A South African business assessing a crypto exchange should verify the exact legal entity and service, how custody and account access work, how deposits and withdrawals are handled, and what evidence supports operational and compliance claims. Treat provider statements as claims to check—not as proof of regulatory status, security, or suitability. The evidence available here supports only a limited description of exchange custody and combined functions. It does not establish current South African regulatory requirements, or the status, controls, fees, or availability of any specific provider. Those matters require current primary sources and provider-specific documents.

What a business should establish before assessing an exchange

Start by documenting the intended business use. Identify the assets and transaction flows involved, the counterparties, and the internal limits or approvals that will govern use. This scope helps determine which questions matter and which documents to request. It does not establish that a service is available or appropriate for the business.

Next, identify each legal entity involved and the role it performs. A centralized exchange operator may combine trading, proprietary activity, lending, token issuance, and custody, but not every operator performs every function. Combining roles can create operational dependencies or conflicts. Ask which entity provides each service, which entity holds or controls assets, and which entity is responsible for support and incident communication. Verify the answers in current provider documents rather than relying on a brand name alone. source

Make a record of the provider’s statements and label each item as a provider assertion, independently verifiable evidence, or an unresolved question. This distinction prevents a marketing description from being mistaken for a documented control or a regulatory finding. Preserve the exact service and entity to which each document applies; a record about one part of a provider’s business may not answer questions about another.

Before proceeding, define what would count as sufficient evidence for the business. For example, a statement about custody may require a description of the custody arrangement and the responsible entity; a statement about a security assessment needs a document identifying its scope and date. These are diligence requests, not claims that every provider has a particular control or document.

South African crypto exchanges: verify the regulatory position

The evidence available for this article does not establish current South African law, regulatory requirements, or the status of any specific exchange. Do not infer that a provider is authorized, registered, or subject to a particular obligation from the word “exchange,” a website label, or an unverified third-party listing.

For each claimed status, obtain the exact legal entity name, the activity or service covered, the relevant jurisdiction, and current supporting documentation. Check those details against current South African primary legal and regulator materials. A provider’s status should not be generalized to an affiliate, another service, or a different activity without evidence showing that the claim covers it.

Ask the provider to identify the obligations it says apply to the particular service and to provide current documentation supporting that explanation. Compare the answer with authoritative materials and record the date and scope of the check. If the documents do not make the status or its coverage clear, mark the point unresolved and seek qualified legal or compliance review. The evidence available here does not allow a conclusion about what obligations apply to a particular provider or business.

Keep regulatory verification separate from operational review. Evidence that addresses one question does not, by itself, establish the quality of custody, account controls, incident response, or transaction processing. Record each as a distinct claim with its own supporting documents and limitations.

Review custody, access controls, and security evidence

Custody concerns who holds or controls access to assets. In a common centralized-exchange arrangement, a customer transfers assets into the exchange’s custody before trading through its internal system. Custody and legal ownership arrangements vary by platform and jurisdiction, so this general description does not establish what happens at a particular provider. source

Ask the provider to explain the custody arrangement for the specific service under consideration. Clarify which legal entity controls access, what the customer’s contractual relationship is, and how the provider describes the treatment of customer assets. If the provider claims segregation or other safeguards, request documents defining what those terms mean, which assets and services they cover, and any stated limitations. Do not treat a broad statement as evidence of a specific control unless the documentation supports that interpretation.

Request security or operational assessments that the provider cites. Check the scope and date, what systems and services were examined, who produced the assessment, and whether the document reports limitations or unresolved issues. An assessment of one component should not be presented as proof about every service, system, or process. The evidence available here does not establish that any named exchange has undergone an audit or uses a particular security measure.

Ask how the provider documents account permissions, withdrawal approvals, incident escalation, and customer notification. These questions help the business identify what it needs to verify, but the available evidence does not establish authentication methods, monitoring practices, recovery procedures, or incident-response performance for any provider. Record answers as provider statements until supporting documentation is reviewed.

Map deposits, withdrawals, settlement, and recovery

Draw the transaction path from the business’s funding source through the provider to the intended destination. At each step, note the responsible party, records produced, and reconciliation responsibility. Confirm the available deposit and withdrawal routes, eligible assets, fees, limits, processing conditions, and service availability directly with the provider for the relevant account and jurisdiction. The evidence available here does not establish current routes, charges, limits, processing times, or availability.

Ask how the service handles the business’s intended transaction flow and what records the business can obtain. Request documentation for order and trade records, account statements, transaction references, and any steps where the provider’s records need to be matched with the business’s own books. The information in this article does not establish a specific provider’s matching, settlement, or recordkeeping arrangements. Verify the details rather than assuming that a general exchange model describes the proposed service.

Document what happens when ordinary processes fail. Ask for the relevant support and escalation channels, account-recovery process, outage communications, and dispute process. Establish internally who may contact the provider, who can approve operational decisions, and how unresolved transactions will be tracked. These are questions for the business to resolve before reliance; they are not guarantees that a provider offers a particular support outcome or recovery timeline.

Create a documented due-diligence decision

Maintain a decision record with one entry for each material claim. Include the exact wording of the claim, the source and date checked, the legal entity and service involved, the reviewer, supporting evidence, and any gaps or follow-up questions. Distinguish provider assertions from documents or other evidence that substantiate them, and keep the original scope and limitations visible in the record.

Where the provider describes a token arrangement backed by assets or offering holder rights, ask what or whom the holder has a claim against and how the backing assets relate to that claim. Legal effect, segregation, redemption, and insolvency treatment depend on the arrangement and applicable law. A disclosure request is a diligence step; it does not establish that a particular arrangement has a specified legal effect or meets a standard. source

Use the record to set approval conditions, identify unresolved operational dependencies, and determine what changes should trigger a fresh review. Seek qualified legal, compliance, and tax advice for the business’s circumstances, and verify applicable obligations against authoritative, current sources. This article does not provide South African legal or tax conclusions.

The final assessment should state what was verified, what remains uncertain, the evidence used, and when it was reviewed. Keep operational findings separate from legal or tax advice, and do not present the assessment as a provider ranking, a guarantee of security, or confirmation of regulatory status where supporting evidence is absent.

Sources and references