How crypto exchange KYC works in South Africa

Direct answer

KYC (“know your customer”) at a South African crypto exchange is the identity check that the Financial Intelligence Centre Act — the FIC Act, usually called FICA — requires before an accountable institution may deal with you. Crypto asset service providers (CASPs) are listed as accountable institutions under item 22 of Schedule 1 to the FIC Act, so VALR, Luno, AltCoinTrader and Ovex must identify and verify every client. In practice that means a government-issued identity document, usually a selfie or live face check, in most cases a proof of address dated within three months, and at some platforms a tax number and a source-of-funds declaration. What you may do before verification, and how much you may withdraw afterwards, is set by each platform’s verification levels, and those levels differ more than most people expect.

Who this guide is for

South African residents opening a first exchange account, and existing users trying to work out why a withdrawal is capped or a document was sent back. It covers the four FSCA-licensed platforms in our South Africa data set: VALR (FSP 53308), Luno (FSP 53314), AltCoinTrader (FSP 53614) and Ovex (FSP 53922), all of which appear in Section A of the FSCA’s December 2025 list of licensed crypto asset service providers. It does not cover business accounts or platforms without a South African entity.

The legal background: FICA, the FIC and the FSCA

Two regulators sit behind the checks.

The Financial Intelligence Centre (FIC) administers the FIC Act. Its guidance on item 22, Public Compliance Communication 57 (issued 3 July 2023), defines a CASP as a person who, for clients, exchanges crypto assets for fiat currency or vice versa, exchanges one crypto asset for another, transfers crypto assets between addresses, safekeeps crypto assets, or provides financial services for an issuer’s offer of a crypto asset. Any business established, registered, incorporated or licensed in South Africa to do these things is required to register with the FIC as a CASP. The FIC’s compliance page states that accountable institutions must register within 90 days of commencing business, that all accountable institutions must identify and verify their clients, that the level of identification and verification is determined in line with the client’s risk profile, and that client and transaction records must be kept for at least five years after the business relationship ends.

PCC 57 goes further for crypto because clients and platforms rarely meet face to face. It encourages CASPs to collect additional identification data — device identifiers, IP addresses, geolocation, browser and operating-system details, all linked wallet addresses and a client-provided photograph — to monitor every crypto transaction, including crypto-to-crypto swaps, for suspicious activity, and to treat transfers to non-custodial wallets as higher risk that may justify enhanced due diligence. That is why a selfie is normal, and why sending coins to a self-custody wallet can prompt extra questions.

The Financial Sector Conduct Authority (FSCA) licenses CASPs as financial services providers under the FAIS Act. It began accepting applications on 1 June 2023 and, as at 12 December 2025, had received 512 applications, approved 300 and declined 14. The FSCA’s 15 December 2025 press release also confirms that it supervises licensed CASPs’ anti-money-laundering, counter-terrorist-financing and counter-proliferation-financing compliance under the FIC Act, and that its 2025 inspections focused on exactly those controls. A licensed platform’s KYC process is therefore inspected, not optional.

What each platform asks for

The requirements below come from each platform’s official verification pages, read on 6 September 2026. Requirements change; confirm on the platform before you upload anything.

VALR

VALR has three levels. Semi-verified (name, surname, verified e-mail and mobile number) cannot deposit or trade. Fully-verified requires a government-issued ID — a South African ID card or book, passport or driver’s licence — plus your tax information, and unlocks crypto and rand deposits and trading with a crypto withdrawal limit of 0.2 BTC (or the equivalent in other coins) per day. Fully-verified PLUS adds two-factor authentication through an authenticator app and lifts the crypto withdrawal limit to 100 BTC per day. Rand must come from, and go back to, a South African bank account in your own name. No proof-of-address requirement is printed on the verification pages we read, so whether one is requested case by case is unknown.

Luno

Luno accepts a South African national ID card (front and back), ID book, driver’s licence or valid passport; temporary identity documents are not accepted. A colour selfie may be requested. A proof of residential address must show your full name matching the ID, your residential address and a date of issue not older than three months; Luno’s accepted list includes utility bills, bank statements, municipal rates, telephone or mobile accounts, lease agreements, insurance and investment statements, and an affidavit with supporting documents. Limits scale with three levels: Level 1 allows R15,000 in deposits and R15,000 in withdrawals over the life of the account; Level 2 allows R50,000 in deposits and R50,000 in withdrawals per month; fully verified accounts have no limits. Luno states that identity is usually checked automatically within minutes, but that a manual check can take a day or two. Luno (Pty) Ltd publishes its FIC registration number, AI/130605/00024, on its licences page.

AltCoinTrader

AltCoinTrader lets you deposit and trade before full verification; withdrawals are what FICA gates. Level 1 (registered, cellphone verified, ID number entered) allows a once-off R100 withdrawal only. Level 2 requires the FICA documents: proof of identity (South African ID book or card, South African or foreign passport, or an asylum seeker permit), proof of residence (mostly under three months old), a colour selfie holding your ID next to your face together with a handwritten note giving “AltCoinTrader.co.za”, the date and the reason for verification, a verified cellphone number and a completed profile. Level 2 raises the limit to R200,000 per 24 hours. Level 3, which requires two-factor authentication to have been active for a month, allows R1,000,000 per 24 hours. Level 4 limits are not published. The help centre gives no processing time; it asks you to watch your e-mail.

Ovex

Ovex is the strictest of the four on timing: full verification (its Level 3) is required before any deposit, withdrawal or trade. It involves real-time capture of a physical ID document with facial recognition, a recent proof of address (bank statement, council bill, credit-card statement, lease agreement, phone bill, utility bill or tax return), and your ID number, date of birth, source of funds, tax number and phone number. Unverified accounts carry a USD 300 lifetime withdrawal limit, and a Level 4 tier applies automatically above USD 3,000,000. Ovex does not publish a processing time.

How the levels change what you can do

Three patterns emerge. VALR and Ovex allow nothing meaningful until an ID has been verified, so plan to finish verification before you send any rand. AltCoinTrader lets money in and lets you trade first, but caps withdrawals at R100 until the documents are approved, which suits people who want to look around before uploading anything and catches out anyone who deposits expecting to withdraw the same day. Luno grades rand limits by level, so a small first purchase can go through on Level 1 while the proof of address is still pending, but anyone planning to move more than R15,000 in total needs Level 2 or full verification from the start.

Two rules apply everywhere: the platform matches your identity to a South African bank account in your own name for rand withdrawals (VALR, Luno and Ovex state this explicitly), and crypto withdrawal limits sit above trading limits, so being able to buy does not mean being able to move coins off the platform without further checks.

Cost assumptions

None of the verification pages we read lists a charge for verification itself. The costs that follow verification are trading and funding fees, which differ by platform. As a labelled assumption: a first R5,000 taker order on a rand pair costs R5,000 × 0.35 % = R17.50 on VALR (Tier 1 fiat-quoted rate) and R5,000 × 0.60 % = R30.00 on Luno or AltCoinTrader at their Tier 1 taker rates; AltCoinTrader also charges 0.5 % on the EFT deposit, another R25.00 on R5,000. Ovex charges 0 % on its instant quotes and recovers its cost in the spread, which you must compare yourself. Actual fees depend on your volume tier and the pair you trade.

Why applications stall

Platforms do not publish rejection statistics, so the following is general guidance drawn from the published requirements rather than a claim about any one exchange. Verification typically stalls when a document is temporary or expired (Luno explicitly rejects temporary South African IDs), when a proof of address is older than the three-month window, when the name on a bank account or address document does not match the ID, when a photograph is cropped, blurred or missing the back of the card where both sides are required, or when selfie instructions such as AltCoinTrader’s handwritten note are not followed. PCC 57 also lists the use of multiple accounts by the same person and transaction values inconsistent with declared income as red flags, so opening a second account to work around a limit is likely to slow both down rather than help.

Privacy considerations

Handing over an ID, a selfie and a bank statement is a real disclosure, and the FIC Act shapes what happens next. Records must be kept for at least five years after the relationship ends, and PCC 57 encourages CASPs to retain device, IP, geolocation and wallet-address data alongside the documents. Tax is the other channel: SARS states that normal income tax rules apply to crypto assets, that the onus is on taxpayers to declare crypto gains or losses, and that its collection powers include requiring third-party service providers to submit financial data. VALR and Ovex both ask for a tax number during verification. Practical steps are to read the platform’s privacy policy before uploading, to submit documents only through the platform’s own app or website (never by e-mail to an address you did not initiate), and to switch on two-factor authentication as soon as the account exists, since two of the four platforms tie higher limits to it anyway.

Risks

The FSCA warns that any institution or person conducting CASP activities without a licence faces enforcement action, and 14 applications had been declined by December 2025. A platform that asks for FICA documents is not automatically licensed; check its FSP number against the FSCA list before you upload anything. Phishing that imitates a “re-verification” request is a known pattern for exactly this reason. Limits and document lists on this page are a dated snapshot and can change without notice, and crypto assets themselves remain unregulated as currency: the FSCA’s release repeats that the South African Reserve Bank does not recognise crypto assets as currency.

Next steps

If you are still choosing a platform, our guide on how to choose a crypto exchange in South Africa sets out the licence, funding and fee checks that come before KYC. To confirm a platform’s licence, see FSCA-licensed crypto exchanges in South Africa. Once verified, the practical follow-on is how to withdraw crypto to a South African bank account, and the exchange finder filters the same four platforms by deposit method and verification status.