SA's new crypto and exchange control rules promise less red tape. They also prohibit almost everything.

Cross-border | Exchange control | Crypto

By Calvin Matsaure, Principal, Calford & Grey Advisory

How can both things be true?

How do you write a thirty-three-regulation document that promises a lighter touch on the first page and hard-wires permission-based control into almost every substantive clause that follows, and have both things be genuinely true at the same time?

The answer determines rather a lot about where South African cross-border fintech lives or dies between now and 2027. It is not in the text Treasury and the Reserve Bank published on Friday. It is in the notices that have not been drafted yet under Regulation 23 and Regulation 31. That is where the next twelve months of policy actually gets made. It is also the part of Friday's announcement that most commentary will walk straight past.

I want to unpack that, because I have been advocating for the policy shift this document embodies for a long time, and the shape it has actually taken surprised me.

The shift is real, and it is the right one

For years, the SA cross-border story has been the same one. A founder builds something sensible. A bank's Exchange Control desk chews through the file for six, nine, fifteen months. The founder's runway burns. Either the dispensation arrives just in time, or the business moves to Dubai, or it quietly dies.

The engine of all that friction was a regulatory philosophy baked into the 1961 Exchange Control Regulations: every cross-border capital movement is presumed impermissible until Treasury or an Authorised Dealer says otherwise. Everything was a permission. Every permission was a conversation. Every conversation took time.

The media statement accompanying the draft Capital Flow Management Regulations shifts that posture explicitly. Positive bias. Fewer transaction pre-approvals. Focus on reporting. Surveillance of high-impact and high-risk flows rather than gatekeeping of all flows. Alignment with the OECD and the FATF. Risk-based. Reporting-first.

Those are not small words. They are the philosophical concession that a lot of people working inside this market have been trying to land, in various tones of voice, since around 2019. I am on the record. I have made the argument at ADs, at sandbox tables, in client files, in rooms where it counted. The statement reads like a win for that argument.

Then you open the actual regulation.

The words in the statement and the words in the schedule

Regulation 2 opens: "No person, other than an authorised dealer, may buy or borrow any foreign currency or any gold... except with the permission of National Treasury."

Regulation 3, the crypto provision, opens with exactly the same sentence, swapping "authorised crypto asset service provider" in for "authorised dealer."

Regulation 4: "A person may not, except with the permission of the National Treasury or an authorised person..." and then a seven-paragraph list that covers almost every cross-border capital movement a normal human being might contemplate.

• Reg 2 prohibits any person other than an authorised dealer from buying or borrowing foreign currency or gold without Treasury's permission.

• Reg 3 mirrors Reg 2 for crypto, applying the same prohibition to authorised crypto asset service providers.

• Reg 4 contains a seven-paragraph prohibition list covering almost every cross-border capital movement a normal person might contemplate.

• Regs 12, 15 and 17 cover export of goods and capital, non-resident securities and issue of capital, all framed as prohibitions from which specific permissions must be sought.

• Reg 25(5) says that if crypto is forfeited, passwords, PINs and private keys must be handed over on written demand. That is a power the 1961 regime never had over cash.

The verbs in the media statement are permissive. The verbs in the schedule are prohibitory. This is not a drafting accident.

Where the positive bias actually lives

Here is the thing most people reading the regulation over coffee will miss. The permissive posture the media statement promises is not in the regulations themselves. It is deferred.

Lever 1: Regulation 23 - Class exemptions

Regulation 23 lets Treasury or an authorised person publish exemptions in the Gazette, for any person or class of persons, in respect of any transaction or category of transactions, with or without conditions, retrospectively if they feel like it.

Lever 2: Regulation 31 - Thresholds

Regulation 31 lets the Minister of Finance set threshold amounts by notice, below which the prohibition in the operative clause simply does not bite.

Those two provisions are where the lighter touch lives or does not. Generous thresholds plus broad class exemptions equals the positive-bias regime the media statement describes. Conservative thresholds plus narrow, case-by-case permissions equals the 1961 regime in new packaging with a R1 million penalty attached.

The regulation has given Treasury a single pair of levers that can dial the operational reality of the entire framework anywhere from actually modernised to same story, new stationery. Friday's publication did not pull those levers. It installed them.

The design observation: that is elegant policy design if you trust the hand on the dial. It is a single point of failure if you do not.

What this means if you are building something

If you are running a cross-border fintech, an aggregator, a remittance business, a crypto platform, a stablecoin rail or a treasury-and-payments stack that touches foreign exchange at any point, three things just changed and one thing did not.

What changed

• The philosophical ground has moved. For the first time since 1961, the stated policy of the SA state is that cross-border capital flows are a feature of a globally integrated economy to be managed through reporting and surveillance, not a threat to be contained through permissions.

• The penalty environment got sharper: R1 million per offence, or the value of the money involved, whichever is greater; director disqualification; administrative sanctions; and a new forfeiture-and-attachment toolkit in Regulations 24 to 26.

• Crypto is inside the tent. It now has a named category, a licensing pathway as an authorised crypto asset service provider, and a statutory basis for cross-border oversight. That is the foundation anything interesting in stablecoin settlement is going to sit on.

What did not change

Every founder, every adviser, every Exchange Control head inside an AD still has to land their case at the manual-and-exemption layer. The regulation did not move the battle. It relocated the map.

The 18th of May is the story

Comments close on 18 May 2026. That window is not a procedural formality. It is a regulatory design moment.

Treasury has already decided to regulate cross-border capital flows this way. That fight is over. What Treasury has not decided, and what public comment can still shape, is how generous the exemption architecture under Regulation 23 and the threshold framework under Regulation 31 will be in practice. That is the real regulation. It has not been written yet.

Everyone who works this file should have a view, in writing, by 18 May. Not because Treasury counts submissions. Because when the exemption notices and threshold notices start rolling out over the following year, the people who shaped the intellectual ground under them will have leverage that the people who watched from the sidelines will not.

The bottom line

The media statement is the preface. The schedule is the chassis. The notices still to come are the car. Comment accordingly.

If you are building something that touches cross-border flow, a comment letter grounded in the Regulation 23 and Regulation 31 architecture, with specific threshold and class-exemption proposals, is the single highest-value regulatory move you can make this quarter.

Comments close: 18 May 2026.

Calvin Matsaure | Principal, Calford & Grey Advisory