South African startups are no longer building only for South Africa. A founder in Cape Town can raise money from a London investor, pay a developer in Kenya, license software to a client in Singapore, store value in crypto assets, and sell services through a United States platform, all before lunch. That is exciting, but it also brings South Africa's capital flow rules sharply into focus.
National Treasury and the South African Reserve Bank published the Draft Capital Flow Management Regulations, 2026 for public comment in April 2026. The draft regulations are intended to replace the Exchange Control Regulations, 1961, which have shaped South Africa's exchange control system for decades. Written comments were invited by 18 May 2026, after which National Treasury and the South African Reserve Bank indicated that they would consider submissions and revise the draft where necessary.
For entrepreneurs, the important point is simple: this is not just an "exchange control" update for banks and large corporates. It affects how South African businesses raise capital, move money, structure foreign ownership, use crypto assets, transfer intellectual property, import goods, export services, and deal with non-resident shareholders. The draft regulations signal a shift towards a capital flow management system with fewer routine pre-approvals, stronger reporting, closer supervision of high-risk transactions, and a clearer focus on illicit financial flows.
The legal framework
The Draft Capital Flow Management Regulations, 2026 (the "Draft Regulations") are made under the Currency and Exchanges Act, 1933 (Act No. 9 of 1933) (the "Currency and Exchanges Act"). The existing Exchange Control Regulations, 1961 (the "Exchange Control Regulations") remain important until the new rules are finalised and brought into force. The Draft Regulations also sit alongside other laws that many startups already deal with, including the Companies Act, 2008 (Act No. 71 of 2008) (the "Companies Act"), the Financial Intelligence Centre Act, 2001 (Act No. 38 of 2001) (the "FIC Act"), the Financial Advisory and Intermediary Services Act, 2002 (Act No. 37 of 2002) (the "FAIS Act"), the National Credit Act, 2005 (Act No. 34 of 2005) (the "NCA"), the Consumer Protection Act, 2008 (Act No. 68 of 2008) (the "CPA"), the Protection of Personal Information Act, 2013 (Act No. 4 of 2013) (the "POPIA"), and the Promotion of Administrative Justice Act, 2000 (Act No. 3 of 2000) ("PAJA").
What "capital" now means
One of the most important changes for modern businesses is the broad definition of "capital". The Draft Regulations treat capital as more than money. Capital includes intellectual property rights, whether registered or unregistered, and anything with monetary value or capable of being converted into money, including crypto assets, but excluding immovable property. That matters because a startup's real value often sits in software code, trademarks, customer data, licensing rights, algorithms, domain names, and brand assets rather than plant and machinery.
The Draft Regulations also expressly define "crypto asset" as a digital representation of value that is not issued by a central bank, can be traded, transferred or stored electronically for payment, investment or other utility, applies cryptographic techniques, and uses distributed ledger technology. This wording brings crypto assets into the capital flow conversation in a direct way. Crypto is no longer treated as something sitting outside the traditional capital system.
This is especially relevant for fintech businesses. A lending platform that raises offshore debt, a crypto-enabled payment gateway, a digital wallet provider, a cross-border remittance product, an invoice-financing platform, or a startup lending in rand but funded by non-resident investors may need to consider both sector-specific financial services rules and the capital flow rules. For example, a fintech lender that grants consumer credit must consider the NCA, affordability assessments, credit agreements, disclosures, and National Credit Regulator requirements. If that same lender receives offshore funding, grants credit backed by a non-resident guarantee, uses crypto assets as settlement value, or issues securities to offshore investors, the Draft Regulations add another legal layer.
Affected persons and foreign ownership
The Draft Regulations retain the concept of an "affected person". In broad terms, this includes a juristic person, trust, partnership, foundation, deceased estate, or association operating or vested in South Africa where 75% or more of the capital, assets, earnings, securities, voting rights or control is directly or indirectly held for the benefit of, or controlled by, non-residents. For startups, this could be highly relevant where a South African company has a majority foreign shareholder, a foreign holding company, or offshore investor control rights.
That does not mean foreign investment is unwelcome. On the contrary, the policy direction appears to support greater integration with global capital markets. The official statement refers to a more modern system with a "positive bias" to cross-border capital flows, fewer transaction pre-approvals, and more reliance on reporting and risk-based supervision. But it does mean founders should avoid casual structuring. Shareholder agreements, funding agreements, convertible loan notes, SAFE-style instruments, subscription agreements, offshore holding structures, IP assignments, and intra-group service agreements all need proper legal and exchange-control review before signature.
Crypto assets and authorised service providers
Crypto asset service providers also receive special attention. The Draft Regulations define an authorised crypto asset service provider as a crypto asset service provider under item 22 of Schedule 1 to the FIC Act that has also been authorised by National Treasury to facilitate transactions treated as imports or exports of capital through crypto assets. The FIC describes item 22 activities as including crypto-to-fiat exchange, crypto-to-crypto exchange, transfers between crypto addresses or accounts, safekeeping or administration of crypto assets or instruments of control, and financial services linked to an issuer's offer or sale of crypto assets. The Financial Sector Conduct Authority also lists crypto asset service providers among the regulated entities under its remit.
For founders, this means a crypto-related business cannot only ask, "Do we have a good product?" It must ask, "Are we properly licensed, registered, authorised, contracted, and documented?" A business that accepts crypto from foreign customers, settles suppliers in crypto assets, lends crypto assets, stores crypto assets for users, or uses crypto assets as a medium for cross-border value transfer must treat legal compliance as part of the product build, not as a late-stage admin task.
The Draft Regulations propose restrictions on buying, selling, borrowing, or lending crypto assets above a threshold unless the transaction takes place through an authorised crypto asset service provider, or with permission from National Treasury or an authorised person. They also restrict the use of crypto assets acquired for a stated purpose, and require a person who no longer needs those crypto assets for that stated purpose to offer them for sale to National Treasury or an authorised crypto asset service provider.
Foreign currency, gold and stated purpose
The same idea applies to foreign currency and gold. A person who is not an authorised dealer may not buy, sell, borrow, or lend foreign currency or gold above a determined threshold except through an authorised dealer or with the required permission. The Draft Regulations also place conditions on using foreign currency or gold for the purpose stated when it was acquired. In ordinary language, founders should be careful about buying foreign currency "for one reason" and then using it for another. Payment purpose, supporting documents, invoices, board approvals, and contract wording all matter.
Taking capital out of South Africa
The Draft Regulations also deal with taking currency, crypto assets, gold, and securities out of South Africa. In broad terms, a person may not remove them from the Republic, transfer securities to a person outside South Africa, make payments to or for a non-resident, or provide certain forms of financial assistance involving non-residents or affected persons unless the required permission, exemption, threshold allowance, or condition applies. This is relevant for a startup paying a foreign founder, issuing shares to an overseas investor, granting a guarantee to an offshore lender, transferring intellectual property to a foreign group company, or using crypto assets to settle an offshore obligation.
Foreign assets and declarations
Foreign assets and crypto assets must also be treated carefully. The Draft Regulations state that every person in the Republic must, within 30 days or within any prescribed period, declare foreign assets or crypto assets after obtaining control or possession of them, or after becoming entitled to sell, procure the sale of, or transfer them. The declaration must include when and how the asset was acquired, where it is held, and whether it is held as cover for a foreign liability. Once declared, the asset may not be sold, transferred or otherwise disposed of without the required permission and conditions.
That rule is likely to catch more everyday startup situations than many founders expect. A South African founder who receives offshore shares as part of an accelerator arrangement, a startup that opens a foreign bank or platform account, a developer who receives crypto assets from a foreign client, or a business that holds offshore intellectual property rights may have a reporting and permission question. The answer will depend on the final regulations, thresholds, exemptions, manuals, and guidance. The safe approach is to map the transaction before implementation.
Imports, exports and cross-border payments
The rules around exports and imports also deserve attention. The Draft Regulations require export declarations and authorised dealer involvement in certain cases. They also provide that where goods are exported for sale and are not sold within six months, or where proceeds are not repatriated within six months from shipment, the exporter must notify National Treasury or an authorised dealer within 14 days after the six-month period expires. For imported goods above a determined threshold, the Draft Regulations contain reporting obligations where goods are paid for but not consigned to South Africa within four months, and require documentation confirming arrival in the manner and period prescribed.
This is not only relevant to traditional importers. Hardware startups, e-commerce businesses, renewable-energy installers, medical-device businesses, and manufacturing ventures often pay foreign suppliers before goods arrive. Poorly drafted purchase orders, vague delivery terms, missing customs documents, or informal payment arrangements can create avoidable legal risk. Good commercial contracts should say exactly what is being bought, when title passes, who handles customs, when payment is due, what happens if shipment is delayed, and which party carries currency, tax, delivery and regulatory risk.
Capital raising and the Companies Act
Capital raising receives direct treatment. The Draft Regulations define "issue of capital" to include raising capital in South Africa by issuing securities in or outside South Africa, receiving money on loan where repayment may take place wholly or partly through securities, and certain municipal loans. The Draft Regulations also restrict issues of capital above a determined threshold during a 12-month period unless an exemption or permission applies. This matters for venture capital rounds, bridge loans, convertible notes, investor warrants, offshore subscription agreements, and shareholder funding.
The Companies Act remains central to these transactions. A startup issuing shares must consider authorised share capital, board approvals, shareholder approvals where required, pre-emptive rights, solvency and liquidity where relevant, financial assistance rules, and proper securities registers. The Draft Regulations do not replace company law. They add a capital flow lens to the transaction. A funding round can be valid under company law but still create exchange-control or capital-flow compliance questions if the investor is offshore, the subscription money comes from outside South Africa, or the rights attached to the instrument affect control.
Fintech lending businesses should be especially cautious because the Draft Regulations define financial assistance widely. It includes lending currency or crypto assets, granting credit, acquiring securities, instalment sale agreements, leases, financing sales or securities, discounting, factoring, guarantees, suretyships, buy-backs, and lease-backs, with limited exclusions for seller credit in a direct sale of goods and credit solely for services rendered. A digital lender may therefore be dealing with the NCA, the FIC Act, POPIA, the Companies Act, and the Draft Regulations in the same product flow. For example, a platform that funds South African small-business invoices using offshore investor money should consider whether its structure involves factoring, securities, cross-border funding, affected-person rules, credit-provider obligations, and data-processing compliance.
Enforcement, sanctions and PAJA review
Enforcement powers also become more direct in the Draft Regulations. National Treasury or an authorised person may require information, and appointed persons may enter and search premises to inspect books or documents, either with consent, under a warrant, or in urgent circumstances where the legal requirements are met. The Draft Regulations require those powers to be exercised with respect for dignity, privacy, freedom and security, and with as little disturbance as possible.
The Draft Regulations also provide for administrative sanctions against authorised dealers and authorised crypto asset service providers. Sanctions may include financial sanctions, public reprimands, suspension or revocation of appointment, disqualification of directors or senior management, restrictions on transactions, and remedial action. This matters because founders often rely heavily on banks, payment providers, and crypto platforms. If a regulated intermediary requires documents, explanations or revised contracts, that request may not be mere red tape. It may be part of that intermediary's own legal duty.
The Draft Regulations contain attachment, blocking and forfeiture powers relating to money, crypto assets and other property linked to actual or suspected contraventions. They also state that attachments and orders made under the relevant provisions constitute administrative action, and that an aggrieved person may seek judicial review under PAJA. PAJA therefore remains an important safeguard. Administrative power must be exercised lawfully, reasonably and procedurally fairly. That is not a small point. It gives businesses a route to challenge improper decisions, but it also rewards businesses that keep clean records, written approvals, transaction histories, board minutes, tax documents, contracts and compliance files.
Contract drafting and warranties
The Draft Regulations also increase the need for careful contract drafting. A startup's legal documents should not treat cross-border payments as a footnote. Contracts should identify the payment currency, payment route, authorised dealer process, tax responsibilities, exchange-control responsibilities, sanctions clauses, documentary requirements, delivery dates, beneficial ownership details, and what happens if a regulator delays or refuses approval. In foreign investment documents, founders should pay close attention to warranties dealing with residence, beneficial ownership, source of funds, anti-money laundering compliance, exchange-control compliance, tax residence, intellectual property ownership, and data transfers.
Precedent, common law and a moving target
The stare decisis principle also matters. South African courts follow binding precedent from higher courts unless a later competent court changes the law. That gives commercial parties a measure of predictability when courts interpret statutes, regulations, administrative-law rights and common-law contract principles. At the same time, the common law continues to develop as technology changes. Courts increasingly have to apply older legal principles to digital assets, platform businesses, remote work, cross-border services and decentralised technology. The Draft Regulations are part of that broader legal development: South African law is trying to fit modern capital flows into a system that protects the economy without cutting entrepreneurs off from global markets.
Practical steps for founders
For founders, the practical message is clear. Do not wait until due diligence to clean up capital-flow compliance. Before signing an offshore investment term sheet, transferring IP to a foreign entity, accepting crypto assets, granting a non-resident guarantee, opening a foreign account, or using offshore debt to fund South African lending, get the structure checked. Once money has moved or securities have been issued, fixing the problem can be slower, more expensive, and more stressful than getting it right at the start.
The Draft Regulations should also be read with care because thresholds are not fixed in the body of the draft. The Minister of Finance may determine threshold amounts in rand by notice in the Government Gazette. In practice, this means founders should not rely on assumptions about "small" or "low-risk" transactions. The legal position may depend on the final threshold, the class of transaction, the identity and residence of the parties, the nature of the asset, and whether an exemption or permission applies.
South Africa's startup sector needs access to global capital, but global capital also expects clean legal records. Investors want to know that shares were validly issued, IP belongs to the company, exchange-control approvals are in order, data processing is lawful, tax risk is understood, and no hidden regulatory problem will block an exit. A properly structured company is easier to fund, easier to sell, and easier to defend.
Our commercial law team assists startups, fintech businesses, founders and investors with shareholder agreements, investment documents, cross-border funding structures, fintech regulatory advice, crypto-related contracts, commercial terms, exchange-control permissions, POPIA compliance, NCA reviews, and transaction support. If your business is raising offshore capital, using crypto assets, lending through a digital platform, importing goods, exporting technology, or restructuring ownership across borders, speak to us before the documents are signed. A short legal review at the beginning can prevent a costly problem later.
This article is for general information only and is based on the Draft Capital Flow Management Regulations, 2026 as published for public comment. The Draft Regulations are not final law until promulgated, and the final wording, thresholds, exemptions, manuals and regulatory guidance may differ. This article does not constitute legal advice and should not be relied on for any specific transaction. Each matter should be assessed on its own facts by a suitably qualified South African attorney.