Bitcoin Treasury Governance in South Africa: Why Your Policy Stops at the Private Key

A Bitcoin treasury policy records what a company intends to do with its position: how much it will hold, when it will rebalance, who may authorise a disposal and at what value. What the company is actually able to do is settled somewhere else entirely, by the custody arrangement. It comes down to how many people must agree before any Bitcoin moves. Where one employee holds one set of credentials, every limit in that policy is voluntary. It binds the company for precisely as long as that person chooses to be bound by it, which is to say it holds on every ordinary day and fails on the one day it was written for.

Most South African boards have never tested the difference, because the policy and the wallet are approved by different people at different meetings and nobody owns the join.

Your directors carry this personally

Section 76 of the Companies Act 71 of 2008 requires a director to act with the degree of care, skill and diligence reasonably expected of someone carrying out that function. Section 77 makes a director personally liable for loss the company suffers through a breach of that duty.

The business judgement rule at section 76(4) offers a safe harbour, though a narrow one. It protects a director who took reasonably diligent steps to become informed, who had no conflicting personal financial interest and who had a rational basis for believing the decision served the company. A board that approved a Bitcoin treasury policy without ever asking whether the policy could be enforced has not taken reasonably diligent steps to become informed about the thing it approved.

King IV Principle 11 puts the same obligation in governance language, making the governing body accountable for risk management even where it delegates the design and implementation to management. Delegation of the work does not delegate the accountability.

The accounting reports your losses and not your gains

The accounting then makes the position harder rather than easier, in a way that is specific to companies reporting under IFRS. Following the IFRS Interpretations Committee agenda decision of June 2019, Bitcoin held by a company that is not a broker-dealer is an intangible asset under IAS 38. It carries an indefinite useful life, which means no amortisation and an impairment test instead.

Under the cost model it sits at cost less impairment, so the gains never appear. Under the revaluation model, which Bitcoin qualifies for because an active market exists, increases go to other comprehensive income rather than profit. Decreases hit profit and loss, except where they reverse earlier gains.

Read that again as a director. Your Bitcoin gains do not reach reported earnings. Your Bitcoin losses do. American companies were moved to fair value through net income by FASB ASU 2023-08, which is why so much of the treasury commentary you read assumes symmetry. South African companies report under IFRS and got no such thing. The practical effect is that your income statement will misrepresent your Bitcoin position in one direction for as long as you hold it. The pressure to do something rash will arrive through the reported numbers rather than through the economics. That is exactly the moment a board needs its exit policy to be enforceable rather than merely written.

Who can move the coins?

So assume your board has done the work properly. There is a cap on Bitcoin as a percentage of total assets. There are rebalancing triggers with real numbers attached to them. There is a defined process for raising liquidity against the position, a schedule of who may authorise a disposal at what value and a standing item on the audit committee agenda. Every page is approved and minuted. Your directors have discharged section 76 on paper.

Now answer one question. Who can move the coins?

If the honest answer is the CFO, working alone, from an exchange login, then everything above is a statement of intent that the company has no mechanism to enforce. The rest of this piece deals with closing that gap: what closing it achieves, what it fails to achieve and what the South African regulatory position means for a board deciding how to hold the asset.

Policy describes. Custody decides.

The governance case for Bitcoin treasuries has been made competently elsewhere. Bryant Nielson at Satoshi Institute put it well recently: the conviction that makes a Bitcoin treasury work is the same conviction that wrecks companies holding it without restraint. His answer is to install controls alongside the belief. That is right as far as it goes.

It stops one step short. A control nobody can enforce is a preference. The entire governance conversation in this space is conducted as though writing the policy is the hard part, when the hard part is building an arrangement in which breaking the policy is not available to any single person. The document tends to get the months of attention. The wallet tends to get an afternoon. That is the wrong way round.

Think about what your directors are actually relying on when the only thing standing between the company and its Bitcoin is one set of credentials. They are relying on the continued good judgement, emotional steadiness and personal solvency of one employee, under conditions specifically designed to test all three. Whatever that arrangement is, it functions as a character reference rather than a governance framework.

What one keyholder can do before lunch

The useful way to size up your exposure is to stop asking what the policy says and start listing what a single person with access could do without anyone stopping them.

They can sell it this morning. Or never sell it at all. Both are the same control failing, in opposite directions. A treasurer who liquidates at the bottom because the mark has become unbearable has spent the thesis. A treasurer who will not part with a satoshi under any circumstance has quietly removed the position from the company's liquidity options. Your board sanctioned neither of those postures. It simply has no way to hold anyone to the one it did sanction.

They can pledge it as collateral. Notice who signs a lending facility at most companies. It is the same person who holds the treasury access, which puts the decision to encumber the asset and the ability to encumber it in one pair of hands. Nobody independent has to check those two against each other. The board learns the Bitcoin is pledged when the facility surfaces in the numbers, at which point a drawdown has become a margin call on an asset the company is no longer free to sell.

They can breach the cap one purchase at a time. Over-allocation almost never arrives as a decision. It accumulates. Nobody convenes a meeting to move the position from 15% of assets to 45%. It gets there through a series of individually defensible buys, each made by somebody who believes, quite sincerely, that they are acting in the company's interest. A cap reviewed quarterly against a balance one person controls daily is a cap in name only.

They can do any of it before anyone knows. This is the part that should hold directors' attention. Each of the above is executable in an afternoon and reportable afterwards. Your governance runs on a quarterly cycle. Your exposure runs on a ten-minute one.

The South African layer

Most treasury commentary on this subject is written for a company with a US bank, US auditors and no exchange control regime to think about. Your directors are in a different room.

Start with exchange control, where the position is genuinely unresolved. In Standard Bank of South Africa v South African Reserve Bank and Others (047643/2023) [2025] ZAGPPHC 481, the Pretoria High Court held that cryptocurrency is neither "capital" nor "currency" for the purposes of regulations 3(1)(c) and 10(1)(c) of the Exchange Control Regulations, on the basis that it is not legal tender. SARB had therefore acted beyond its powers in forfeiting roughly R26 million connected to alleged crypto-related contraventions. The regulations date from 1961 and were plainly not drafted with a borderless digital asset in mind.

SARB has appealed and the Supreme Court of Appeal is seized of the matter. Read the judgment carefully before treating it as good news. It says the current regulations do not reach crypto, which is a statement about the drafting of a 1961 instrument rather than a policy decision to leave Bitcoin outside exchange control.

National Treasury and SARB have both signalled that the framework is being reworked, a direction I traced in Bitcoin and exchange control after the 2026 Budget. A board that structures a cross-border position today on a first-instance judgment under appeal, in an area the regulator has said it intends to close, is taking a regulatory view rather than relying on a settled rule. Your directors should know which of those they are doing.

The FSCA position is more settled and less useful than it first appears. General Notice 1350 of 19 October 2022 declared crypto assets to be financial products under the FAIS Act. CASP licensing has applied since 1 June 2023. By 2026 the FSCA had received over 500 applications and approved roughly 300. A CASP licence is now a baseline rather than a signal. It tells your board that a provider is regulated for conduct. It tells your board nothing whatsoever about whether your Bitcoin is held in a structure your policy can rely on, which is a question about signing arrangements rather than about licensing.

Then there is the audit. At year end your auditors will want evidence of existence and evidence of control over the asset. Those are two separate questions and a policy document answers neither. An exchange statement answers the first weakly and the second not at all, because what it evidences is a claim against a third party rather than control of the asset itself. This is where the custody structure stops being a security preference and starts being an audit position.

None of which is an argument against holding Bitcoin. Africa Bitcoin Corporation, formerly Altvest, has already shown that a JSE-listed company can adopt Bitcoin as a stated treasury strategy, raise against it and take the market with it, and I went through that listing in Africa's first JSE-listed Bitcoin treasury company. The interesting question has moved on. It is now whether the SA corporates following that path are building the controls at the same time as the position or intending to get to them once the position is large enough to hurt.

What a 2-of-3 structure actually changes

In a 2-of-3 multi-signature arrangement, three keys exist and any two of them can authorise a movement. The company holds two. A regulated third party holds one. I have set out the mechanics of that structure in multi-signature Bitcoin custody.

The consequence is structural rather than technical. No individual at the company can move the position alone, so the disposal schedule your board approved is now enforced by the arrangement rather than by everyone's continued willingness to respect it. The company retains control of its own asset, because it holds two of the three keys and can recover and move the position without the third party's cooperation.

One detail decides whether any of that is real. The two company keys have to sit with people who are genuinely separated. If the CFO holds both, you have bought an expensive backup rather than a control, because the CFO can still act alone. Put one with the CFO and one with an independent director or the board chair. The signing threshold then becomes the place where your board's authority physically lives.

Be clear about what this does and does not solve, because a structure oversold is a structure your board will stop trusting. It ends unilateral disposal completely. Nobody sells the position at 3am on their own judgement, in either direction of panic.

It does less than that on the other three. A vault governs outflows rather than inflows, so it will not stop a treasurer buying past the cap with company fiat. A pledge is a contractual act, so a facility can be signed against the position whether or not the coins can be moved to satisfy it. And a treasurer determined never to sell can simply decline to co-sign, which is a personnel problem rather than a cryptographic one. What multi-signature buys you on those three is time and visibility: nothing settles without a second person seeing it, which is usually enough for a board to intervene while intervening is still useful.

The same structure answers your auditor. A multi-signature arrangement with a regulated co-signer produces something inspectable: verifiable on-chain evidence of the position alongside a documented record of who must act together to move it. Existence and control, evidenced rather than asserted. The governance benefit and the audit benefit turn out to be one feature seen from two chairs.

The third key, in my case, is held by SimplB. Ask any provider offering to hold one the same three questions. Under what licence do they hold it? What becomes of your access if they fail? Can you recover the position today without them?

The founder question

Every board that has taken this decision knows the dynamic. Directors who would interrogate a R5 million capex line without blinking will wave through a nine-figure treasury position, because the person who put it there has been right about it for six years and everyone in the room knows it.

The usual prescription is cultural. Recruit an independent director prepared to push back. Build a boardroom where challenge is welcome.

That advice asks people to be brave on a schedule, which is not a control either. The structural answer is quieter and considerably more reliable: build the arrangement so that unilateral action by the founder is not technically available in the first place. Nobody has to be brave. Nobody has to have the difficult conversation at the worst possible moment. The founder keeps the conviction that got the company here. The company loses the single point of failure that came attached to it.

Conviction was never the problem

The belief is the asset. The single set of credentials is the liability. Those two get conflated constantly because the same person usually holds both. Boards end up debating the belief when the thing needing attention is the credentials.

Nothing in this argument requires your board to believe less. It requires the company to be built so that believing and acting are separate events, each with its own authorisation. Everything your directors are worried about when they worry about Bitcoin is downstream of one person being able to do both at once.

So when you next review the position, start here. Who could move it today, alone, before anyone else found out? Everything else in your policy follows from that answer.

Sources

Companies Act 71 of 2008, sections 76 and 77, on directors' conduct, the business judgement rule and personal liability. IFRS Interpretations Committee, Holdings of Cryptocurrencies (June 2019), classifying cryptocurrency as an IAS 38 intangible asset, with IAS 2 treatment where it is held for sale in the ordinary course. FASB ASU 2023-08, the US fair value treatment that does not reach South African IFRS reporters.

Standard Bank of South Africa v South African Reserve Bank and Others (047643/2023) [2025] ZAGPPHC 481, under appeal. FSCA General Notice 1350 of 19 October 2022, with the CASP regime in force since 1 June 2023. King IV, Principle 11, on risk governance.

// this article is for general educational purposes only and does not constitute financial, legal, tax or exchange control advice. the information reflects the regulatory position as at the date of publication. your individual circumstances may differ and you should seek qualified professional advice before making any decisions.