Recent proposals from the South African Reserve Bank and the National Treasury signal a significant shift in how cryptocurrency ownership will be monitored within the country. Draft regulations on Capital Flow Management require holders of cryptocurrency to disclose their assets, including details about where these assets are stored, within 30 days of acquiring them. Notably, there is no stipulated minimum threshold for these disclosures, meaning all holders are affected regardless of the value of their holdings.
According to the draft Crypto Asset Manual, cryptocurrency trading platforms will be required to document each customer’s home address and identification number, submitting this data to the central bank in a standardized format within 48 hours. This move raises pressing concerns about privacy and the potential misuse of sensitive information.
Global trends show a disturbing increase in crimes related to cryptocurrency, particularly kidnappings for ransom. A notable incident involved David Balland, co-founder of Ledger, a French wallet manufacturer, who was kidnapped and subjected to violence as ransom demands soared to €10 million. Statistics indicate that France has experienced a surge in cryptocurrency-related kidnappings—from 45 in 2023 to 77 in just the first half of 2024, as reported by the country’s interior minister.
Similarly, South Africa has witnessed a dramatic rise in kidnappings, with the police recording 17,061 incidents in the 2023/24 period—an increase from 4,692 nine years earlier, as noted by the Institute for Security Studies. Among these, many represent express kidnappings, often involving victims being held until their bank accounts are emptied. The untraceable nature of cryptocurrency makes it an increasingly attractive target for criminals compared to traditional bank accounts.
While the state’s efforts to collect information about asset ownership are not new—similar to how property ownership is registered with the Deeds Office—the key distinction lies in the ease with which cryptocurrency can be stolen. Unlike physical assets, a person can empty a cryptocurrency wallet in a matter of moments if coerced. This issue raises serious concerns about a government-mandated registry that would identify cryptocurrency holders, potentially making them prime targets for criminal activity.
Proponents of the regulations argue that sensitive data will be adequately safeguarded and treated confidentially. However, there are numerous instances demonstrating that data can be leaked. For example, a recent incident involving Gauteng’s government highlighted vulnerabilities in an e-panic button app, where user data was exposed in an unsecured online database—a situation that could have far-reaching consequences.
Moreover, there have been revelations regarding misuse of information by state officials. In June 2025, a tax official in Bobigny, France, was implicated in a violent crime after leveraging her access to state databases to uncover a prison officer’s home address, demonstrating the risks associated with data access by government employees.
These situations underline the broader implications of maintaining a central register of cryptocurrency holders. Each individual with access to such a register increases the likelihood that criminals could either bribe or threaten officials for access to sensitive information, creating a dangerous terrain for cryptocurrency owners.
For those not involved in cryptocurrency transactions, the situation remains disconcerting. Traditional banking institutions also retain sensitive information—like identification and address details—using them for verification in compliance with Financial Intelligence Centre Act (Fica) reviews. Recent cases of cyberattacks, such as a ransomware group stealing data from RelyComply, a firm managing these checks for banks, only intensify the concern regarding personal data security.
While it is critical for the state to track illicit financial activities, concerns remain about overreach and data security. South Africa has been on the Financial Action Task Force’s grey list for 32 months as of October 2024, highlighting the need for enhanced measures against money laundering.
Defenders of the Reserve Bank assert that cryptocurrency platforms currently maintain customer information in adherence to Fica regulations. However, critics point out that the proposed manual extends reporting obligations beyond platforms to include individuals who hold cryptocurrency in their private wallets. Notably, the lack of a minimum reporting threshold complicates compliance for even the smallest holders.
In light of these developments, many are calling for a reassessment of the proposed regulations. Suggestions include raising the minimum value for disclosures, ensuring that platforms report aggregate totals rather than individual identities, and implementing stringent obligations on data security, such as notifying individuals in the event of a data breach.
Ultimately, balancing the need for tracking illicit financial flows with protecting citizens from violence stemming from data exposure remains a critical challenge. The country’s constitution guarantees the right to safety from violence, and the implementation of these regulations must consider the potential risks to individual security.
Dr. Endres serves as the CEO of the South African Institute of Race Relations, contributing to the ongoing discussion regarding the intersection of finance, technology, and state oversight.
