How to Check If Your Bitcoin Provider Is FSCA Licensed, and Why It Matters More Than You Think

Whether a South African Bitcoin provider is FSCA-licensed is the one check that decides everything else. Do it before a single rand moves and most of the ways this goes wrong close off behind you. Skip it and you are trusting a website. The register is free to search. Skipping it is a strange thing to do with your family's money.

I get asked to recommend an exchange most weeks. My first answer is never a name. It is a question back: have you looked the provider up on the FSCA register yet. Nine times out of ten the person has not, because nobody told them the register was public, or that checking it is the difference between owning Bitcoin and holding a promise from a stranger.

So let me tell you.

How to check the register yourself

The Financial Sector Conduct Authority runs a public search of every authorised financial services provider in the country. You do not need an account, a fee or anyone's permission to use it. Open fsca.co.za, find the search for authorised financial services providers, and you can look a firm up by its FSP number or its registered company name.

1. Ask the provider for the FSP number they operate under. A licensed firm gives it to you in one line. Hesitation here is already an answer.
2. Search that FSP number, or the registered name, on the FSCA register at fsca.co.za.
3. Read what comes back. Check that the entity is active, that crypto assets appear among the products it is authorised for, and that the representative or juristic representative you are actually dealing with is listed under it.

That last step is the one people always miss. A firm can be perfectly licensed while the person selling you Bitcoin is not tied to it in any way the register recognises. That gap shows up plainly on the register itself if you know to go looking for it. The whole exercise takes two minutes from start to finish and it is the cheapest insurance anywhere in the entire process.

When the rules actually changed

None of this existed in a usable form until fairly recently, which is worth remembering when someone tells you the industry has always been above board. On 19 October 2022 the FSCA published General Notice 1350 and declared crypto assets a financial product under the FAIS Act. From that date anyone advising South Africans on Bitcoin or brokering it for them needed a licence, or needed to operate as the representative of a firm that held one. The decade of shrugging and calling it a grey area was over.

Two months later the net widened again. Amendments to the Financial Intelligence Centre Act took effect on 19 and 31 December 2022 and added crypto asset service providers as accountable institutions, dropping the full weight of FICA on the sector. By 10 February 2025 the Financial Intelligence Centre had 256 crypto providers registered under that item. The Travel Rule followed, with the FIC's Directive 9 coming into force on 30 April 2025 and requiring that sender and receiver information travels with transfers between providers.

I have written the fuller version of this timeline in my piece on regulatory compliance for Bitcoin in South Africa, because the sequence tells you more than any single date. Every one of those steps exists to move the risk off the client and onto the provider, and every one of them shows up on the register as a firm that either did the work or did not.

What a licence actually forces a provider to do

A licence is not a rubber stamp. To hold one, a provider has to clear a set of requirements that map almost exactly onto the ways clients have historically been fleeced, and it is worth understanding each of them because they explain why the check is not a formality.

The people running the business have to be fit and proper. Key individuals must satisfy the honesty and good standing requirements under the FAIS fit and proper determination, hold appropriate crypto qualifications and sit the regulatory examinations. That single filter removes a category of operator who simply printed business cards and started taking deposits. It is not a high bar to a serious firm. It is an impassable one to a chancer, which is precisely the point of it.

The firm has to be financially sound. That gives the regulator sight of whether it can meet its obligations rather than running on the next client's money to pay the last one. It is the exact failure mode that took down half the famous names in this industry. A provider that proves its solvency to a supervisor every year cannot quietly become a Ponzi.

Then comes the requirement that carries the most weight and gets the least attention, so I will spend a moment on it. Under the FAIS General Code, client assets held by a provider must be readily discernible from the provider's own. The Financial Institutions Protection of Funds Act goes further and treats Bitcoin held in safe custody as trust property, which under that Act can under no circumstances form part of the assets of the institution holding it. A licensed provider also has to submit an auditor's report each year confirming that client money and client assets were kept separate throughout. Put plainly, your Bitcoin is legally fenced off. If the firm goes under, its liquidator cannot reach across that fence to pay the firm's debts with your coins. On an unlicensed platform there is no fence. Your Bitcoin sits on the company balance sheet, which means when the company fails you stop being an owner and become an unsecured creditor queuing behind everyone else for a fraction of what you put in.

What you give up when there is no licence

The history here is not theoretical and it is not only foreign. Mt Gox and FTX are the famous graves, but South Africa has dug its own, and the clients queuing outside those local collapses were as real as anyone in Tokyo. The common thread in every one is missing oversight. Client funds got mixed with company funds. Balance sheets were quietly insolvent long before the doors closed. And in the worst cases the operators simply left with the money, which no amount of clever technology can undo after the fact.

An unlicensed provider sits entirely outside the perimeter. No supervisor is checking its books. No code of conduct is being enforced against it. So the material customer protections that keep a client safe, the segregation rules and the duty to act in your interest, simply are not applied to it at all. If the assets vanish in a hack or a collapse or a founder who stops answering his phone, there is no legal obligation on that provider to make you whole. Nothing compels it to lift a finger. You are left relying on its goodwill, which is a thin thing to lean on once the money is gone.

Recourse is the part people only value in hindsight.

With a licensed provider you have somewhere to go when something breaks. There is an internal complaints process you can hold the firm to, an escalation to the financial ombud when that fails you, and behind both of those a regulator with real teeth. The FSCA can suspend or withdraw a licence and debar the individuals responsible from the industry entirely. In serious cases it can go to the High Court and have a curator appointed to seize control of the business and protect whatever client assets remain. None of that machinery exists for a firm the register has never heard of. Your only remedy against a firm nobody licensed is civil litigation, which is slow and expensive at the best of times and close to hopeless when the counterparty turns out to be a shell company in another jurisdiction with a website and nothing behind it.

The receipts matter here too. Verified, documented Bitcoin is bankable Bitcoin, and the paper trail a licensed provider produces is the same trail that keeps SARS and your bank satisfied years later. I set out that side of it in my guide to FICA compliance for Bitcoin buyers.

But their app looks so professional

A client in Cape Town once sent me a link to a platform he was about to move a serious sum onto and asked me what I thought. The site was beautiful. Slick charts, testimonials, a founder in a good suit talking to camera about security. It looked more polished than most licensed firms I know.

It was not on the register.

Not under any name I could find, not under any FSP number, and there was no number offered anywhere on the site to search. The design budget had gone into the parts a visitor sees and none of it into the parts a regulator inspects. He kept his money. Two of his acquaintances, he told me later, did not, and learnt the lesson the expensive way.

This is the trap the register is built to catch. A website costs a weekend and a template. A licence costs an audit, a compliance function and a business that can survive being inspected. The FSCA has warned more than once about fraudsters cloning legitimate providers and even using AI-generated videos of well known South Africans to sell platforms that do not exist. You cannot tell the real from the fake by looking, because looking is exactly what the fake is engineered to survive. You can tell them apart by searching, which the fake cannot survive at all.

The offshore exchange question

Plenty of South Africans hold Bitcoin on large international exchanges that answer to the UK's FCA or Singapore's MAS but carry no FSCA licence. That is a genuinely different situation from using a firm nobody regulates anywhere. A serious exchange under a credible foreign regulator operates inside a real framework. Its segregation and its operational standards may well be as good as anything you will find here at home. I am not going to pretend otherwise.

The trade-offs are local ones. Cross-border Bitcoin now falls under exchange control, so the money leaving and returning is the regulator's business in a way it was not a few years ago. Your transactions on a foreign venue remain taxable events for a South African resident regardless of where the exchange sits. And any dispute has to be fought in the provider's jurisdiction rather than yours, which is a very different fight when it is happening in a courtroom you will never see. For a client who wants those complications to disappear, a locally licensed provider is simply the shorter path. This is really the same choice that runs through the difference between self-custody and exchange custody: how much of your control you are willing to lend out, and to whom.

What my own licensing means, and how to check it

I hold myself to the same test I am asking you to run. SimplB operates as a Juristic Representative of CAEP Asset Managers, which carries FSP number 33933 and the Category I and II crypto asset service provider licences that cover brokerage and custody as well as advice. That structure is what lets me broker Bitcoin as regulated financial activity rather than a handshake, and it puts compliance officers and external auditors between my clients and any temptation to cut a corner. I go into how that shapes the whole operation in what SimplB offers on security, compliance and custody.

Do not take my word for it. Search 33933 on the FSCA register and read what comes back, exactly as I have asked you to do for anyone else. The point of a public register is that trust becomes optional.

The market here has matured past the excuse that the rules were unclear. There is no longer a good reason to send money to an unlicensed provider, and there is every reason to spend two minutes making sure you are not about to. Check the register first. It is the most useful thing you can do before you own a single satoshi.