Blockchain & Web3 Development Company in Cape Town

A scoped FSCA Crypto Asset FSP licensing and compliance design for a Cape Town exchange or CASP runs ZAR 380,000 to ZAR 900,000 (roughly USD 20,000 to USD 48,000) over six to twelve weeks, covering Cat I or Cat II application drafting support, FIC Schedule 3 programme design, travel rule integration plan, and a tech architecture. A production exchange MVP with regulated custody (Fireblocks or BitGo), KYC and AML stacks (Sumsub plus Chainalysis), and ZAR rails through Mercantile, Standard Bank, or FNB typically lands at ZAR 4.5M to ZAR 12M (USD 240,000 to USD 645,000). Full institutional-grade exchanges with derivatives, market making, and SARS reporting range from ZAR 14M to ZAR 38M (USD 750,000 to USD 2M). We invoice in ZAR for South African entities and offer USD escrow for offshore parents.

In October 2022 the FSCA gazetted the Declaration of Crypto Assets as a Financial Product under the Financial Advisory and Intermediary Services Act (FAIS), bringing crypto asset service providers (CASPs) into the FSP licensing regime. Anyone in South Africa providing financial services in respect of crypto assets, including advice and intermediary services around buying, selling, holding, or transferring crypto, requires FSP licensing as a Category I or Category II FSP. The transitional licensing window closed in late 2023 and the FSCA has been processing applications since. Our discovery produces the licensing pathway analysis, the operational ability and financial soundness documentation, the compliance officer mandate, and the supporting policies (TCF, complaints, AML) the FSCA examines.

South Africa added CASPs to FIC Schedule 3 (Accountable Institutions) in December 2022, which triggers full FICA obligations including customer due diligence, enhanced due diligence on high-risk customers, transaction monitoring, suspicious transaction reporting through goAML, and the FATF Recommendation 16 travel rule. We integrate Notabene, Sumsub Travel Rule, or the TRP (Travel Rule Protocol) network depending on counterparty coverage, default to a R5,000 threshold for travel rule data exchange aligned with FIC public consultations, and ship transaction monitoring on Chainalysis KYT, TRM, or Elliptic with rules tuned for South African typology (high-risk jurisdictions, mixer exposure, sanctions matches). All STRs route through the FIC goAML portal with the templated narratives the regulator now expects.

Yes. Our audit process covers Solidity (and Vyper where used), with static analysis through Slither and Mythril, custom rule sets in Semgrep, fuzzing through Foundry and Echidna, and symbolic execution on critical paths. For high-value protocols (tokenisation issuers, stablecoin rails, large DeFi deployments) we add formal verification on invariants with Certora Prover or Halmos, particularly around access control, balance accounting, and oracle dependence. Every audit ships with a public-style report (whether published or not, the artefact reads like one), a remediation plan with severity ratings on the SCSVS scale, and a post-deploy monitoring spec for Forta or Tenderly Alerts. We have audited tokenisation contracts, ERC-20 stablecoins, and bridge components, and we will name prior work under NDA on call.

SARB has run Project Khokha (wholesale tokenised settlement on permissioned DLT) and Project Khokha 2, exploring tokenised debentures, payments, and intraday liquidity on a multi-bank network. SARB and the IFWG (Intergovernmental Fintech Working Group) have signalled that a retail CBDC (digital rand) is under active study but no firm launch commitment exists. On the regulatory side, SARB enforces exchange control through SARB ExCon directives, which restrict South African residents from moving capital offshore via crypto without using the single discretionary allowance or the foreign investment allowance with SARS tax clearance. We design CASP onboarding flows that surface these limits at deposit and withdrawal time and that integrate with the FinSurv reporting CASPs are now expected to support under SARB and FIC coordination.

Yes. We have designed tokenisation frameworks for property, agricultural commodities, money market funds, and trade finance receivables in the South African context. Standard architecture uses ERC-3643 or an in-house permissioned token contract for identity-gated transfer (KYC required on both sender and receiver before transfer settles), Chainlink Proof of Reserve or attestation oracles for off-chain asset backing, and a custodian or escrow agent with FSCA authorisation for the underlying asset. Distribution typically runs through an FSCA Cat II FSP wrapper for retail or accredited offering, with the SARS tax treatment documented up front (CGT on disposal for crypto-classified tokens, dividend or interest treatment for security-token classifications). We coordinate with FSCA-recognised legal counsel on the prospectus or exemption pathway.

We default to Fireblocks for institutional MPC custody, BitGo for hot and cold wallet segregation with insurance, Anchorage for OCC-aligned (US national trust) custody where US institutional flow matters, and Copper for prime brokerage style flows. Hot wallet policy caps daily withdrawal exposure (typically 2 to 5 percent of total custody by asset), warm wallets handle settlement, and deep cold storage holds the balance under Shamir secret sharing or multi-sig with documented quorum and incident escalation. FSCA examination expects clear segregation of customer assets from CASP house assets, including separate addresses and on-chain attestation. We ship Merkle-tree proof of reserve in the style of Kraken and post-Binance industry practice on a documented cadence, alongside the audited financial statements.

POPIA classifies KYC documentation, transaction history, and wallet metadata as personal information, with biometric data (selfie liveness, ID document verification) as special personal information requiring explicit consent. We default to South African residency on KYC artefacts through Sumsub South Africa region, Onfido EU with documented Section 72 safeguards, or in-house storage on AWS af-south-1 and Azure South Africa West. Chain analytics through Chainalysis, TRM, and Elliptic typically processes wallet addresses (pseudonymous) without exporting personal identifiers, which simplifies the cross-border position. Breach response under POPIA Section 22 requires notification to the Information Regulator and affected data subjects, and our incident playbook includes the templated notification, the goAML STR if AML-relevant, and the customer communications that survive Twitter and journalist scrutiny on the worst day.