The Deadline Treasury Could Not Agree On
On 17 April 2026, the National Treasury and the South African Reserve Bank jointly published the Draft Capital Flow Management Regulations under the Currency and Exchanges Act of 1933 — the statute that has governed foreign-exchange flows out of South Africa for almost a century. The draft would replace the 1961 Exchange Control Regulations and, for the first time, treat crypto assets as a category of capital subject to authorisation.
The deadline for public comment is the first thing that breaks. The Gazette notice itself sets a 30-day window closing 18 May. The accompanying Treasury and SARB press releases say 10 June. ENS Africa identified the contradiction and updated its own analysis to 18 May; the firm's view is that the Gazette is the legally operative document. Treasury has also published two different submission email addresses across its materials.
This is not pedantry. The draft would criminalise undeclared crypto positions, with penalties up to ZAR 1 million or five years' imprisonment, and it grants border officers powers to compel production of any device or data facilitating crypto transfer. A regulator that cannot agree with itself on when public input ends is signalling how much of that input it intends to absorb.
What the Draft Actually Does
Three operative requirements sit at the centre of the draft, each contingent on a numerical threshold the Finance Minister has not yet set.
First, any transaction to buy, sell, lend, or transfer crypto above the threshold requires National Treasury authorisation — including transactions in which both counterparties sit inside South Africa. The exchange-control framework historically applied only to foreign flows; the draft extends its reach into purely domestic activity for the first time.
Second, persons in the Republic must declare crypto assets to Treasury within 30 days of acquiring control, possession, or the right to sell or transfer them. The obligation runs on a rolling basis from acquisition rather than as a one-time legacy disclosure, which means it captures both existing holdings at the date the regulations come into force and every subsequent on-chain movement that meets the definition.
Third, transactions routed through licensed crypto-asset service providers must carry a stated purpose at the point of approval. Using the asset for any purpose other than the one declared triggers a mandatory sale — to Treasury, to an authorised dealer, or to another licensed provider at market-related prices. The framework does not extinguish the asset; it extinguishes the holder's discretion over what to do with it.
The regime supplements rather than replaces the FAIS and FICA architecture built since October 2022. As of December 2025, the Financial Sector Conduct Authority had received 512 CASP licence applications and approved 300. Those operators spent two years onboarding on the understanding that licensure was the regulatory destination. The new draft is a second perimeter built on top of the first.
Luno Has the Most to Lose
Luno is the largest licensed crypto-asset service provider operating in South Africa, and it has been the most public voice against the draft. Marius Reitz, its General Manager for Africa and Europe, told TechCentral on 27 April that the current draft would stall South Africa's momentum as a global fintech leader.
The company's substantive asks are concrete. Crypto held by South African residents on locally licensed CASPs should be designated as onshore rather than treated as a capital export. The comment window should be extended. The threshold must be defined in the regulations themselves, before they take force, rather than left to subsequent ministerial determination — operators cannot run compliance against a number they do not have.
VALR, the largest local competitor, has filed a parallel position. The CASP industry is unusually unified here because the cost of the draft is structural rather than commercial. The framework retroactively reframes the customers these exchanges spent two years onboarding as capital exporters whose holdings are subject to authorisation regardless of where the counterparty sits. That reframing — not the threshold, not the declaration window — is the load-bearing argument Luno will be making over the next three weeks.
The Malaysia Read-Across
Luno's position in South Africa is amplified by where else it operates. On 4 June 2019, Malaysia's Securities Commission granted conditional approval to three Recognised Market Operators to run digital asset exchanges: Luno, SINEGY, and Tokenize. That cohort defined the country's regulated DAX market for its first three years; the SC's current registry has since expanded to six. Luno is the only operator with deep regulatory experience in both an SC-disciplined capital-markets regime and the exchange-control regime South Africa is now proposing.
Malaysia is moving in the opposite direction. The SC's Public Consultation Paper 3/2025, open from 30 June to 11 August 2025, proposed liberalising DAX listing — removing the requirement for direct SC concurrence on assets that meet a published minimum criteria — while raising operational standards through a 90 percent cold-storage requirement and strengthened financial and competency rules. Bank Negara Malaysia's commentary on cryptocurrencies in 2025 has stayed within AML, counter-terrorism financing, and financial-stability lanes; it has not proposed exchange-control gating of crypto flows, and there is no indication in current consultation pipelines that it intends to.
The read-across, then, is not that Kuala Lumpur is about to copy Cape Town. It is that Luno is now a primary witness to two regulatory philosophies — one liberalising under capital-markets law, one tightening under exchange-control law — applied to the same operator. The submissions Luno files in South Africa over the next three weeks will be read closely by SC Malaysia and the broader DAX cohort as a working argument for why exchange-control logic should not be allowed to bleed into capital-markets regulation. That is the deeper stakes.
The Southeast Asian Precedent Already Exists
Indonesia is the closest live analogue in the region. Authority for crypto regulation transferred from Bappebti to the Otoritas Jasa Keuangan on 10 January 2025. Under SEOJK 15/2025, cross-border crypto movements above approximately IDR 100 million — roughly USD 6,500 — require special OJK approval. The structural logic is identical to what South Africa is proposing: a numerical threshold, a state authorisation gate, and a presumption that movements above the line are not retail conduct. Indonesia's threshold is set lower in the stack and narrower in scope, but the architecture is the same.
Singapore has not gone this route. The Monetary Authority of Singapore's June 2025 tightening of the Digital Token Service Provider regime focused on licensing scope and extraterritoriality rather than capital flows. Thailand's SEC has signalled concern about cross-border movements without proposing a formal authorisation framework. The regional pattern is divergent rather than coordinated, which means the precedent power of any one regulator's framework is unusually high.
If the South African draft becomes law substantially as drafted, it will be the most aggressive G20 implementation of capital-flow controls layered on top of a licensed crypto framework. The next round of OJK rulemaking will be the first test of whether that template travels east on its own merits, or whether the resistance from licensed operators in jurisdictions like South Africa is enough to keep capital-markets and exchange-control logic in separate regulatory boxes.
What to Watch
Three signals over the next sixty days will tell the rest of the story.
The deadline. Whether Treasury holds the 18 May Gazette deadline or quietly accepts comments through 10 June will indicate whether the discrepancy was a drafting error or an early concession to industry pressure. Either reading carries weight.
The threshold. The Finance Minister's eventual numerical figure is, in practice, the regulation. A high threshold renders the regime symbolic and aimed at large-scale capital flight; anything below the equivalent of USD 10,000 captures retail transactions wholesale and remakes the South African crypto market overnight.
The Luno filing. Whether Luno files only as a South African operator, or as a multi-jurisdiction DAX with a position on regulatory design that explicitly references its Malaysian, Indonesian, and European licences, will signal how the company plans to deploy its full regulatory standing in the South African debate. The submission will not stay inside South Africa.
Layer 7 Ventures is a research-driven firm focused on AI and cryptocurrency in Southeast Asia. Views expressed are those of the firm and do not constitute investment advice.
