JOHN ENDRES | Reserve Bank’s crypto register puts holders in harm’s way - Business Day

John Endres

If you own cryptocurrency the Reserve Bank wants to know. The draft Capital Flow Management Regulations, issued by the National Treasury, would require a holder to declare crypto within 30 days and say where it is kept. Regulation 10, as published, sets no minimum threshold for disclosure.

Under the draft Crypto Asset Manual, issued jointly by the Reserve Bank and National Treasury, trading platforms would have to record each client’s home address and ID number and make the records available to the central bank within 48 hours as a spreadsheet.

Criminals would pay well for such a list. In January 2025 kidnappers seized David Balland, a cofounder of the French wallet maker Ledger, and cut off one of his fingers in the process of demanding a €10m ransom. France recorded 77 crypto-related kidnappings and extortion cases in the first half of this year, according to its interior minister, up from 45 in 2025.

South African gangs are familiar with the method. Police recorded 17,061 kidnappings in 2023/24, up from 4,692 nine years earlier, according to the Institute for Security Studies. Many were express kidnappings, in which gangs hold victims until their bank accounts are empty. Crypto suits that method better than a bank account does.

You might say there is nothing new about the state-collecting information on who owns what. The Deeds Office will tell anyone who owns which house. But a burglar cannot carry a house away, and your bank can cap or stop a transfer.

On the other hand, crypto in a wallet you control enjoys neither protection: a robber who forces you to unlock it can empty it in minutes, and no-one can reverse the transfer. A state-mandated register of people who hold their own crypto would amount to a list of the people most worth robbing.

The manual’s proponents will argue that such information will be protected and kept confidential. However, insiders leak data too.

Gauteng’s government gave a similar assurance last month. A student had found that its R269m e-panic button app left users’ addresses, ID numbers and crime reports in an open online database. The province said no personal information had been compromised. The student said there was no way to know who had seen it.

In France, a tax official in Bobigny, near Paris, was remanded in custody in June 2025 and charged with complicity in violence. Though she worked on company taxes, investigators say she used the tax system to find a prison officer’s new home address, Le Parisien reported.

Three men later forced their way into his flat and beat him and his wife. Her work computer also showed searches on crypto investors, though none is reported to have been attacked. She admits passing on information but says she did not know the man was a prison officer.

The case shows how one official with access to a state database can hand criminals a list of targets, and each official with access to a register is one more person a gang can bribe or threaten.

If you don’t own crypto none of this should comfort you. Your bank collects your ID and proof of address again at each Financial Intelligence Centre Act (Fica) review, and may pass them to an outside firm to verify. In September a ransomware gang claimed to have stolen 200GB of data from RelyComply, which runs such checks for Standard Bank, EasyEquities and other banks and investment platforms.

Another example: if you own more than 5% of a company, the Companies & Intellectual Property Commission holds a copy of your ID too. Each extra copy of your documents, and each extra person able to open them, gives criminals another way in.

None of this means the state should stop tracking criminal money. South Africa spent 32 months, until October 2025, on the Financial Action Task Force’s greylist of countries that do too little to stop money-laundering.

The Reserve Bank’s defenders will also point out that crypto platforms already hold their clients’ details under Fica, so the manual only adds a duty to report them. That argument misses two things:

• The manual says the reports are for balance of payments statistics, which measure how much money flows in and out of the country. Totals would serve that purpose without identifying anyone.
• Regulation 10 reaches beyond platforms. It covers people who keep crypto in their own wallets and have never used a platform, and it sets no minimum value. The state keeps no register of self-custody holders today.

The Bank should go back to the drawing board and scrap exchange controls, and these regulations and the manual with them. If it insists on keeping them it should minimise the sensitive data it collects, for example by setting a value threshold for declarations and asking platforms for totals in place of names.

The regulations also need something they now lack: a duty to secure the data and tell you when it leaks, and a limit on how long platforms and officials may keep it. The manual requires platforms to keep records for at least five years, with no maximum.

The constitution gives everyone the right to be free from violence “from either public or private sources” and obliges the state to protect that right. It cannot do so while it compiles a directory for kidnappers.

Dr Endres is CEO of the SA Institute of Race Relations

https://www.businessday.co.za/opinion/2026-10-14-john-endres-reserve-banks-crypto-register-puts-holders-in-harms-way/