Blockchain & Web3 Development Company in Johannesburg

The Financial Sector Conduct Authority declared crypto assets a financial product on 19 October 2022 under the Financial Advisory and Intermediary Services Act, and from 1 June 2023 any Crypto Asset Service Provider (CASP) providing advice or intermediary services in South Africa must hold a Category I or Category II FSP license. The FSCA published Joint Standards with the Prudential Authority (SARB) covering fit-and-proper requirements, capital, segregation of client assets, conflicts of interest, complaints, and operational resilience. The FATF Travel Rule (Recommendation 16) is implemented via FICA amendments, and beneficial-ownership rules from the General Laws Amendment Act 2022 (passed under FATF grey-listing pressure) apply. We classify every build under CASP early, structure the entity (FSP holder, juristic representative, key individual) appropriately, and coordinate with your FSP compliance officer rather than guessing at the perimeter.

A scoped Web3 proof of concept (CASP-aligned exchange prototype, mining-provenance pilot, R3 Corda tokenized-bond demo) at Johannesburg rates runs ZAR 400,000 to 1.2M (roughly USD 21,000 to 63,000) over eight to twelve weeks, including FSCA classification, internal security review, and a hosted demo against your sandbox. Production platforms (CASP-licensable exchange, full mining-provenance on Hyperledger Fabric, JSE-aligned tokenized securities) typically land at ZAR 2M to 6M (USD 105,000 to 315,000) including external audit by Quantstamp, Hacken, or Halborn, AML/CFT integration with Chainalysis or TRM, and SARB Joint Standard 2 cybersecurity hardening. Full bank-grade tokenization stacks or VASP-scale exchanges range from ZAR 8M to 25M (USD 420,000 to 1.3M). We quote fixed-fee in both ZAR and USD, with USD held flat against Rand volatility so CAC and budget hold their meaning over a 12-month build.

Yes. SARB Joint Standard 1 (Outsourcing by Banks and Insurers) governs the institutional risk framework when a regulated financial institution outsources to a third party including blockchain infrastructure providers. We build the engagement so it sits cleanly within the institution's outsourcing register: documented risk assessment, material outsourcing notification to the Prudential Authority where required, exit and contingency plan, audit rights, and SLA structure aligned to the institution's risk appetite. SARB Joint Standard 2 (Cybersecurity and Cyber Resilience) imposes board-level cyber-governance, threat-led penetration testing, third-party risk management, incident reporting (to SARB within 24 hours of a material event), and cyber-resilience testing aligned to TIBER-EU style methodology. We have shipped against both standards inside the JSE-listed bank cluster.

Yes. South Africa's gold, platinum-group-metal (PGM), and diamond producers face increasing ESG and regulatory pressure from LBMA Responsible Gold, LPPM PGM, the EU Conflict Minerals Regulation, and the OECD Due Diligence Guidance, plus from LSE, JSE, and TSX-V listed offtakers demanding chain-of-custody attestation. We build provenance on Hyperledger Fabric or Ethereum-anchored permissioned chains, tying assay data, smelter records, refiner attestations, and shipping documents into an auditable chain. The De Beers Tracr platform (an Anglo American initiative) is the benchmark in diamond provenance, and we will not pretend to out-engineer Tracr where it already operates; for greenfield gold-royalty tokenization, Sibanye-Stillwater PGM provenance, and Impala Platinum chain-of-custody work, we deliver against the same standard. Royalty tokenization for project finance unlocks pre-payment from offtakers at materially better rates than uncollateralised paper.

The Johannesburg Stock Exchange has publicly explored equity and bond tokenization through its Strate Central Securities Depository and through partnerships with international tokenization platforms. The FSCA, SARB, and JSE coordinate on the regulatory pathway, and Standard Bank, FirstRand, Absa, and Nedbank have all run R3 Corda PoCs on tokenized money-market instruments, trade finance, and corporate bonds. Production-scale tokenized listings on the JSE remain at the pilot and regulatory-engagement stage, not in routine retail trading. We build PoCs and pilot platforms aligned to the JSE's published tokenization research, structure the legal wrapper with your securities counsel, and we will tell you when a use case will not survive FSCA and JSE review rather than burn 18 months on a fundable-looking dead end.

POPIA (Protection of Personal Information Act 4 of 2013, fully enforced from 1 July 2021, supervised by the Information Regulator) applies to any platform processing personal data of South African data subjects, including KYC on an exchange or beneficial-owner records on a tokenized-asset registry. We file a POPIA Section 22 risk assessment, document Section 72 cross-border transfers (e.g. KYC analytics on a US-hosted Chainalysis instance) under one of the eight lawful bases, build subject access and erasure flows that handle on-chain immutability versus off-chain mutability, and register Information Officers where required. FICA, as amended in 2022 under FATF grey-listing pressure, brings CASPs into scope for AML/CFT, beneficial-ownership transparency, and suspicious-transaction reporting to the Financial Intelligence Centre. Our default architecture separates on-chain settlement from off-chain personal data so neither POPIA nor FICA undermines the other.

Materially. FATF grey-listed South Africa in February 2023 for strategic deficiencies in AML/CFT effectiveness, particularly around beneficial ownership transparency and prosecution of complex money-laundering cases. The country has been working through a FATF action plan, with material progress acknowledged through 2024 and 2025. For blockchain projects, the practical impact is heightened due diligence by international correspondent banks, more aggressive FICA enforcement, expanded beneficial-ownership disclosure under the General Laws Amendment Act 2022, and tightened FATF Travel Rule (Recommendation 16) implementation. We build every project assuming grey-listing-era scrutiny: Chainalysis KYT or TRM Labs screening, granular Travel Rule data exchange, and full beneficial-ownership chain documented in the system of record, not just in a paper file.

Standard Bank, FirstRand (FNB/RMB), Absa, and Nedbank have all run multiple R3 Corda PoCs, including the SARB Project Khokha series on tokenized money-market instruments and interbank settlement. Corda's permissioned, point-to-point messaging architecture maps more cleanly to FSCA, SARB, and bank-internal risk controls than a public-chain MEV-exposed Ethereum mainnet does, particularly for instruments that are not intended to be permissionless or retail-tradeable. For retail and consumer-facing flows (stablecoin remittance, tokenized loyalty, public equity tokenization where retail access is the point) we still default to Ethereum, Polygon, Base, or Solana. We will not ship Corda for a use case that genuinely benefits from public-chain composability, and we will not ship public-chain for a bank consortium that needs Corda's privacy model.