How crypto exchange KYC works in South Africa

Who this guide is for

South African residents opening a first exchange account, and existing users trying to work out why a withdrawal is capped or a document was sent back. It covers the four FSCA-licensed platforms in our South Africa data set: VALR (FSP 53308), Luno (FSP 53314), AltCoinTrader (FSP 53614) and Ovex (FSP 53922). All four appear in Section A of the FSCA’s March 2026 list of licensed crypto asset service providers. It does not cover business accounts or platforms without a South African entity.

Verification at a glance

The legal background: FICA, the FIC and the FSCA

Two regulators sit behind the checks.

The Financial Intelligence Centre (FIC) administers the FIC Act. Its guidance on item 22, Public Compliance Communication 57 (issued 3 July 2023), defines a CASP as a person who does any of the following for clients:

• exchanges crypto assets for fiat currency or vice versa;
• exchanges one crypto asset for another;
• transfers crypto assets between addresses;
• safekeeps crypto assets;
• provides financial services for an issuer’s offer of a crypto asset.

Any business established, registered, incorporated or licensed in South Africa to do these things is required to register with the FIC as a CASP. The FIC’s compliance page sets four duties for accountable institutions:

• register within 90 days of commencing business;
• identify and verify their clients;
• set the level of identification and verification in line with the client’s risk profile;
• keep client and transaction records for at least five years after the business relationship ends.

PCC 57 goes further for crypto because clients and platforms rarely meet face to face. It encourages CASPs to collect additional identification data: device identifiers, IP addresses, geolocation, browser and operating-system details, all linked wallet addresses and a client-provided photograph. It also encourages them to monitor every crypto transaction, including crypto-to-crypto swaps, for suspicious activity, and to treat transfers to non-custodial wallets as higher risk that may justify enhanced due diligence. That is why a selfie is normal, and why sending coins to a self-custody wallet can prompt extra questions.

The Financial Sector Conduct Authority (FSCA) licenses CASPs as financial services providers under the FAIS Act. It began accepting applications on 1 June 2023 and, as at 31 March 2026, had received 533 applications, approved 310 and declined 17, according to its press release of 15 April 2026. Its 15 December 2025 press release confirms that it supervises licensed CASPs’ anti-money-laundering, counter-terrorist-financing and counter-proliferation-financing compliance under the FIC Act, and that its 2025 inspections focused on exactly those controls. A licensed platform’s KYC process is therefore inspected, not optional.

What each platform asks for

The requirements below come from each platform’s official verification pages, read on 3 October 2026. Requirements change; confirm on the platform before you upload anything.

VALR

VALR has three levels. Semi-verified (name, surname, verified e-mail and mobile number) cannot deposit or trade. Fully-verified requires a government-issued ID (a South African ID card or book, passport or driver’s licence) plus your tax information. It unlocks crypto and rand deposits and trading, with a crypto withdrawal limit of 0.2 BTC (or the equivalent in other coins) per day. Fully-verified PLUS adds two-factor authentication through an authenticator app and lifts the crypto withdrawal limit to 100 BTC per day. Rand must come from, and go back to, a South African bank account in your own name. No proof-of-address requirement is printed on the verification pages we read, so whether one is requested case by case is unknown.

Luno

Luno accepts a South African national ID card (front and back), ID book, driver’s licence or valid passport; temporary identity documents are not accepted. A selfie may be requested. A proof of residential address must show your full name matching the ID, your residential address and a date of issue not older than three months. Luno’s accepted list includes utility bills, bank statements, municipal rates, telephone or mobile accounts, lease agreements, insurance and investment statements, and an affidavit with supporting documents. Limits scale with three levels. Level 1 allows R15,000 in deposits and R15,000 in withdrawals over the life of the account; Level 2 allows R50,000 in deposits and R50,000 in withdrawals per month; fully verified accounts have no limits. Luno states that most identities are checked automatically within a few minutes, but that a manual review can take a day or two. Luno (Pty) Ltd publishes its FIC registration number, AI/130605/00024, on its licences page.

AltCoinTrader

AltCoinTrader lets you deposit and trade before full verification; withdrawals are what FICA gates. Level 1 (registered, cellphone verified, ID number entered) allows R100 of withdrawals in total. Level 2 requires the FICA documents. They are proof of identity (South African ID book or card, South African or foreign passport, or an asylum seeker permit) and proof of residence (mostly under three months old). You also need a colour selfie holding your ID next to your face with a handwritten note giving “AltCoinTrader.co.za”, the date and the reason for verification, plus a verified cellphone number and a completed profile. Level 2 raises the limit to R200,000 per 24 hours. Level 3, which requires two-factor authentication to have been active for a month, allows R1,000,000 per 24 hours. Level 4 limits are not published. The help centre gives no processing time; it asks you to watch your e-mail.

Ovex

Ovex is the strictest of the four on timing: its verification-levels page says Levels 1 and 2 cannot deposit or withdraw, so full verification (its Level 3) comes before anything else. It involves real-time capture of a physical ID document with facial recognition and a recent proof of address (bank statement, council bill, credit-card statement, lease agreement, phone bill, utility bill or tax return). You also give your ID number, date of birth, source of funds, tax number and phone number. Ovex’s withdrawal FAQ, however, says unverified accounts may withdraw up to USD 300 in total, which conflicts with the levels page. A Level 4 tier applies automatically once you deposit or withdraw more than USD 3,000,000. Ovex does not publish a processing time.

How the levels change what you can do

Three patterns emerge. VALR and Ovex allow nothing meaningful until an ID has been verified, so plan to finish verification before you send any rand. AltCoinTrader lets money in and lets you trade first, but caps withdrawals at R100 until the documents are approved. That suits people who want to look around before uploading anything, and catches out anyone who deposits expecting to withdraw the same day. Luno grades rand limits by level, so a small first purchase can go through on Level 1 while the proof of address is still pending. Anyone planning to move more than R15,000 in total needs Level 2 or full verification from the start.

Two more rules matter. VALR, Luno and Ovex state that rand withdrawals go only to a South African bank account in your own name. Crypto withdrawal limits also sit above trading limits, so being able to buy does not mean being able to move coins off the platform without further checks.

Cost assumptions

None of the verification pages we read lists a charge for verification itself. The costs that follow verification are trading and funding fees, which differ by platform. As a labelled assumption, a first R5,000 taker order on a rand pair costs R5,000 × 0.35 % = R17.50 on VALR (Tier 1 fiat-quoted rate). At Luno or AltCoinTrader the Tier 1 taker rate gives R5,000 × 0.60 % = R30.00, and AltCoinTrader also charges 0.5 % on the EFT deposit, another R25.00 on R5,000. Ovex charges 0 % on its instant quotes and recovers its cost in the spread, which you must compare yourself. Actual fees depend on your volume tier and the pair you trade.

If your verification fails

None of the four platforms publishes rejection statistics or internal rejection codes, so the reasons below are each platform’s own published rules, read on 3 October 2026. A rule published by one platform is not assumed to apply to another. A withdrawal that was accepted but not paid out, or a deposit that has not reflected, is a different problem: see crypto withdrawal pending or crypto deposit not showing.

Start by naming the state, because each has its own fix. Rejected means the platform named, or implied, a defect in a document or photo: fix that defect and upload once. Pending means the platform has your documents and has not decided: wait, then follow up through its own channel instead of re-uploading. Luno is the only one of the four to give a review time (a day or two for a manual review), and AltCoinTrader says documents already pending block a new upload. Limit reached means verification succeeded at a level whose limit you have hit: the fix is the next level, not a new document.

For a rejection, check the document in this order:

1. Is it on that platform’s list, and current? A document one platform accepts may be missing from another’s list. Luno refuses temporary IDs, and VALR accepts only valid government-issued IDs.
2. Does the photo meet that platform’s rules? Look for colour, the original document, all four edges, both sides of a card where asked, and no blur, glare or edits.
3. Is the proof of address recent and in your name? The maximum age differs by platform (second table), and Luno refuses one in a name other than the one on your ID.
4. Were the selfie instructions followed? AltCoinTrader wants your ID held next to your face with a handwritten note. Ovex captures your face live, so a camera problem can stop the check.

For a limit, check your level against the table at the top of this guide before contacting support. A VALR semi-verified account cannot deposit or trade at all, which is a level, not a failed check. Luno counts its limits over rolling 30-day periods, so a monthly limit does not reset on the first of the month. AltCoinTrader’s Level 4 is arranged through support.

At AltCoinTrader, a failed or pending FICA check shows up as the R100 withdrawal cap or the “withdrawals not permitted” message. Its help centre lists six causes for that message: an unverified account, duplicate same-value deposits, a fraud-department flag, a withdrawal limit, an e-mail address change, or a password change in the last 24 hours. If an upload fails because the file is too large or has several pages, AltCoinTrader asks you to e-mail the documents from your registered address with the subject “FICA documents”.

Do not:

• edit, annotate or screenshot a document: AltCoinTrader refuses edited documents and screenshots, and VALR rejects watermarked or scanned images;
• use someone else’s proof of address or bank account to make the details match;
• open a second account to get round a limit, because PCC 57 lists several accounts held by one person as a red flag, alongside transaction values out of line with declared income.

Contact support only through the platform’s own app, website or published support address, writing from the e-mail address registered to the account. Have ready the step that failed and the exact message, a fresh, unedited colour photo that meets its rules, and for a proof of address its issue date and the name on it. For a limit, give your current level and the transaction that was blocked.

Privacy considerations

Handing over an ID, a selfie and a bank statement is a real disclosure, and the FIC Act shapes what happens next. Records must be kept for at least five years after the relationship ends, and PCC 57 encourages CASPs to retain device, IP, geolocation and wallet-address data alongside the documents. Tax is the other channel. SARS states that normal income tax rules apply to crypto assets and that the onus is on taxpayers to declare crypto gains or losses. Its collection powers include requiring third-party service providers to submit financial data (see crypto tax in South Africa). VALR and Ovex both ask for a tax number during verification. Practical steps:

• read the platform’s privacy policy before uploading;
• submit documents only through the platform’s own app or website, never by e-mail to an address you did not initiate;
• switch on two-factor authentication as soon as the account exists, since two of the four platforms tie higher limits to it anyway.

Risks

The FSCA warns that any institution or person conducting CASP activities without a licence faces enforcement action, and 17 applications had been declined by 31 March 2026. A platform that asks for FICA documents is not automatically licensed; check its FSP number against the FSCA list before you upload anything. Phishing that imitates a “re-verification” request is a known pattern for exactly this reason. Limits and document lists on this page are a snapshot read on 3 October 2026 and can change without notice. Crypto assets themselves remain unregulated as currency: the FSCA’s release repeats that the South African Reserve Bank does not recognise crypto assets as currency.

Next steps

If you are still choosing a platform, our guide on how to choose a crypto exchange in South Africa sets out the licence, funding and fee checks that come before KYC. To confirm a platform’s licence, see FSCA-licensed crypto exchanges in South Africa. Once verified, the practical follow-on is how to withdraw crypto to a South African bank account, and the exchange finder filters the same four platforms by deposit method and verification status.