Security, Compliance and Custody: What SimplB Offers

Bitcoin ownership comes down to three questions: how to buy it without breaking any rules, how to hold it so it cannot be stolen and how to prove it is yours when a bank, an auditor or an executor asks. Most providers answer one of the three and leave you to work out the rest. I built SimplB to answer all three inside South Africa's regulatory framework, as a Juristic Representative of CAEP Asset Managers (FSP 33933).

Is Bitcoin regulated in South Africa?

In October 2022 the Financial Sector Conduct Authority declared crypto assets a financial product under the FAIS Act. That notice ended a decade of argument about whether Bitcoin sat inside or outside the law. From then on anyone advising South Africans on Bitcoin or brokering it needed a licence or authorised representative status under a firm holding one.

The cowboys did not vanish overnight. They just lost the excuse that the rules were unclear.

SimplB sits inside that framework rather than beside it. The business is a Juristic Representative of CAEP Asset Managers (FSP 33933) and operates under CAEP's Category I and II crypto asset service provider licences. In practice this means a licensed FSP carries formal responsibility for how I conduct myself, how I keep records and how client processes are run. There are compliance officers who check my work and external eyes on every part of the operation. I find that comforting rather than restrictive, which probably tells you what kind of operator I am.

The two licence categories do different jobs. Category I covers advice and intermediary services, the licensing that governs helping you transact. Category II covers discretionary management. My own advisory work happens under supervision and always one to one, after onboarding, with your circumstances on the table. Nothing on this site is advice and I am careful about that distinction, because plenty of providers are not.

Do not take my word for any of it either. The FSCA register is public and a search takes about two minutes. I wrote a separate piece on how to check whether a Bitcoin provider is actually licensed, because the oldest trick in this industry is a confident website standing in front of an empty structure.

What FICA compliance looks like before you buy

Every client goes through full FICA onboarding before any Bitcoin changes hands. That means identity verification, proof of address and a review of where the funds come from. For a trust the net is wider than most people expect: the law requires that every trustee and every named beneficiary is verified before an account or a Vault can be established. I have watched that requirement surprise more than one founder of a family trust.

Source of funds is the part that generates the most email. In practice it means showing where the money originated: a salary history, a property sale agreement, a business distribution or an inheritance letter. Honest money always has a paper trail somewhere in a filing cabinet or an inbox. The review feels intrusive right up until the day you need that same trail to defend your ownership.

The same logic now follows the coins themselves. South Africa has adopted the FATF Travel Rule, which requires identifying information about sender and receiver to travel with transfers between service providers. Bitcoin's ledger was always traceable. The compliance layer around it is catching up.

What the paperwork buys you is provable ownership. Purchases happen in an account carrying your own name. There is no pooled wallet, no nominee structure and no IOU on anyone's balance sheet. When SARS asks about your disclosure, the paper trail is clean. When a bank queries a large deposit after you sell, the provenance is a printout away. When an executor winds up an estate, ownership is a fact rather than an argument. I set out the full document list in my guide to FICA compliance for Bitcoin buyers.

Compliance is not the price of admission. It is the receipt.

How I buy Bitcoin for clients

The process starts with a conversation, not a form. A discovery call establishes what the money is for, what the time horizon looks like and whether Bitcoin even suits the situation. I am Bitcoin only and I turn away work involving altcoins, yield schemes or trading signals. Once onboarding clears, funds move by EFT from your named bank account and the Bitcoin is bought at market through my execution partners.

Named accounts are the detail I refuse to compromise on. The Bitcoin is yours from the moment of purchase, held against your name rather than mine. If I fall under a bus tomorrow the asset does not enter my estate. That single design choice removes the counterparty risk that has destroyed more crypto wealth than every hacker combined.

From there the shape depends on the client. Savers build positions through automated monthly purchases from R1,000 a month, which smooths the entry price across the cycle instead of betting everything on one Tuesday. Larger buyers use the OTC desk, live at any size, where a single settlement price replaces the slippage of pushing a big order through a retail order book. Clients wanting offshore Bitcoin exposure in US dollars can register an expression of interest and I structure that conversation separately.

Selling runs through the same rails in reverse. The compliance you did on the way in makes the exit painless.

The lesson South Africa already paid for

The Bitcoin protocol has never been hacked. Every headline loss you can name happened at the places people left their coins. Mt Gox was handling roughly seven of every ten Bitcoin trades on earth when it collapsed in February 2014 with around 850,000 coins missing. Well over 400 exchanges have failed globally since then. South Africa wrote its own chapter in 2021 when the local exchange iCE3X froze withdrawals after finding holes in its books. Its clients stopped being customers that week and became creditors in a liquidation. At least two South African exchanges have gone under in Bitcoin's short local history and the schemes that simply fled with client money are too many to list.

I did not learn this from headlines. I have been in Bitcoin since 2016 and the early years charged me what I call schooling fees, mistakes made on platforms and setups I had no business trusting. SimplB exists so that my clients never pay those fees themselves. I keep a running record of what has and has not been hacked in Bitcoin's history for anyone who wants the receipts.

The pattern has held for fifteen years. Custodians fail. The asset does not.

Self-custody, done properly

From about R10,000 upward I recommend holding your own keys and I run guided setups to get clients there safely. The session covers choosing a hardware device, buying it directly from the manufacturer so nothing arrives tampered with, initialising it offline and generating the seed phrase properly. The backup gets verified before any meaningful value touches the wallet. Then comes the part almost everyone skips: a test recovery, so you know the backup actually works before the day you need it.

Below R10,000 I generally tell people not to overthink it. Keep saving, keep the position on the named account and revisit custody once the value justifies the hardware. Security should be proportionate to what it protects. A small holding behind expensive hardware solves the wrong problem first.

The seed phrase is the whole game. Those words are the Bitcoin.

Anyone who reads them can take everything, which is why they never get photographed, never touch a cloud service and never get read out to anyone who phones you claiming to be support.

The old mantra says not your keys, not your coins. My version is less poetic. Trust no one with your Bitcoin and since none of us manage that completely, the goal is to limit how much trust sits in any one place. A hardware wallet with a verified backup does that for most holders. I cover the detail in my guide to Bitcoin self-custody in South Africa.

How the SimplB Vault works

Above a certain value a single hardware wallet starts to feel thin. One device means one backup and one person who understands the setup. The Vault is my answer to that concentration. It is a 2-of-3 multisignature arrangement built on three hardware devices from three different manufacturers: a Trezor, a Ledger and a Coldcard recovery key. The vendors differ on purpose, so no single manufacturer fault or supply chain compromise can ever touch all three keys at once. Each key gets a steel plate backup that survives fire and water.

You hold two of the keys. I hold one as part of the regulated service under CAEP's licence. Moving Bitcoin requires two signatures, which produces the property the whole design turns on: I can never move your funds alone and you can move them without me whenever you choose. If SimplB disappeared tomorrow, your two keys are enough for a standard multisig recovery. A custodian you do not need to trust is the only kind worth paying.

It is worth being precise about what this is not. The Vault is not an exchange account wearing a suit and it is not a pooled product where your Bitcoin becomes a line in someone else's database. It is self-custody with regulated participation in the control environment. You keep direct bearer-asset ownership of specific coins. I provide the service layer that keeps the arrangement governable and lawful.

Setup is deliberate rather than fast. I do five Vault setups a month, because each one includes the estate work that makes the structure worth having. Courts can confirm who your heirs are. No court on earth can decrypt a private key. So every Vault comes with a documented recovery plan: a letter of instruction telling your executor what exists, where the keys live and how the funds move, without a single private key ever being written into a will. The plan is reviewed at setup and updated when circumstances change.

For companies and trusts the same structure answers the governance questions that stall most boards. Keyholders are documented. Withdrawals need two parties by design rather than by policy. Auditors get view-only wallet access, so balances can be verified in real time without anyone gaining signing power. The details of hardware, process and pricing sit on the Vault page.

Bitcoin is a bearer asset. The Vault turns that from a threat into a feature.

What is live today and what is still coming

As of July 2026 the live services are buying and selling in your own name, monthly savings plans from R1,000, guided self-custody setups, the Vault and OTC execution at any size. Offshore US dollar exposure runs by expression of interest. Lightning payments, Bitcoin-backed lending, an advisor dashboard and a white-label offering for other licensed firms sit on the roadmap and I will keep saying so plainly until the day they go live.

That distinction is worth testing when you compare providers. A shop claiming everything is live usually has something that is not. Ask which services carry a licence, which carry a roadmap and which carry nothing but a landing page.

The answers sort this industry very quickly.