Identity
A South African identity document, smart ID card or valid passport. The name on it must match the name on the bank account used for settlement, because that match is the point of the exercise.
Onboarding
What we have to ask,
What we have to ask,
and why.
A crypto asset service provider has to identify and verify you before it can trade with you. This page sets out exactly what Conexus asks for, the statute that requires each item, and what happens to it afterwards.
This page describes the South African requirements
South Africa is the market this desk has an office in, and its rules are the ones set out below in detail. Equivalent customer due diligence applies in every market the desk operates in: the statute changes from country to country, the obligation does not. Nowhere does this desk trade with a client it has not identified.
The legal basis
Why a desk has to ask.
Crypto asset service providers were added to the list of accountable institutions as Item 22 of Schedule 1 to the Financial Intelligence Centre Act, with effect from 19 December 2022. From that date a South African crypto desk carries the same core anti-money-laundering duties as a bank, an attorney holding trust money or a foreign exchange trader.
Four of those duties shape the onboarding you experience:
- Registration with the Financial Intelligence Centre through the goAML portal, so that reports can be filed and the institution is known to the regulator.
- A board-approved Risk Management and Compliance Programme under section 42, which is the written document setting out how the desk rates risk and what it does at each rating. Onboarding is not improvised per client; it follows that programme.
- Customer due diligence under section 21, which must be completed before a business relationship is established or a single transaction is concluded. This is the reason a firm quote follows onboarding rather than preceding it.
- Record keeping under sections 22 and 23 for five years.
Two consequences follow that are worth being blunt about. First, a desk offering to trade without identifying you is not being generous; it is operating unlawfully, and a desk willing to break that law is willing to break others with your money. Second, the desk cannot make an exception for you. Section 21 does not have a discretion clause.
Separately, crypto assets were declared a financial product under the FAIS Act by General Notice 1350 in Government Gazette 47334 of 19 October 2022, and the transitional exemption for unlicensed operators closed on 30 November 2023. Licensing details and register links are on the compliance page.
Individuals
What an individual client provides.
Four items, and a fifth if you are not a South African resident. Clear photographs are acceptable for most of it — nothing needs to be certified unless the desk says so after looking at it.
Proof of address, under three months old
A utility bill, municipal rates account, bank statement, short-term insurance schedule or a lease in your name. If the account is in a spouse’s or landlord’s name, an affidavit plus their document works — tell the trader up front rather than sending the wrong thing twice.
Source of funds evidence
Documents showing where the value being traded came from: payslips, an employment contract, audited financial statements, a sale agreement, a distribution notice, an exchange statement showing the acquisition, or a wallet history. What is needed scales with the size and the risk rating, not with the desk’s mood.
A bank account in your own name
A recent statement or a bank confirmation letter showing the account holder and number. Settlement goes to that account and no other, in either direction.
Non-residents: permit and foreign address
Passport, the visa or permit under which you are in South Africa, and proof of your address here or abroad. If you have recently relocated, say so — the exchange-control position is explained honestly rather than glossed over.
Companies, trusts and partnerships
What a business client provides.
The principle is that the desk must know the legal person, the natural people behind it, and the person instructing the trade. In practice that is six items.
| Item | What is required |
|---|---|
| CIPC registration documents | The registration certificate and the current CIPC disclosure showing directors, and the Memorandum of Incorporation where the structure is not standard. |
| Beneficial ownership above 25% | The identity documents of every natural person who ultimately owns or controls more than 25% of the entity, traced through holding companies and trusts until natural people are reached. |
| Directors’ identity | Identity documents for the directors, and for a trust, for the trustees, founder and named beneficiaries. |
| A mandate or resolution | A board resolution or written mandate authorising the specific person to instruct trades on the entity’s behalf, and specimen identification for that person. |
| Proof of business address | A utility account, lease or municipal account for the operating address, under three months old. |
| Bank confirmation | A bank confirmation letter or recent statement for the entity account used for settlement, in the entity’s registered name. |
Trusts and partnerships follow the same logic with different paperwork: the trust deed and letters of authority, or the partnership agreement, plus identification for the people who control it. Tell the trader the structure at the enquiry stage and the list is sent to you specific to it, rather than as a generic form. A company registered outside South Africa provides the equivalent documents from its own registry.
Risk rating
Enhanced due diligence, and when it applies.
Section 21 sets the baseline. Section 21A requires enhanced due diligence where the risk of money laundering or terrorist financing is higher than that baseline. The desk’s Risk Management and Compliance Programme sets the triggers; in practice they are:
- A ticket that is large relative to the profile the client has evidenced.
- A first transaction that does not fit the stated purpose of the relationship.
- A client, counterparty or wallet connected to a higher-risk jurisdiction.
- A wallet with screening exposure to a mixer, a sanctioned address, a darknet market or a known fraud cluster.
- A politically exposed person, their immediate family or a known close associate.
- Any structure that obscures who ultimately benefits from the trade.
- Reluctance to evidence source of funds, or evidence that does not reconcile.
Enhanced due diligence does not mean an interrogation. It means more documents, an explanation of the commercial rationale, and senior sign-off before the trade proceeds. It can also mean a decision not to proceed. The desk is allowed to decline a client and does not have to explain the decision in detail — but it will always tell you that it has declined, rather than leaving you waiting.
Politically exposed persons
South African law distinguishes domestic prominent influential persons from foreign prominent public officials, and extends screening to immediate family members and known close associates. Being a PEP is not an accusation and is not a bar to trading. It means senior approval, a documented view on source of wealth, and ongoing monitoring. Say so at the enquiry stage; it is far worse to be identified by a screening tool after documents are in.
Sanctions screening
Every client, every beneficial owner and every counterparty name is screened against the targeted financial sanctions lists South Africa is obliged to apply, including the United Nations Security Council consolidated list. A confirmed match freezes the transaction and triggers a report. A false positive — two people sharing a common name — is cleared with a date of birth or an identity number, usually within the hour.
Wallet and transaction screening
The addresses involved in a trade are screened before settlement, not after. If an inbound address carries exposure the desk cannot accept, you will be told before you send. This is one of the practical reasons to send the address to the trader and wait for confirmation rather than transferring first and asking later.
Two different questions
Source of funds is not source of wealth.
These are asked for different reasons and answered with different documents. Clients conflate them constantly, then feel they are being asked the same thing twice.
| Source of funds | Source of wealth | |
|---|---|---|
| The question | Where did the specific value in this trade come from? | How did you come to have wealth at all? |
| Typical evidence | Exchange statement showing the purchase, a bank statement, a sale agreement, a wallet history for the specific coins | Employment history, business ownership, audited statements, a sale of property or a business, an inheritance, a divorce settlement |
| When it is asked | On every trade, proportionate to size | On enhanced due diligence, on very large tickets, and for politically exposed persons |
| Why it matters to you | It is what allows the trade to conclude quickly | It is what allows the relationship to keep working as your ticket sizes grow |
Reporting and records
What is reported, what is kept, and for how long.
Record keeping — sections 22 and 23
Identification records and transaction records are retained for five years from the date the business relationship ends or the date the single transaction is concluded. The desk cannot delete them on request inside that period, and a request to erase your data under privacy law does not override a statutory retention duty. This is set out in the privacy policy, which also explains who inside the desk can see what.
Cash threshold reports — section 28
Cash transactions above R49 999.99 must be reported to the Financial Intelligence Centre. Conexus settles by bank transfer and does not run a cash service, so this is largely academic here — but it is the reason no trader will structure a payment to sit under a threshold, and the reason any request to do so ends the conversation. Deliberate structuring is itself an offence.
Suspicious and unusual transaction reports — section 29
There is no threshold. Where the desk knows or suspects that funds are the proceeds of unlawful activity, that a transaction is designed to avoid a reporting duty, or that a transaction has no apparent business purpose, a report must be filed within 15 days, excluding weekends and public holidays. Two things follow that clients should understand. The desk may not tell you that a report has been filed — tipping off is a separate offence. And filing a report is not an accusation; it is an obligation triggered by a suspicion, and the vast majority of trades never come near it.
The Travel Rule — FIC Directive 9 of 2024
Directive 9 of 2024 implements the FATF Travel Rule for crypto asset transfers and has been in force since 30 April 2025. It has no minimum threshold: originator and beneficiary information must accompany a transfer between institutions whatever the amount. In practice that means the desk collects and, where the counterparty is another institution, transmits the originator’s name, an identifier, and the beneficiary’s name and account or wallet reference. The FATF standard the directive implements has been adopted in most markets this desk deals with, so the same information travels with a transfer in either direction.
Below R5 000 a reduced information set applies and the ordering institution is not required to verify it. This is verification relief and not anonymity. The information is still collected, still recorded, still retained for five years and still available to the Financial Intelligence Centre. Anyone marketing sub-R5 000 transfers as private or untraceable is misrepresenting the directive, and that claim is a reliable signal to stop dealing with them.
Reduced information is not anonymity
Directive 9 of 2024 has no minimum threshold. Below R5 000 the ordering institution is relieved of the duty to verify certain details — but the details are still collected, recorded and retained. Any desk selling that as privacy is misleading you.
A rule with no exceptions
Why the desk will not accept a third-party payment.
Funds come from, and go to, an account in the verified client’s own name. Crypto assets are received from and returned to addresses the client has confirmed. A payment from your business into your personal trade, from a friend, from a relative, or from an employer is refused — and this is the single rule the desk is asked to bend most often.
It defeats the verification
The desk has verified you. It has not verified the person whose account the money came from, and their funds would enter the system on the strength of your documents.
It is the classic mule pattern
Money mule networks work precisely by having a verified individual receive value on behalf of someone who could not pass the checks. That is the pattern the FIC Act exists to interrupt.
It breaks your own audit trail
When a revenue authority or your bank asks why a large credit appeared, a chain that runs through a third party is the difference between a five-minute explanation and a formal query.
It exposes the payer
If a trade is later reversed or disputed, a third-party payer has no contract with the desk, no claim on the confirmation and no standing to complain.
If the trading party genuinely is a company, a trust or another person, then onboard that party. It takes an afternoon and it is the correct answer. If you are being asked by someone else to receive crypto assets or funds on their behalf, please read the scam warning page before you go further — that request is how most mule accounts begin.
What happens to your documents.
They are stored under access control, visible only to the traders and compliance staff who need them, and retained for the statutory five years. They are not sold, not used for marketing, and not shared except where a law compels disclosure — to the Financial Intelligence Centre, to a regulator exercising a statutory power, or under a court order. The detail, including your rights under the Protection of Personal Information Act and the contact for the information officer, is in the privacy policy.
Onboarding is done once. On later trades you will be asked to confirm that nothing material has changed, and to refresh a document that has aged out — most often the proof of address, which has to be under three months old at the time it is relied on.
Onboarding questions
No. Section 21 of the FIC Act requires customer due diligence before a single transaction is concluded, and Directive 9 of 2024 applies to crypto asset transfers with no minimum threshold. The reduced information tier below R5 000 relieves the ordering institution of the duty to verify certain details; it does not make the transfer anonymous and the information is still recorded and retained. No market this desk operates in offers an anonymous tier.
Usually under an hour once the documents are to hand, for a straightforward individual. A company with layered ownership, a trust, a politically exposed person or a case requiring enhanced due diligence takes longer, and the trader will tell you that at the start rather than let you sit waiting.
Usually not. Clear photographs or scans are accepted for most items. Certification is asked for only where a document is unclear, where a foreign document needs authentication, or where the risk rating calls for it.
Send an affidavit confirming that you live at the address together with their document, or use a bank statement, insurance schedule or lease that carries your own name. Ask the trader before you send, and it is resolved in one message instead of three.
Because the desk is required to understand the source of the funds involved in a transaction, proportionate to its size and risk. In practice an exchange statement showing the original purchase, or a wallet history, answers it. It is a documentation exercise, not a judgement about you.
The desk does not report individual trades to SARS as a matter of course. It does keep records for five years, it does report as the FIC Act requires, and South Africa adopted the OECD Crypto-Asset Reporting Framework from 1 March 2026, with the first return due to SARS by 31 May 2027. The safe assumption is that disposals are visible. The tax guide explains what to keep; a registered tax practitioner advises you on it.
The statutes cited here are South African, and they govern the desk itself. If you are onboarding from another market you will be asked for the same categories of evidence — identity, address, source of funds, and an account in your own name — because equivalent customer due diligence rules apply wherever the desk settles. The trader will tell you which documents your corridor requires before you send anything.
You will be told that the desk cannot proceed. The desk is not obliged to give detailed reasons, and in some circumstances it is prohibited from doing so. Anything already received from you is returned to the address or account it came from, less the network fee. You are not left guessing.
Related pages
The full process
What happens from enquiry to written confirmation, with a worked example and timings.
AML and KYC policy
The formal policy document behind everything described on this page.
Compliance
Licensing, registrations and the public registers where you can verify the desk yourself.
Get the exact list for your situation.
Tell a trader whether you are trading as an individual, a company or a trust, and the checklist that comes back is the one for your structure — not a generic form.
Investing in crypto assets may result in the loss of capital, as the value is variable and can go up as well as down. A crypto asset is not legal tender and is not a regulated deposit. Conexus Crypto provides an exchange service only and does not provide financial, investment or tax advice.