Africa's crypto market is entering a more demanding phase of regulatory maturity. The question for exchanges is no longer simply whether virtual assets will be regulated, but whether operators can demonstrate that their compliance frameworks work in practice.
Kenya's Virtual Asset Service Providers Act, 2025 established a statutory licensing framework, with implementing Regulations gazetted in July 2026. South Africa has already brought crypto asset service providers within its financial-intelligence framework, including specific requirements relating to the Travel Rule. At the international level, the Financial Action Task Force (FATF) continues to identify gaps in licensing, supervision, Travel Rule implementation, offshore VASP activity and risk mitigation.
For African crypto exchanges, this changes the compliance question.
A policy manual and a screening subscription are no longer sufficient evidence of a mature programme. Exchanges increasingly need to demonstrate that they can identify customers, understand transaction risk, investigate alerts, manage sanctions exposure, respond to suspicious activity and provide regulators and banking partners with evidence that their controls operate as designed.
The principal challenges are increasingly operational rather than purely regulatory.
1. Maintaining banking and fiat-rail access
Access to banking remains one of the most consequential compliance challenges for crypto exchanges.
An exchange may have a technically sophisticated trading platform and a valid licence, yet still struggle to obtain or maintain banking relationships. Banks and other financial institutions assess the financial-crime risks associated with their counterparties, including customer profiles, jurisdictions, transaction flows, sanctions exposure and the effectiveness of AML/CFT controls.
This creates a difficult dynamic for exchanges.
A weak compliance programme can increase perceived counterparty risk. But the loss of banking access can itself make compliant fiat operations more difficult, particularly where an exchange depends on a small number of banking or payment partners.
The answer is not simply to produce more policies. Exchanges need to be able to evidence how their risk assessment, customer due diligence, transaction monitoring, sanctions screening, suspicious transaction reporting and governance arrangements operate in practice.
This is particularly important as regulators move from establishing rules to assessing implementation. FATF's 2026 targeted update found that significant gaps remain globally in translating regulatory requirements into effective risk mitigation and supervision.
The practical lesson:banking relationships should be treated as an outcome of the exchange's broader financial-crime control environment, not as a separate commercial problem.
2. Operationalising the Travel Rule
The Travel Rule is another major implementation challenge.
FATF Recommendation 15 applies AML/CFT requirements to virtual assets and VASPs, while the Travel Rule requires relevant information concerning the originator and beneficiary to accompany qualifying transfers. FATF's latest targeted update reported that 83% of surveyed jurisdictions had enacted legislation implementing the Travel Rule, although implementation remains uneven.
For exchanges, the challenge is therefore moving from policy to operational execution.
A compliant framework must address questions such as:
- What information must be collected before a qualifying transfer?
- How is the information transmitted securely?
- What happens when the receiving VASP cannot receive Travel Rule information?
- How are transfers involving unhosted wallets assessed?
- What risk-based controls apply to transfers involving higher-risk jurisdictions or counterparties?
- How are exceptions documented and escalated?
South Africa illustrates how these requirements can become operationally specific. Its Financial Intelligence Centre issued Directive 9 setting out Travel Rule obligations for crypto asset service providers involved in ordering, intermediary and recipient functions.
African exchanges should therefore avoid treating the Travel Rule as an IT integration project alone. It is a compliance operating model involving customer data, transaction risk, counterparties, technology, investigations and governance.
3. Turning blockchain analytics into effective investigations
Blockchain analytics can identify exposure to sanctioned addresses, illicit services, fraud typologies and other high-risk activity. But technology does not replace investigative judgement.
The operational challenge is the point between an alert being generated and a compliance decision being made.
An exchange needs appropriately trained personnel who can determine:
- why a transaction generated an alert;
- whether the exposure is meaningful or merely incidental;
- what additional information should be obtained;
- whether the customer's behaviour is consistent with their risk profile;
- whether escalation is required; and
- whether the rationale for the final decision has been documented.
This distinction matters because a high volume of alerts does not necessarily indicate an effective programme.
A mature transaction-monitoring function is one in which the exchange can demonstrate risk-based alert generation, documented investigation, consistent escalation and defensible disposition decisions.
FATF's recent work continues to identify increasingly sophisticated illicit-finance risks involving virtual assets, including fraud, stablecoins, peer-to-peer transactions, unhosted wallets and offshore VASPs.
The question is therefore not whether an exchange owns blockchain analytics software.
It is whether the exchange can turn blockchain intelligence into an appropriate compliance decision.
4. Managing sanctions risk beyond name screening
Sanctions compliance in digital assets introduces an additional layer of complexity because exposure can arise through blockchain addresses and transaction relationships, not only through customer names.
A conventional sanctions-screening programme may identify a sanctioned individual or entity during customer onboarding. It may be less effective, however, when risk enters through a wallet associated with a designated person, a sanctioned service, a compromised address or another high-risk cluster.
This means exchanges need to consider both customer-level and transaction-level sanctions controls.
Depending on the business model and applicable law, this may involve:
- customer and beneficial-owner screening;
- wallet and address screening;
- transaction screening;
- geographic and jurisdictional controls;
- escalation procedures for potential matches;
- asset-freezing or blocking procedures where legally required; and
- documented investigation and disposition of alerts.
The objective is not to treat every blockchain interaction with a high-risk address as automatically illicit. It is to establish a documented, risk-based process for determining the significance of the exposure.
5. Navigating fragmented African regulatory regimes
Africa does not have a single regulatory framework for virtual assets.
The regulatory perimeter, licensing categories, supervisory authorities and AML/CFT obligations differ across jurisdictions. Kenya's framework, for example, establishes a licensing regime under the VASP Act and Regulations, while allocating supervisory responsibilities across the relevant authorities according to the nature of the virtual asset service.
South Africa provides another model. Crypto asset service providers are within the Financial Intelligence Centre's regulatory perimeter as accountable institutions, and the FIC has developed sector-specific guidance and directives, including its Travel Rule Directive. Its 2025 sector risk assessment classified the inherent ML/TF risk of the CASP sector as high and residual risk as medium-high.
For an exchange operating across several African markets, the challenge is therefore not simply identifying whether crypto is regulated.
The exchange must determine:
- whether its activities fall within the local definition of a VASP or CASP;
- whether a local licence or registration is required;
- which authority has supervisory responsibility;
- whether local-presence requirements apply;
- what AML/CFT obligations apply;
- what reporting requirements exist;
- how customer onboarding should be adapted; and
- whether the jurisdiction's rules capture offshore providers serving local customers.
The final issue is becoming particularly important.
FATF's 2026 report on offshore VASPs specifically examined providers established in one jurisdiction that serve customers in another, including providers operating without a physical presence in the customer jurisdiction. FATF identified gaps in oversight of offshore VASPs as a significant illicit-finance vulnerability.
For regional exchanges, regulatory mapping should therefore be completed before entering a new market rather than after customer acquisition.
6. Building sufficient compliance expertise
Regulation can be written by a government, but compliance has to be operationalised by people.
This creates a difficult constraint for growing exchanges: experienced financial-crime professionals with genuine virtual-asset expertise are limited, while the complexity of the regulatory environment is increasing.
The appointment of a compliance officer or MLRO should therefore not be treated as a box-ticking exercise.
A credible compliance function requires sufficient authority, resources, independence and technical capability to:
- conduct enterprise and customer risk assessments;
- oversee CDD and EDD;
- monitor transactions;
- investigate alerts;
- manage sanctions and PEP exposure;
- make or recommend suspicious transaction reports;
- maintain regulatory records;
- escalate material risks to senior management and the board; and
- test whether controls are actually working.
This becomes particularly important in jurisdictions where the regulatory framework imposes specific governance and staffing expectations. Kenya's 2026 Regulations, for example, include ongoing requirements covering human and technology resources alongside broader licensing and governance requirements.
The strategic mistake is to hire the most junior person capable of occupying the compliance seat and assume that the existence of the role equals the existence of a compliance function.
It does not.
The deeper challenge: proving that compliance works
These six challenges point to a broader shift in the African virtual-asset market.
The competitive advantage will increasingly belong to exchanges that can demonstrate control effectiveness, rather than simply demonstrate that policies exist.
That distinction can be expressed simply:
Policy → Procedure → System → Investigation → Decision → Evidence.
A regulator, banking partner or institutional counterparty may ultimately want to know what happened in a real case.
Can the exchange show how a customer was risk-rated?
Can it explain why enhanced due diligence was triggered?
Can it reconstruct a suspicious transaction investigation?
Can it demonstrate how a sanctions alert was resolved?
Can it explain why a transaction was permitted, rejected, frozen or escalated?
Can it produce the relevant records?
Can senior management demonstrate that material compliance risks were reported and addressed?
These are fundamentally questions of control effectiveness.
What a mature exchange should have in place
A practical compliance maturity framework for an African crypto exchange should cover at least five layers.
1. Governance
The board and senior management should understand the exchange's principal financial-crime risks, risk appetite and regulatory obligations.
2. Customer risk management
The exchange should have documented CDD, beneficial-ownership, PEP, sanctions, adverse-media and EDD processes appropriate to its business model and risk profile.
3. Transaction and wallet monitoring
Monitoring should combine conventional transaction-monitoring controls with blockchain intelligence where appropriate, supported by defined investigation and escalation procedures.
4. Regulatory and reporting infrastructure
The exchange should maintain processes for suspicious transaction reporting, regulatory reporting, record retention, regulatory requests and applicable Travel Rule obligations.
5. Independent assurance
Testing should not stop at confirming that a policy exists. Compliance programmes should be periodically tested for design and operating effectiveness, with deficiencies tracked to remediation.
Conclusion
Africa's crypto sector is moving from regulatory uncertainty towards regulatory execution.
That transition changes what compliance means for exchanges.
The central question is no longer whether an operator has an AML policy, a sanctions-screening provider or a blockchain analytics subscription. The more important question is whether those controls operate together as a coherent financial-crime risk management system.
FATF's latest work reinforces this direction: regulatory adoption is increasing, but implementation gaps remain, particularly around effective supervision, Travel Rule implementation, offshore VASPs, unhosted wallets, stablecoins and emerging forms of illicit finance.
For African exchanges, this creates both a regulatory obligation and a strategic opportunity.
The exchanges that invest early in governance, investigative capability, transaction intelligence, regulatory mapping and independent testing will be better positioned to maintain banking relationships, enter new markets and respond credibly to regulatory scrutiny.
In the next phase of Africa's digital-asset market, compliance will not be measured by the number of policies an exchange owns. It will be measured by what the exchange can prove.
Primary sources
- Kenya, Virtual Asset Service Providers Act, 2025 (Act No. 20 of 2025).
- Kenya, Virtual Asset Service Providers Regulations, 2026 (Legal Notice No. 134 of 2026).
- Financial Action Task Force, Seventh Targeted Update on Implementation of the FATF Standards on Virtual Assets/VASPs, July 2026.
- Financial Action Task Force, Understanding and Mitigating the Risks of Offshore Virtual Asset Service Providers, March 2026.
- Financial Intelligence Centre, South Africa, Directive 9: Implementation of the Travel Rule relating to crypto asset transfers.
- Financial Intelligence Centre, South Africa, Crypto Asset Service Providers Sector Risk Assessment*, April 2025.
This article is for general informational purposes only and does not constitute legal, regulatory or compliance advice. Requirements vary by jurisdiction and business model. Virtual asset businesses should obtain jurisdiction-specific advice before commencing or expanding operations.