it keeps the records.

Records for five years. That number carries more weight than it sounds.

Every identity document, every source-of-funds note, every transaction is retained and available to the FIC, to law enforcement or to SARS on request. In practice, at SimplB, that means I collect your ID, verify your face against it through my compliance provider, confirm your address, ask what you do and where the money came from, and screen you against the targeted financial sanctions lists the FIC publishes. If you have opened a bank account in the last decade, none of this will feel foreign. That is the point. Bitcoin now sits inside the same walls.

Why an honest investor comes out ahead

If your money is clean, FICA quietly builds you an asset most people never think about: proof. The provider's onboarding file becomes evidence that you disclosed where the funds came from and that a licensed, supervised institution accepted you after due diligence. When SARS looks at your Bitcoin position, you are not scrambling to reconstruct a story from screenshots. You are pointing at a dated record a regulated firm already holds. I covered how SARS actually sees this activity through the CARF reporting regime in my walkthrough of buying Bitcoin in South Africa, and the two records reinforce each other.

The protection runs the other way too. The moment a provider puts you through proper verification, you know you are dealing with someone answerable to the FSCA and the FIC rather than an unlicensed platform in a jurisdiction you have never visited and cannot sue. For a trust or a company the value compounds. An entity holding Bitcoin through a licensed structure ends up with a full chain of evidence: verification records confirming who the trustees and beneficiaries are, transaction reporting to SARS, and custody documentation showing exactly where the coins are held. That chain holds up in a tax audit, in an estate wind-up and in a dispute over how a trust was run. I set out the entity side in more detail in how I run security, compliance and custody at SimplB.

Trusts and companies get the full treatment

An individual is straightforward. An entity is where FICA earns its reputation. The law does not let a trust or a company hide the humans behind it, so a provider has to reach through the structure to the real owners and controllers. For a company that means identifying anyone holding a quarter or more of the shares along with the directors and authorised signatories. For a trust it goes wider than most founders expect.

Every founder, every trustee, every named beneficiary and every person authorised to act for the trust has to be verified before an account or a Vault opens. Alongside the people, a provider collects the letters of authority stamped by the Master of the High Court, the trust deed and a trustee resolution. I have watched that requirement land on the person who set up a family trust for their children a decade ago and never imagined their teenage beneficiaries would need to be FICA verified. They do. I explain how the entity itself should be structured for Bitcoin in my piece on the trust deed for Bitcoin in South Africa.

The source of funds question

This is the part that generates the most email, so let me be plain about it. When you fund a Bitcoin account, you declare where the money came from. For modest amounts a provider will usually accept that declaration on its own. Push past a meaningful threshold and it asks to see the origin: a bank statement showing the salary, the agreement from a property sale, a letter from an estate confirming an inheritance. Honest money almost always leaves a trail. The trouble only ever starts when someone cannot show one.

Nobody is interrogating you. A provider is satisfying a legal duty to confirm the source is legitimate, and the red flags it watches for are the obvious ones. Funds arriving from a platform with no real know-your-client controls. Money routed through mixing or tumbling services built to obscure where it came from. A purchase wildly out of step with everything else the provider knows about you. Declare employment income and back it with a statement and the account opens. Declare a source that contradicts your documented history and you will get more questions, or a decline.

My advice, if your affairs are at all complicated, is to arrive ready. Bring the sale agreement, the distribution notice, the inheritance letter, whatever explains the money, and the friction disappears before it starts. The engineer from Somerset West did exactly that on his second visit and the account opened the same afternoon.

Why the scrutiny is not the same for everyone

FICA runs on risk, not on suspicion. A salaried professional putting a bonus into Bitcoin sits at the light end of the scale. A business owner with high transaction volumes, a client operating from a higher-risk jurisdiction or a politically exposed person sits further along it and gets more attention. The provider weighs your profile, the size of the transaction against that profile, the intended use and where you are based, and calibrates accordingly.

None of that is an accusation. The level of checking simply mirrors the assessed risk, which is why transparency is the fastest route through onboarding. Tell a provider clearly who you are, what you do and what you plan to do with the Bitcoin and the process moves. Give vague or grudging answers and you invite the very scrutiny you were hoping to avoid.

When a provider has to file a report

If activity crosses into genuinely suspicious territory, the provider is legally required to report it to the Financial Intelligence Centre. The triggers are what you would expect: transactions that diverge sharply from a client's declared profile, amounts structured to duck reporting thresholds, patterns tied to high-risk jurisdictions and anything that carries the fingerprints of laundering or fraud.

For a compliant investor this is a non-event. Your activity matches your profile, so nothing gets flagged. The problem is a mismatch. Declare that you are a pensioner living on R5,000 a month, then deposit R5 million and buy Bitcoin, and the transaction contradicts everything on file. A report follows. It is not a verdict. It is a flag, and where there is a legitimate explanation, the documents settle the question quickly. This is also why I refuse to help anyone paper over an inconsistency at onboarding: the report exists precisely to catch that.

What false information actually costs

Lying on a FICA form is a criminal offence, and I mean that literally rather than as a scare tactic. Declare a false source of funds, a false occupation or a false address and you have committed fraud. If a provider later uncovers it, the law obliges the provider to report it, and the consequences run from a closed account to a matter handed to law enforcement.

If you are carrying prior undeclared Bitcoin and want to bring it into the light, the route is the Voluntary Disclosure Programme, not a convenient fiction at onboarding. Speak to a tax advisor before you open anything new if your history is tangled.

The Travel Rule and moving coins between providers

Bitcoin's ledger was always open. The compliance layer around it has now caught up. Under FATF Recommendation 16, known as the Travel Rule, identifying information about the sender and the receiver has to accompany a transfer between service providers. South Africa made this concrete through the FIC's Directive 9, issued on 15 November 2024 and operational from 30 April 2025. When coins move between two licensed providers, the sender and recipient details travel with them.

The practical effect is an end-to-end trail that anonymous transfers between institutions no longer break. If you hold Bitcoin on a foreign licensed exchange, that platform answers to its own version of these rules, and through the automatic exchange of financial account information its home tax authority can pass your details back to SARS. Moving Bitcoin offshore does not make it disappear. If anything it multiplies the channels through which the record can be reconstructed, which is one more reason to keep your own copy of that record clean from the start.