Briefing
The Financial Sector Conduct Authority (FSCA) of South Africa has issued a mandatory Information Request (RFI 2 of 2025) to all licensed Crypto Asset Service Providers (CASPs), a critical step that shifts the regulatory burden toward proactive, systemic data disclosure. This action immediately operationalizes the FSCA’s oversight by compelling granular reporting on business models, risk management, and Anti-Money Laundering/Counter-Financing of Terrorism (AML/CFT) controls, effectively creating a supervisory baseline for future conduct rules. The most important detail quantifying this change is the 89-question scope , which requires CASPs to report comprehensive data as of June 30, 2025, with a strict compliance deadline of December 5, 2025.
Context
Prior to this RFI, the primary regulatory step in South Africa was the declaration of crypto assets as a financial product in October 2022, which initiated the licensing regime for CASPs. This declaration established a legal perimeter, yet it left significant ambiguity regarding the operational expectations for risk management and the specific data required for effective supervision. This created a compliance challenge for firms needing to align their systems with an evolving, principles-based framework, as the lack of a comprehensive data set prevented the FSCA from moving from a licensing phase to a data-informed, risk-based supervisory phase.
Analysis
This RFI directly alters the operational requirements of a CASP’s compliance framework by demanding integration between legal compliance and core business systems. The 89-question survey acts as a de facto self-audit, forcing regulated entities to map their customer demographics, financial metrics, and cross-border activities directly to their AML/CFT controls, including the implementation of the FATF Travel Rule. The chain of cause and effect is clear → failure to produce verifiable data by the December 5 deadline constitutes an offense under the Financial Sector Regulation Act, making this a critical update that ties operational data integrity to legal viability. This mandate signals that CASPs must now function with the data rigor expected of traditional financial institutions.
Parameters
- Regulatory Instrument → Information Request 2 of 2025 (RFI)
- Question Count → 89 questions (The scope of the mandatory data submission)
- Data Reporting Date → June 30, 2025 (The date as of which all data must be provided)
- Submission Deadline → December 5, 2025 (The final date for RFI submission)
- Penalty Clause → Section 267 of the Financial Sector Regulation Act (The legal consequence for non-compliance)
Outlook
The data acquired through this RFI will serve as the foundational intelligence for the FSCA’s next phase of regulatory development, which will likely include more granular, prescriptive conduct and prudential standards. This proactive, data-driven approach by a major African jurisdiction sets a precedent for other emerging markets, demonstrating how to transition from a broad licensing regime to a robust, risk-based supervisory model. The immediate next phase is the FSCA’s analysis of the submitted data, which will directly inform the final shape of the South African digital asset legal framework.
Verdict
The FSCA’s mandatory RFI establishes a new, high-bar supervisory standard, requiring CASPs to immediately institutionalize their operational data and compliance controls to secure their long-term legal standing.
