Bitcoin and Regulation: What the Evidence Actually Shows

The regulatory risk people fear with Bitcoin is not the risk the evidence shows. The headlines promise a crackdown. The paper trail of the last five years shows the opposite: licensing, declarations, court judgments and reporting frameworks, all pulling Bitcoin further inside the law rather than pushing it out. This is a walk through what South Africa actually did, with the dates, so you can weigh the real risk instead of the imagined one.

Start with what actually happened, not what might

People imagine a ban. What South Africa produced was a stack of gazette notices.

On 19 October 2022 the Financial Sector Conduct Authority published General Notice 1350, declaring crypto assets a financial product under the FAIS Act. That single document ended roughly a decade of argument about whether Bitcoin sat inside the law or outside it, and it did so by regulating the people who sell and advise on it rather than the asset you hold. Anyone rendering advice or intermediary services on crypto now needed a licence or needed to act as a representative of a firm that held one. A transitional window ran from 1 June 2023 to 30 November 2023 for existing operators to apply. By October 2024 the FSCA had received four hundred applications and approved two hundred and eighteen, with a hundred and six withdrawn, mostly by applicants who could not meet the operational or competency bar. That is not the shape of a crackdown. It is the shape of an industry being brought indoors and made to prove it can behave.

The detail I find most revealing is what the FSCA deliberately left out. Miners, node operators and providers dealing only in non-fungible tokens were exempted from the licensing net, on the reasoning that their activities support the network rather than sell a product to a customer and pose a lower consumer risk. A regulator drawing careful lines around who is captured and who is not is a regulator trying to regulate well, not one trying to stamp something out. That distinction is the whole tell. Prohibition does not bother with proportionality.

Governments regulate the door, not the building

China is the case everyone reaches for. It announced restrictions in 2017, again in 2021 and again in 2022. Each time the price fell and the obituaries were written, and each time the network kept producing blocks and the price recovered, because banning the exchanges is not the same as banning the protocol. Trading simply moved offshore and peer to peer.

The reason is structural. The Bitcoin network is not a company with an office you can raid. It runs on tens of thousands of private machines spread across more than 180 countries, and no jurisdiction has a switch for it. What a government can reach is the infrastructure bolted onto the edges: the exchanges, the custodians, the moment your rand becomes Bitcoin and back again. So that is what they regulate. This is the same lesson the internet taught in the 1990s, when states discovered the network itself was too distributed to control and too useful to ban, and settled instead for regulating the commerce running on top of it. Bitcoin is on the same track. You cannot shut down the protocol, but you can license who provides services around it, and that is precisely what is happening here and everywhere serious about it.

Look outward and the pattern repeats in the jurisdictions that matter. The European Union brought its markets in crypto-assets framework into force from 2023, a strict regime but a clear one that licenses providers rather than banning them. The United States took the longest road and arrived at the same junction when spot Bitcoin exchange-traded funds were approved in January 2024, a decision that told the market this is an asset class to be regulated like any other, with standards for the intermediaries and the custody. El Salvador went further still and made Bitcoin legal tender in 2021 before accumulating it as a reserve. Different politics, different economies, one direction of travel. The sceptics who priced in prohibition kept being wrong.

The compliance layer that followed the licence

A licence on its own does not stop dirty money, so the anti-money-laundering machinery arrived alongside it. Amendments to the FIC Act took effect on 19 and 31 December 2022, adding crypto asset service providers to Schedule 1 as accountable institutions under new item 22. From that point the full weight of AML, counter-terrorist-financing and proliferation-financing law fell on the sector. Verification, monitoring and record keeping stopped being a courtesy and became a statutory duty.

Then the rules started following the coins as well as the client. On 15 November 2024 the FIC issued Directive 9, bringing the FATF Travel Rule to South African providers, and it came into force on 30 April 2025. Identifying information about sender and receiver now travels alongside transfers between service providers. None of this makes Bitcoin harder to own. It makes the provider you use accountable, and it is the reason I walk every client through full FICA onboarding before a single satoshi moves, which I set out in detail in my piece on what regulatory compliance for Bitcoin in South Africa actually requires.

What SARS and SARB have put on the record

SARS treats Bitcoin as an asset, not a currency. Sell at a profit and capital gains tax applies for most investors. Receive it as payment and it is income at your ordinary rates. Trade it actively and the whole gain may be treated as revenue. The holdings and the gains belong on your annual return, and the assumption that SARS cannot see crypto flows is already out of date. It has built the capability to analyse movements in and out of local platforms, and on 26 November 2024 the Commissioner signed the multilateral agreement under the OECD's Crypto-Asset Reporting Framework, with automatic exchange of crypto tax information between countries due to begin in 2027.

The Reserve Bank sits at the cautious end of all this. Its settled position, shared with the Intergovernmental Fintech Working Group, is that crypto assets do not carry legal tender status and cannot be used to settle obligations inside the national payment infrastructure. That caution is not the same as prohibition. Holding Bitcoin remains lawful.

What SARB has actually pursued is narrower and more interesting: bringing cross-border Bitcoin flows under the exchange control net that was built for banks and borders. Its Financial Surveillance Department has pushed for years to amend Exchange Control Regulation 10(4) so that crypto counts as capital, the legal groundwork for treating a Bitcoin transfer across the border the way it already treats moving rand or gold. That is a bureaucrat's project, patient and procedural, and it tells you the Reserve Bank sees Bitcoin as something to bring into the system rather than something to abolish. You do not spend years drafting rules for a thing you intend to ban.

The evidence that judges are still arguing

Here is the part the headlines miss entirely, and it is the clearest evidence of all that this is being worked out in the open rather than settled by decree. The courts do not yet agree with each other.

In Standard Bank of South Africa v South African Reserve Bank [2025] ZAGPPHC 481, handed down on 15 May 2025, the Gauteng High Court held that cryptocurrency does not constitute "money" or "capital" within the meaning of the Exchange Control Regulations of 1961, leaning on Bitcoin's decentralised and intangible nature. Barely a year later, in Mangundhla and Another v South African Reserve Bank on 1 June 2026, another High Court reached the opposite conclusion, holding that Bitcoin was both money and capital in the context before it, and describing the earlier reasoning as clearly wrong. Two courts, two answers, one asset. I unpack what that first judgment means for holders in my write-up of the Standard Bank exchange control case, because it carries more weight than most people realise.

That contradiction is not a footnote. It is the direct catalyst behind the Draft Capital Flow Management Regulations published in 2026, which try to end the argument by writing crypto into the definition of capital and folding it into the exchange control regime, open for public comment until 30 June 2026. If you hold material sums, this is the live question, and I have written separately about why the 2026 crypto rules differ from everything before them.

Two judges disagreeing is not chaos. It is a system arguing its way to an answer.

That is what evidence of live regulation looks like from the inside. It is messy, it is contested and it moves in public through gazettes and courtrooms rather than arriving overnight as a decree. Anyone who tells you the outcome is already fixed, in either direction, is guessing ahead of the record.

Reading the risk honestly

So here is the balance, without the spin either way. Could the state make restrictive rules, impose declaration duties or design an unfriendly tax regime? Yes, and the 2026 drafts show it is willing to try. Could it shut down the network you actually hold your Bitcoin on? No, and no evidence in five years suggests otherwise. The regulatory risk is real and it is not zero, but it is lower than it was in 2017 and it points at licensing and disclosure rather than prohibition.

I say that as someone who has watched this from inside the industry since 2016, through the schooling-fee years when the rules were unclear and the platforms were cowboys. The change since 2022 is enormous and it runs almost entirely in the holder's favour. A licence you can verify. A paper trail that proves the money was clean. A tax framework that, whatever you think of it, is at least written down. None of that existed a decade ago.

The practical move follows from that. Use a locally licensed provider so a shifting rule finds you already visible and documented, keep your tax records clean and know where your exchange control position stands. The people who get hurt by regulation are almost always the ones who tried to route around it, not the ones who kept the receipts.

Compliance is not the cage people fear. It is a receipt you welcome.

If you want to be sure the provider you are trusting is genuinely licensed rather than merely confident, I wrote a full walkthrough of how to check whether a Bitcoin provider is FSCA licensed, and it takes about two minutes.