South Africa’s Crypto Reporting Regime Is Now Live — What CASPs Must Do

South Africa became the first African country to operationalise the OECD’s Crypto-Asset Reporting Framework on March 1, 2026, when the first mandatory reporting period formally opened. Every Crypto Asset Service Provider with a South African nexus is now required to collect, verify, and annually report user tax residency data and transaction totals to the South African Revenue Service — whether they are ready or not.

CARF — the Crypto-Asset Reporting Framework — is the OECD’s answer to the question of how tax authorities can track crypto transactions across borders in a world where digital asset ownership is increasingly global and increasingly opaque to traditional reporting mechanisms. The same logic that produced the Common Reporting Standard for bank accounts in 2014 produced CARF for crypto a decade later. South Africa has now moved first on the continent to put it into effect.

For CASPs — exchanges, brokers, and hosted wallet providers — operating with a South African connection, the reporting obligation that begins on March 1, 2026 is not a future planning item. It is a current compliance requirement.

What the First Reporting Period Covers

The first CARF reporting period runs from 1 March 2026 to 28 February 2027. At the close of that period, CASPs must submit a structured report to SARS covering every qualifying customer whose transactions during the year meet the reporting threshold. The report must contain:

• The customer’s tax residency — including residency in any foreign jurisdiction, not only South Africa
• The customer’s Tax Identification Number (TIN) for each jurisdiction of tax residency
• Gross annual transaction values, segmented by asset type and transaction category (exchanges for fiat, exchanges for other crypto, transfers)
• Aggregate balances or holdings where relevant

SARS will then use this data in two ways: to match against South African taxpayers’ own declarations and identify unreported crypto gains, and to exchange data with foreign tax authorities under applicable automatic exchange agreements — the same infrastructure that carries CRS data internationally.

Who Must Report

The reporting obligation applies to all Crypto Asset Service Providers with a South African nexus. “Nexus” is defined broadly and includes: CASPs incorporated in South Africa, CASPs that are tax resident in South Africa, CASPs with a branch or permanent establishment in South Africa, and CASPs that provide services to South African customers above a de minimis threshold even if incorporated offshore.

The categories of CASP covered are equally broad:

Firms that are unsure whether they meet the nexus test should assume they do and seek a legal opinion. SARS has indicated that aggressive nexus interpretation is the starting point, not a cautious one.

The Budget Context: Crypto Inside Capital Flow Management

Finance Minister Enoch Godongwana’s February 2026 Budget did more than set expenditure allocations — it formally incorporated crypto assets into the Capital Flow Management framework under the Currency and Exchanges Act of 1961. This is the same legislative vehicle that governs how South Africans move money in and out of the country, managed by the South African Reserve Bank and the Financial Surveillance Department.

The practical implication is that crypto-denominated cross-border flows — sending bitcoin to an offshore exchange, receiving USDC from a foreign counterpart, holding stablecoins that are managed by a foreign entity — are now treated as capital flows for regulatory purposes, subject to the same annual discretionary and investment allowances that govern foreign currency transactions. Using crypto to circumvent forex controls is no longer a grey area. SARS and the Reserve Bank have aligned their frameworks.

FSCA Licensing Enforcement Is Tightening

The CARF reporting mandate lands in a market where the Financial Sector Conduct Authority’s licensing process for crypto asset service providers is moving into enforcement mode. The FSCA opened CASP licence applications in late 2022 and set a transitional period during which unlicensed providers could operate while applications were processed. That transitional period has effectively closed for most categories of applicant.

The large majority of established South African crypto exchanges — Luno, VALR, AltCoinTrader, and others — have received their CASP licences or have applications in advanced stages. For smaller operators and offshore platforms serving South African customers without a licence, the risk profile has shifted materially. FSCA has signalled active enforcement against non-licensed CASPs — not merely the refusal to accept new applications.

CARF and FSCA licensing reinforce each other. A CASP that is licensed by the FSCA already has the customer verification infrastructure — KYC, AML, identity documents — that CARF reporting depends on. An unlicensed CASP that has been operating with minimal KYC is simultaneously in breach of FSCA requirements and unable to produce CARF-compliant reports. The two regulatory streams converge on the same compliance problem.

What CASPs Must Do Now

For compliance teams, the March 1 start date means that data collection obligations are already running. The minimum requirements for the current reporting year:

• Tax residency verification: Collect and verify each customer’s tax residency status, including TIN for each jurisdiction. Self-certification forms — modelled on CRS self-certification — are the standard mechanism. Existing KYC processes will need to be extended if they do not already capture tax residency
• Transaction recording: Log all transactions from March 1, 2026 with sufficient granularity to produce the annual aggregate report — asset type, transaction type, fiat equivalent value at time of transaction
• Data architecture: Ensure reporting systems can produce the SARS-specified XML or structured data format. SARS is expected to publish the final technical specification for CARF submissions during the course of 2026
• Remediation of existing customer records: Customers onboarded before March 1 who do not have tax residency on file will need to be contacted and self-certification collected before the annual submission

The Regional Precedent

South Africa’s first-mover status on CARF is not an accident. The country has the continent’s most developed financial regulatory infrastructure, is a member of the Financial Action Task Force, and has for years been the default benchmark for African financial regulation in international forums. But being first also means absorbing the implementation difficulties that other jurisdictions will be able to learn from.

Kenya, Nigeria, and Ghana are watching. Each has a maturing crypto regulatory framework — Kenya’s VASP Bill is progressing through parliament, Nigeria’s SEC VARA framework is operational, Ghana’s VASP Act 2025 is now in sandbox phase. CARF will follow each of these frameworks in sequence, as the OECD’s international exchange agreements extend to new signatories.

For CASPs with a pan-African operating footprint, building CARF-compliant data infrastructure now — in South Africa — creates the foundation for the reporting requirements that will arrive in other markets within the next two to four years. The compliance investment is not South Africa-specific. It is the infrastructure for the next decade of African crypto regulation.