South Africa: technology regulation at a glance

Framework: Financial Advisory and Intermediary Services Act (FAIS) with crypto assets declared a 'financial product' by FSCA (Oct 2022); Financial Intelligence Centre Act (FICA); FIC Directive 9 (Travel Rule); Income Tax Act (SARS)

South Africa treats crypto as legal but regulated. Since June 2023 the Financial Sector Conduct Authority (FSCA) has run a mandatory Crypto Asset Service Provider (CASP) licensing regime under FAIS, complemented by FIC Act AML/CFT obligations, a Travel Rule directive effective 30 April 2025, and SARS taxation of gains/income. Stablecoin and DeFi frameworks remain under development at the Intergovernmental Fintech Working Group (IFWG).

Framework: Draft National Artificial Intelligence Policy (DCDT, published 10 April 2026, withdrawn 26/27 April 2026); no AI-specific statute. AI activity currently governed by general laws, chiefly POPIA, administered by the Information Regulator.

South Africa has no comprehensive AI-specific law in force; AI is currently governed indirectly through general legislation such as the Protection of Personal Information Act (POPIA), the Cybercrimes Act, the Consumer Protection Act and the Electronic Communications and Transactions Act. The Department of Communications and Digital Technologies (DCDT) advanced a Draft National AI Policy through Cabinet and gazetted it for 60 days of public comment in April 2026, but the Minister withdrew it later that month after at least six of its academic citations were found to be AI-fabricated. A revised draft is expected, leaving the country in a pre-legislative, policy-development phase.

Framework: Protection of Personal Information Act 4 of 2013 (POPIA), enforced by the Information Regulator (South Africa)

South Africa has a comprehensive, GDPR-style data-protection law: the Protection of Personal Information Act 4 of 2013 (POPIA), whose substantive provisions commenced on 1 July 2020 with a one-year grace period ending 30 June 2021, making compliance enforceable from 1 July 2021. POPIA is administered by an independent Information Regulator, which also oversees the Promotion of Access to Information Act (PAIA) and has begun active enforcement, issuing infringement and enforcement notices.

Framework: National Payment System Act 78 of 1998 (SARB as overseer/regulator of the National Payment System); crypto asset service providers licensed by the FSCA under the Financial Advisory and Intermediary Services (FAIS) Act. A dedicated activity-based licensing regime for non-bank payment institutions / e-money issuers is in draft (Exemption Notice + Directive, March 2025) and not yet in force.

South Africa has robust payments oversight by the South African Reserve Bank under the 1998 NPS Act, but the legacy regime is bank-centric: most non-bank fintechs still participate via bank sponsorship or as designated System Operators / Third-Party Payment Providers rather than under a dedicated payment-institution or e-money licence. SARB is transitioning to a PSD2-style activity-based authorisation framework under its Payments Ecosystem Modernisation (PEM) Programme, with draft instruments published in 2025 and the first non-bank payment-institution licences expected from 2026. Crypto asset service provider (CASP) licensing is, by contrast, fully operational under the FAIS Act via the FSCA.

Framework: Immigration Act 13 of 2002 and the Immigration Regulations (Third Amendment, Government Gazette No. 51416, in force 9 October 2024), administered by the Department of Home Affairs (DHA). The Remote Work Visa sits within the visitor's-visa category under section 11 of the Act.

South Africa has a dedicated Remote Work Visa (commonly called the digital nomad visa), introduced via amendments to the Immigration Regulations effective 20 May 2024 and refined in the Third Amendment effective 9 October 2024. It lets foreign nationals working remotely for an employer or clients based outside South Africa reside in the country, initially for up to 12 months and renewable. Separate routes (points-based work visas, business/investment and financially-independent permanent residence) also exist for other relocators.

Framework: No single comprehensive online-safety statute. A patchwork of sector laws governs online content: the Films and Publications Amendment Act 11 of 2019 (administered by the Film and Publication Board), the Cybercrimes Act 19 of 2020, intermediary-liability provisions in the Electronic Communications and Transactions Act 25 of 2002, and the Protection of Personal Information Act (POPIA).

South Africa regulates online content through several overlapping laws rather than a unified DSA/OSA-style regime. The Films and Publications Amendment Act extends content classification and prohibited-content blocking to online distributors, the Cybercrimes Act criminalises harmful and non-consensual intimate data messages, and the ECT Act provides a notice-and-takedown safe harbour for intermediaries. A comprehensive online-safety law with mandatory age verification is under active government consideration in 2026 but not yet enacted.

Framework: No single comprehensive cybersecurity law. Obligations arise from a patchwork: the Cybercrimes Act 19 of 2020 (offences), POPIA (data-breach/security-compromise notification, overseen by the Information Regulator), the Critical Infrastructure Protection Act 8 of 2019, and the FSCA/Prudential Authority Joint Standard 2 of 2024 for financial institutions, sitting under the policy-level National Cybersecurity Policy Framework (NCPF, 2015).

South Africa has no single NIS2-style comprehensive cybersecurity statute; instead obligations are spread across sector- and theme-specific instruments. The Cybercrimes Act criminalises cyber offences and was partly brought into force from 1 December 2021, while POPIA imposes economy-wide breach-notification duties enforced by the Information Regulator. Sector-specific cyber-resilience rules (notably the 2024 financial-sector Joint Standard) and the Critical Infrastructure Protection Act add layered obligations, coordinated at policy level by the 2015 National Cybersecurity Policy Framework.

Framework: Companies Act 71 of 2008, administered by the Companies and Intellectual Property Commission (CIPC); foreign founders also engage the Immigration Act 13 of 2002 (business visa) and South African Reserve Bank exchange-control rules.

Registering a private company (Pty Ltd) in South Africa is fast, low-cost and fully online, with 100% foreign ownership permitted and no minimum capital requirement. The incorporation itself is straightforward, but a foreigner who wants to actively manage or relocate to run the business faces additional layers, a demanding business visa (R5 million investment, subject to waiver), exchange-control compliance, and a required local physical address, which add real complexity beyond the paperwork.