Understanding Directive 9: What New Crypto Compliance Regulations Mean for CASPs

As South Africa strengthens its regulatory framework regarding cryptocurrencies, Crypto Asset Service Providers (Casps) need to act promptly to prevent compliance violations. Beginning on 30 April 2025, Directive 9 will impose more rigorous regulations for the monitoring and reporting of crypto asset transactions. A key aspect of this directive is the ‘travel rule’, which mandates that customer details accompany all domestic and international crypto transfers. This information must consist of the sender’s full name, identification or passport number, date and place of birth, residential address (if “readily available”), and wallet address for transactions over R5 000.

Listen/Read:

The greylisting of South Africa by the Financial Action Task Force (FATF) has resulted in a significant increase in compliance regulations. Directive 9 addresses these concerns directly, placing the responsibility on Casps to ensure that crypto transactions do not enable money laundering, terrorism financing, or any other unlawful financial activities.

This includes the ‘ordering Casp’ (the service provider where the crypto sender maintains an account), the ‘recipient Casp’ (the provider receiving crypto assets from the ordering Casp for the customer), and any intermediary Casp (a provider that transmits and receives crypto assets on behalf of an ordering Casp, a recipient Casp, or another intermediary Casp).

Reasons for Casps to be vigilant

In October 2022, the Financial Sector Conduct Authority (FSCA) officially designated crypto assets as financial products, and in December 2022, Casps were integrated into South Africa’s regulatory framework as accountable institutions. As a result, these service providers are now obligated to comply with the Financial Intelligence Centre Act (Fica) regulations to remain within the law.

Casps are responsible for performing customer due diligence and verifying a customer’s identity before processing transactions. This obligation is crucial, as the nature of crypto assets allows for rapid and seamless cross-border money transfers, making it difficult to identify those behind transactions and exposing them to potential criminal misuse.

To avoid financial penalties and safeguard their reputation, Casps should establish comprehensive governance and compliance protocols, which may include real-time checks against global watchlists, live customer verification through video calls, and advanced biometric identification (requiring users to blink, smile, or perform specific movements during the scanning process). However, the verification process does not conclude upon customer approval.

Casps should regularly monitor transactions for unusual patterns and behaviors that could suggest illicit activities. These regulatory mandates require Casps to maintain more detailed records of client transactions and develop robust risk assessment frameworks to evaluate customer risk from the onboarding stage onward. For instance, external factors such as geopolitical events may prompt certain individuals or groups to use crypto for funding illegal activities, as these transactions are often more challenging to trace than traditional banking methods.

As part of their risk assessment measures, Casps should clearly outline the circumstances under which a cross-border crypto asset transfer may be denied or delayed, along with the necessary follow-up actions in such cases.

While many support this directive, concerns have emerged about the substantial privacy governance challenges introduced by the travel rule. The Protection of Personal Information Act (POPIA) restricts the transfer of personal data outside South Africa, yet the global nature of crypto transactions may necessitate sharing personal information with entities in countries that do not enforce robust privacy protections. Moreover, POPIA stipulates that only data essential for completing a transaction should be collected and processed, potentially conflicting with the travel rule’s requirements.

As more initiatives are implemented to ensure the crypto industry operates within regulated frameworks, both Casps and other financial entities require comprehensive support to keep up with evolving compliance mandates and minimize operational risks.

VOCA, powered by SearchWorks, has been designed to comply with Fica, AML, CFT, FATF, and POPIA regulations, making it an ideal solution to ensure that compliance with the travel rule aligns with other legal obligations. This automated compliance platform aims to assist businesses in efficiently meeting governance standards by integrating real-time identity validations, risk assessments, and transaction monitoring to combat fraud, money laundering, and regulatory violations.

A notable new feature of VOCA is its ongoing monitoring capability, which tracks client profiles daily and alerts users to any changes that may indicate compliance risks. Additionally, VOCA’s automated reporting ensures that any suspicious activities are documented and reported in accordance with regulatory authorities’ requirements.

The introduction of Directive 9 marks a significant transformation in South Africa’s regulatory landscape for Casps. With non-compliance now carrying the risk of administrative penalties under Fica, Casps must act swiftly to adhere to these new obligations.

Sameer Kumandan, MD of SearchWorks.

Follow Moneyweb’s in-depth finance and business news on WhatsApp here.