The FSCA CASP scoreboard: 533 applications, 310 licences

The FSCA has published CASP licensing updates roughly every six to twelve months since July 2024, and each release repeats the same structure: applications received, approved, declined, withdrawn, plus enforcement colour. Read in sequence, the releases show a market that rushed the gate when crypto assets were declared a financial product, and a regulator that has worked through the queue at its own pace ever since.

The velocity matters more than the totals. Between the December 2024 and December 2025 cuts the FSCA added 52 approvals; between December 2025 and 31 March 2026 it added ten. Approvals have slowed to a trickle - not, on the face of the releases, because the FSCA stopped working, but because what remains is the hard tail: every release carries the standing caveat that the remaining applications are still being considered.

The FSCA does not leave its decline reasons to speculation. In the December 2024, December 2025 and April 2026 releases it names the same two failure modes: operational ability - applicants unable to show a clear business plan or business model for their crypto activities - and competence - applicants unable to demonstrate crypto knowledge and practical experience.

Notice what is absent from that list: capital. There is no fixed minimum share capital in rand for a Category I or Category II FSP; the financial-soundness requirement is expenditure-based liquidity - for a Category II FSP, liquid assets of at least 8/52 of annual expenditure. The gate the FSCA actually polices is fit-and-proper substance: does the applicant have a real crypto business, and people who have demonstrably run one? That is precisely the assessment an already-licensed CASP has banked - and precisely the assessment an incoming buyer's own key individuals must still pass.

The most telling number in the funnel is not the declines but the withdrawals: 124 of them, outnumbering formal declines by roughly seven to one. The FSCA's April 2026 release describes these as applications withdrawn after engagement with the regulator, and its Service Level Commitments of 26 March 2024 supply the mechanism: where an applicant fails to respond to a request for information within 30 calendar days, the application is considered withdrawn and the application fee is forfeited.

In other words, most files that fail in South Africa do not fail by decision - they die on an information request. An applicant that cannot document its business model, its key individuals' experience or its compliance arrangements within a month of being asked forfeits the file. For anyone reading the scoreboard before choosing a route in, the withdrawal column is a proxy for preparation: the funnel disposes of thin files quietly, and declines the persistent ones on the record.

The FSCA's Service Level Commitments of 26 March 2024 promise a decision on a new Category I or Category II authorisation within 60 working days of receiving a complete, error-free application with the fee paid. Three caveats sit inside that sentence. The commitments are expressly not legally binding, and the FSCA reserves the right to vary its timelines. The clock runs only from a complete, error-free file. And there is no statutory deadline behind any of it.

The FSCA's own statistics are the reality check. The licensing window opened on 1 June 2023; as at 31 March 2026, some 34 months later, roughly 82 applications were still in process on the published arithmetic. Part of that tail dates to the transitional window: firms that applied between 1 June and 30 November 2023 could keep operating under exemption until their application was approved or declined, which softens the wait for them. A new entrant gets no such bridge. The transitional window closed on 30 November 2023, and operating unlicensed is now an enforcement matter - the FSCA reports 81 investigations into suspected unlicensed CASP activity, 51 of them still open at 31 March 2026. A fresh applicant therefore waits out of the market for however long its file actually takes.

Set against that funnel, acquiring an already-licensed CASP buys two things a fresh application cannot: the operational-ability and competence assessment is already banked in the licence, and the business is authorised today rather than after an open-ended queue. South Africa then adds a structural wrinkle: there is no FSCA approval of the share sale itself, because the FSR Act's significant-owner regime does not reach FAIS FSPs, and the ownership change is processed as a licence profile variation with a 30-working-day service commitment.

That is not a loophole, and we do not sell it as one. The FSCA's grip on an acquisition is on people, not paper. An incoming key individual may not take part in the management or oversight of the business until the FSCA has approved them on application under section 8(4)(b) of the FAIS Act - the same fit-and-proper substance that decided the 17 declines. Since 30 June 2025, when the CASP exemption from the regulatory examinations expired with no further extensions, that includes the prescribed exams in hand. No adviser can guarantee key individual approval; approvability is built, not bought. The mechanics, gate by gate, are in our FSCA key individual guide.

The honest calculus, then. If your key individuals would clear FSCA scrutiny either way and time-to-market matters - or your model cannot afford an unlicensed year in a jurisdiction running 81 perimeter investigations - acquisition is the rational route, and SKY7 has two live South African lots: an FSCA Category II discretionary FSP and a dual Category I and II crypto licence (CASP), both priced on request. If your people cannot yet demonstrate crypto experience or have not passed the exams, the scoreboard says the same thing about both routes: fix that first, because it is the gate either way.