A plain guide to which record to check for every crypto offer.

A discretionary mandate is what separates advice from control

When a provider says they will trade on your behalf, the law looks for a written discretionary mandate. Without that document, the provider is not allowed to decide which crypto to buy or sell, or when, even if you have told them your goals. The mandate must say who may act, over which assets, and under what limits.

Many offers describe a service where the client still clicks a button, but the provider has already set the parameters. That can still be discretionary management, because the provider has made the investment choices in advance. The client's click is an execution step, not a decision, and the law does not treat it as the client retaining control.

Ask for the mandate before you send money. If the provider cannot produce one, or says it is not needed for the size of your account, that is a sign the service is outside the licence category they hold. A licensed provider will have the mandate as part of their compliance file, and they will give you a copy.

Exchange control applies to the rand before it becomes crypto

The South African Reserve Bank looks at the movement of rand across the border, not at the crypto itself. If you use rands to buy crypto on an overseas exchange, or send rands to a foreign platform to trade, you are using your exchange control allowance. The crypto is then an offshore asset for exchange control purposes.

The allowance is per calendar year and per person, and it does not reset when you sell the crypto and bring rands back. If you use an intermediary who pools your rand with other clients' money before sending it offshore, the intermediary needs its own exchange control approval. Your personal allowance does not cover a pooled transfer.

Tax clearance is a separate step from exchange control, but the bank will ask for it above a set amount. The bank is not checking whether the investment is wise; it is checking that you have a tax compliance status that allows the transfer. That means you need the clearance before the money moves, not after the trade.

A licence does not follow the client's money

A crypto asset service provider licence covers the services the provider is allowed to offer, not the assets the client owns. If a licensed provider moves your crypto to an overseas exchange or a liquidity pool, your claim is against that provider, not against the overseas platform. The FSCA's register does not track where client assets end up.

Some providers use third-party custody or execution services. The licence does not make those third parties part of the provider's own compliance structure, and the FSCA does not approve them separately. The provider remains responsible for what happens to your crypto, but that responsibility is enforceable only through the provider's own legal entity, which may not have enough assets to cover a loss.

Before you transfer crypto to a provider, ask for the custody arrangement in writing. The answer should name the custodian, the jurisdiction, and whether the custodian is a separate legal entity. If the provider says the custodian is 'internal' but cannot show a separate audited entity, the client's crypto is likely held in the same pool as the provider's own assets, which changes the risk.

The FSCA's warnings are not the same as its register

The FSCA publishes warnings about specific unlicensed firms and about patterns like promised returns. Those warnings are not entries on the licensed provider register, and they do not mean the FSCA has investigated every fact about the firm. A warning can be based on a complaint, a self-reported advertisement, or a referral from another regulator.

A firm can be on the register and still be the subject of a warning, because the warning may concern a different service or a different legal entity under the same brand. The register lists the legal entity that holds the licence, not the trading name. If the warning names a trading name and the register lists a company number, you have to match them yourself.

The absence of a warning does not mean the FSCA has looked at the firm and found nothing. The FSCA does not pre-approve every advertisement or every product, and many offers circulate without the FSCA ever seeing them. The register is a list of who is allowed to act; the warnings are a list of what has been reported. Neither is a full picture of a firm's conduct.

The FSCA's crypto register does not vouch for a provider's solvency or conduct

A crypto asset service provider licence is not a seal of financial health. The FSCA checks whether an applicant meets fit and proper requirements and has the operational ability to comply with the Financial Sector Conduct Authority's standards, but it does not audit balance sheets or guarantee client funds. A provider can be licensed today and insolvent tomorrow, and the register will not flash a warning. The decision to place money with a provider remains a credit risk that no licence category removes.

The register also does not monitor every transaction a licensed provider makes. The FSCA's supervision is periodic and often reactive, triggered by complaints or market events rather than continuous oversight. A licensed provider can drift into conduct that breaks the law without the register changing at all. When the regulator eventually acts, it may suspend or withdraw a licence, but that action can come long after clients have lost money. The register is a starting point, not a live conduct score.

That is why the register's silence on a provider is not a clean bill. A licence confirms that the FSCA has accepted an application and imposed conditions, but it does not mean the provider's products are suitable for any particular client. A licensed discretionary manager can still put a client into assets that are too risky or too illiquid. The client must still ask for the mandate, the category and the risk disclosures, because the register will not say whether this provider is right for this client.