PCC 61 – Implementation of the “travel rule” relating to crypto asset transfers

FIC

Financial Intelligence Centre

PUBLIC COMPLIANCE COMMUNICATION

PUBLIC COMPLIANCE COMMUNICATION

61 OF 2026 (PCC 61) ON PROVIDING

GUIDANCE CONCERNING THE

IMPLEMENTATION OF THE “TRAVEL

RULE” RELATING TO CRYPTO ASSET

TRANSFERS AS DIRECTED BY DIRECTIVE

9 OF 2024, WHICH CAME INTO EFFECT ON

30 APRIL 2025.

30 March 2026

PUBLIC COMPLIANCE COMMUNICATION 61 OF 2026 (PCC 61) ON PROVIDING GUIDANCE CONCERNING THE IMPLEMENTATION OF THE "TRAVEL RULE" RELATING TO CRYPTO ASSET TRANSFERS AS DIRECTED BY DIRECTIVE 9 OF 2024, WHICH CAME INTO EFFECT ON 30 APRIL 2025.

PCC SUMMARY

This Public Compliance Communication (PCC) 61 provides guidance to accountable institutions, in particular, item 22 (CASPs) and Item 12 (Financial Service Provider (FSP) CASP) of Schedule 1 to the Financial Intelligence Centre Act, 2001 (Act 38 of 2001) (FIC Act) regarding the implementation of the "travel rule" relating to crypto asset transfers, as required by Directive 9 of 2024 (Directive 9), which came into effect on 30 April 2025.

THE AUTHORITATIVE NATURE OF GUIDANCE

The Financial Intelligence Centre (Centre) provides the guidance in terms of section 4 (c) of the FIC Act read with Regulation 28 of the Money Laundering and Terrorist Financing Control Regulations (the Regulations) issued in terms of the FIC Act.

Section 4(c) of the FIC Act empowers the Centre to provide guidance in relation to a number of matters concerning compliance with the obligations in terms of the FIC Act. Guidance provided by the Centre is the only form of guidance formally recognised in terms of the FIC Act and the Regulations issued in terms of the FIC Act.

Accordingly, guidance provided by the Centre is authoritative for interpreting obligations and must be considered when interpreting the provisions of the FIC Act or assessing compliance of an accountable or reporting institution with its obligations imposed on it by the FIC Act.

It is important to note that enforcement action may emanate as a result of non-compliance with the FIC Act in areas where there has been non-compliance with the guidance provided by the Centre. Where it is found that an accountable institution has not followed guidance which the Centre has issued, the institution must be able to demonstrate that it has nonetheless complied with the relevant obligation under the FIC Act in an equivalent manner.

Page 2 of 24

DISCLAIMER

The publication of a PCC concerning any particular issue, as with other forms of guidance which the Centre provides, does not relieve the user of the guidance from the responsibility to exercise their own skill and care in relation to the users' legal position. The Centre accepts no liability for any loss suffered as a result of reliance on this publication.

COPYRIGHT NOTICE

This PCC is copyright. The material in a PCC may be used and reproduced in an unaltered form only for personal and non-commercial use within your institution.

Apart from any use permitted under the Copyright Act, 1978 (Act 98 of 1978) all other rights are reserved.

OBJECTIVE

The objective of PCC 61 is to provide practical guidance to Crypto Asset Service Provider (CASPs) as those accountable institutions that provide or engage in crypto asset transfers for or on behalf of a client, on how to implement the 'travel rule' in the context of crypto asset transfers, as directed in terms of Directive 9, which directive transposes and implements the requirements of Financial Action Task Force Recommendation 16 into the FIC Act regime in South Africa.

PUBLIC COMPLIANCE COMMUNICATION 61 OF 2026 (PCC 61) ON PROVIDING GUIDANCE CONCERNING THE IMPLEMENTATION OF THE "TRAVEL RULE" RELATING TO CRYPTO ASSET TRANSFERS AS DIRECTED BY DIRECTIVE 9 OF 2024, WHICH CAME INTO EFFECT ON 30 APRIL 2025.

Page 3 of 24

1. INTRODUCTION

1.1. This public compliance communication 61 (PCC 61) provides guidance to CASPs on the implementation of controls aimed at compliance with Financial Intelligence Centre Act, 2001 (Act 38 of 2001) (FIC Act) Directive 9. Directive 9 requires CASPs, as accountable institutions that provide or engage in crypto asset transfers, for or on behalf of their client, to implement the Financial Action Task Force (FATF) Recommendation 16 (referred to as the 'travel rule' in the context of crypto asset transfers).

1.2. Directive 9 places an obligation on accountable institutions that are ordering, beneficiary and intermediary CASPs that facilitate or enable crypto asset transfers, to obtain, hold and transmit certain information regarding the originator and beneficiary securely and immediately when transferring crypto assets. Post-facto transmission of information is not permitted, and it defeats the purpose of the travel rule, which is to bring transparency to crypto asset transactions.

1.3. The requirement to obtain, hold and transmit certain information for crypto asset transfers enables CASPs to identify suspicious and unusual transactions, to detect possible terrorist financing, proliferation financing and financing of persons designated on targeted financial sanctions lists of the United Nations Security Council (UNSC) resolutions. In addition, it enables the CASPs to freeze crypto assets when necessary, and file reports to the Centre.

1.4. The definitions contained in Directive 9 are applicable to this PCC. Directive 9 and this PCC should be read together with PCC 57 which provides guidance on the interpretation of item 22 of Schedule 1 to the FIC Act, and PCC 44A which provides guidance on targeted financial sanctions. Refer also to Guidance Note 4B and 6A which deal with reporting.

PUBLIC COMPLIANCE COMMUNICATION 61 OF 2026 (PCC 61) ON PROVIDING GUIDANCE CONCERNING THE IMPLEMENTATION OF THE "TRAVEL RULE" RELATING TO CRYPTO ASSET TRANSFERS AS DIRECTED BY DIRECTIVE 9 OF 2024, WHICH CAME INTO EFFECT ON 30 APRIL 2025.

1.5. As highlighted in the Centre's sector risk assessments and the terrorist financing national risk assessment, trends indicate that crypto asset transfers are being used as a method of sanctions evasion.

GENERAL TERMS AND APPLICATION

2.1. Directive 9 applies to accountable institutions that, in terms of items 12 and 22 of Schedule 1 to the FIC Act, provide or engage in crypto asset transfers, for or on behalf of their customers. The Directive applies to all crypto asset transfers between CASPs, as well as crypto asset transfers between CASPs and unhosted wallets (also referred to as self-hosted or non-custodial wallets).

2.2. Directive 9 applies to crypto asset transfers that take place within South Africa, originate from South Africa, or are received into South Africa.

2.3. CASPs that provide services or products in South Africa remain obliged to comply with Directive 9 requirements in respect of domestic and cross-border crypto asset transfers in which they participate.

2.4. Crypto asset transfers that constitute single transactions below R5000 are included in the scope of Directive 9. In such instances, the distinction relates to the customer due diligence verification requirements, and not to the obligation to obtain, hold and transmit the information prescribed in Directive 9.

2.5. Directive 9 does not apply to fiat currency transfers (see the South African Reserve Bank Directive on electronic funds transfers compliance with FATF Recommendation 16 and Guidance Note 9).

PUBLIC COMPLIANCE COMMUNICATION 61 OF 2026 (PCC 61) ON PROVIDING GUIDANCE CONCERNING THE IMPLEMENTATION OF THE "TRAVEL RULE" RELATING TO CRYPTO ASSET TRANSFERS AS DIRECTED BY DIRECTIVE 9 OF 2024, WHICH CAME INTO EFFECT ON 30 APRIL 2025.

Page 5 of 24

Page 6 of 24

Explanation of certain terms used in Directive 9

2.6. For the sake of good order and effectiveness the Centre provides an explanation of certain terms used in Directive 9, below:

2.6.1. A ‘qualifying transfer’ includes a crypto asset transfer, whether domestic or cross-border, conducted in the course of a business relationship. The threshold for such a crypto asset transaction is zero, this means the travel rule applies to all crypto asset transactions regardless of the amount.

2.6.2. ‘Cross-border crypto asset transfer’ means a transfer where either the ordering crypto asset service provider or the receiving crypto asset service provider is located outside the Republic of South Africa.

2.6.3. ‘Located in’ means physical presence, operating, registered, providing products or services from within South Africa.

2.6.4. ‘Located outside’ means physical presence, operating, registered, providing products or services from outside of South Africa.

2.6.5. ‘Domestic crypto asset transfer’ means a transfer where the ordering crypto asset service provider and the receiving crypto asset service provider are both located in South Africa.

2.6.6. ‘Crypto asset’ means a digital representation of perceived value that can be traded or transferred electronically within a community of users of the internet who consider it as a medium of exchange, unit of account or store of value and use it for payment or investment purposes, but does not include a digital representation of a fiat currency or a security as defined in the Financial Markets Act, 2012 (Act 19 of 2012). A crypto asset includes a stablecoin.

PUBLIC COMPLIANCE COMMUNICATION 61 OF 2026 (PCC 61) ON PROVIDING GUIDANCE CONCERNING THE IMPLEMENTATION OF THE “TRAVEL RULE” RELATING TO CRYPTO ASSET TRANSFERS AS DIRECTED BY DIRECTIVE 9 OF 2024, WHICH CAME INTO EFFECT ON 30 APRIL 2025.

2.6.7. ‘Beneficiary’ – the term beneficiary as used in the Directive includes the receiver of the crypto assets transferred and has a different meaning to the term ‘beneficial owner’ as defined in the FIC Act.

2.6.8. ‘Distributed ledger address’ means a unique identifier to describe the account or identity on the distributed ledger technology, and which can be the wallet address of the originator and/or the beneficiary. A distributed ledger address should only be used as a customer identification number where the CASP assigns one dedicated address per customer. Where CASPs use shared or rotative hot wallet structures, the address does not uniquely identify a specific customer.

2.6.9. ‘Crypto asset account number’ means a unique account assigned by the CASP to the CASP’s client.

2.6.10. ‘Unique transaction reference number’ means a specific identifier that can be used to determine the exact transaction between the originator and beneficiary.

2.6.11. ‘Network using distributed ledger or similar technology,’ includes a digital system for recording the transaction of assets in which the transactions and their details are recorded in multiple places at the same time.

3. COMPLIANCE CONSIDERATIONS

Zero-threshold application of the travel rule in business relationships

3.1. A zero threshold applies per crypto asset transfer for business relationships, this means that all crypto asset transfers regardless of the amount must comply with the travel rule and must have the information as required in terms of Directive 9.

PUBLIC COMPLIANCE COMMUNICATION 61 OF 2026 (PCC 61) ON PROVIDING GUIDANCE CONCERNING THE IMPLEMENTATION OF THE “TRAVEL RULE” RELATING TO CRYPTO ASSET TRANSFERS AS DIRECTED BY DIRECTIVE 9 OF 2024, WHICH CAME INTO EFFECT ON 30 APRIL 2025.

3.2. The zero threshold that applies for the travel rule should not be confused with the single transaction threshold set out in paragraph 4.5 of the Directive that determines the scope of customer due diligence (CDD) measures applicable to accountable institutions.

Verify for accuracy

3.3. The term 'verify the information' and 'verify for accuracy,' means that an accountable institution must ensure the information concerning the client that is captured as required in terms of Directive 9 when processing a crypto asset transfer, has been obtained through CDD.

3.4. Before entering into a business relationship with a client, the CASP must have conducted CDD on its client in compliance with the FIC Act and in terms of the CASP's risk management and compliance programme (RMCP).

3.5. When an ordering CASP processes a once-off single crypto asset transfer below R5 000 which is not conducted as part of a business relationship, the obligation to verify the information requested in paragraph 4.5 does not apply. The accountable institution would still have to obtain and record information set out under paragraph 4.5 of Directive 9 and transmit the information in respect of the originator and beneficiary to the recipient CASP.

3.6. However, if there is a suspicion of money laundering, terrorist financing or proliferation financing (ML, TF or PF) in respect of such transaction then the accountable institution, acting as ordering crypto asset service provider, must verify the information pertaining to the originator.

3.7. Revised FIC Guidance Note 7A (2025) sets out guidance on the single transaction threshold. The FIC Act defines a single transaction for purposes of CDD, as a transaction other than a transaction concluded in the course of a business

PUBLIC COMPLIANCE COMMUNICATION 61 OF 2026 (PCC 61) ON PROVIDING GUIDANCE CONCERNING THE IMPLEMENTATION OF THE "TRAVEL RULE" RELATING TO CRYPTO ASSET TRANSFERS AS DIRECTED BY DIRECTIVE 9 OF 2024, WHICH CAME INTO EFFECT ON 30 APRIL 2025.

Page 8 of 24

relationship and where the value of the transaction is not less than R5 000 (the single transaction threshold as set out in regulation 1A of the Money Laundering and Terrorist Financing Control Regulations).

3.8. In the case of crypto asset transfers that constitute single transactions below R5 000, accountable institutions are reminded that section 20A of the FIC Act prohibits conducting transactions on behalf of anonymous clients, the CASP must obtain and record information on the client.

Single transaction or business relationship

3.9. A business relationship is an arrangement between a client and an accountable institution for the purpose of concluding transactions on a regular basis. A single transaction is a transaction that is either (a) a transaction other than a transaction concluded in the course of a business relationship and (b) where the value of the transaction is not less than the amount of R5 000.

3.10. From the definition of a single transaction the emphasis is placed on one transaction. Accountable institutions must carefully assess, on a factual and risk-based basis, whether the nature, duration and frequency of their interactions with a client constitute the establishment of a business relationship or a single once-off transaction.

3.11. Where, based on a factual and risk-based assessment, a business relationship is established, the customer due diligence and targeted financial sanctions obligations set out in sections 21F, 21G, 21H and 28A of the FIC Act and other relevant sections apply. This is distinct from a single once-off transaction, where the applicable obligations are determined in accordance with Directive 9 and the FIC Act.

PUBLIC COMPLIANCE COMMUNICATION 61 OF 2026 (PCC 61) ON PROVIDING GUIDANCE CONCERNING THE IMPLEMENTATION OF THE "TRAVEL RULE" RELATING TO CRYPTO ASSET TRANSFERS AS DIRECTED BY DIRECTIVE 9 OF 2024, WHICH CAME INTO EFFECT ON 30 APRIL 2025.

Page 9 of 24

Page 10 of 24

Enhanced due diligence

3.12. The CASP should determine which factors make a crypto asset transfer higher risk, and apply enhanced measures to such crypto asset transfers, factors may include but are not limited to:

3.12.1. The transaction is unusual for the client type.

3.12.2. Either the originator or beneficiary are based in a high-risk country.

3.12.3. The transaction is linked to a designated person.

3.12.4. The client is high risk.

3.12.5. The funds are coming from or going to an unhosted wallet.

3.12.6. Crypto assets are sent to or received from high-risk or adverse media related counterpart CASPs.

3.12.7. Where the beneficiary information received from the ordering CASP does not match the beneficiary CASP's own records for the account holder (a name mismatch).

Immediate and secure transmission

3.13. The information transferred must be done so in a safe and immediate manner, this could entail:

3.13.1. Data not being susceptible to unauthorised access or altering.

3.13.2. Personal information data is protected and transmitted confidentially.

3.13.3. Data is not susceptible to fraud, manipulation, or interception.

3.13.4. End to end encryption between the originator and beneficiary.

> **Immediate and secure transmission of originator and beneficiary information**

>

> Ordering and intermediary CASPs must transmit the required information (referred to in paragraphs 4.2; 4.4 and 4.5 of Directive 9) prior to or simultaneously with the transfer to the recipient CASP or intermediary CASP, as appropriate.

>

> Such information can be transmitted in batches but must still comply with transmitting the information prior to or simultaneously with the crypto asset transfers. Such information is not

PUBLIC COMPLIANCE COMMUNICATION 61 OF 2026 (PCC 61) ON PROVIDING GUIDANCE CONCERNING THE IMPLEMENTATION OF THE “TRAVEL RULE” RELATING TO CRYPTO ASSET TRANSFERS AS DIRECTED BY DIRECTIVE 9 OF 2024, WHICH CAME INTO EFFECT ON 30 APRIL 2025.

allowed to be sent after the transfer is conducted, that is, post facto transmission is not permitted.

Ordering and intermediary CASPs must transmit and store the information referred to (referred to paragraphs 4.2; 4.4 and 4.5 of Directive 9) in a secure manner and protect the integrity and availability of the required information – to facilitate record keeping and to protect the information from unauthorised disclosure.

3.14. The Centre recommends the pre-settlement authorisation of transactions to ensure travel rule information is obtained prior to processing the crypto transaction.

3.15. There is no exemption to the Directive, post facto submission of travel rule information is not allowed (no buffer time can be applied). CASPs are nevertheless required to take reasonable steps to comply with Directive 9, having regard to their operational capacity, system resilience, and good-faith efforts to implement compliant solutions, while working towards full alignment with the Directive requirements. Where system interoperability causes delay an accountable institution can consider:

3.15.1. Suspension until all travel rule information has been obtained, and only thereafter transfer value to the client.

3.15.2. Alternatively, provide information before proceeding with the transaction.

3.16. The accountable institution should conduct a risk assessment to determine which counterpart CASPs systems impact operability and causes a delay.

Counterparty CASP due diligence

3.17. A risk-based approach should be adopted when dealing with counterpart CASPs. In this regard, enhanced due diligence should be applied to CASPs that pose a heightened risk of ML, TF and PF.

PUBLIC COMPLIANCE COMMUNICATION 61 OF 2026 (PCC 61) ON PROVIDING GUIDANCE CONCERNING THE IMPLEMENTATION OF THE "TRAVEL RULE" RELATING TO CRYPTO ASSET TRANSFERS AS DIRECTED BY DIRECTIVE 9 OF 2024, WHICH CAME INTO EFFECT ON 30 APRIL 2025.

Page 11 of 24

3.18. The Centre recommends that the CASP should conduct CDD on the counter party ordering CASP.

3.19. Prior to conducting crypto asset transfers, the ordering CASP must scrutinise the counterpart CASP information against the targeted financial sanctions list and should conduct CDD on the counterpart CASP. Important factors to consider when conducting due diligence include but are not limited to:

3.19.1. Identify and verify the counterpart CASP, authorised representative and beneficial owners.

3.19.2. Determine whether the entity has the necessary data protection and privacy controls in place.

3.19.3. Whether there is negative media coverage regarding the counterpart CASP, including but not limited to, linking the entity to criminal actors.

3.19.4. Are there any concerns regarding terrorist financing, proliferation financing or dealing with designated persons on the TFS list, when dealing with the CASP.

3.19.5. Whether the counterpart CASP is licensed or registered in the jurisdiction from which they operate. Where a CASP is established in a jurisdiction that requires licensing or registration, but the CASP is not licensed or registered, this is a high-risk indicator.

3.19.6. If the counterpart CASP is not licensed nor registered with an AML supervisory body, enhanced risk mitigation measures should be considered to be implemented by the ordering CASP. Refer to PCC 57 which sets out additional guidance on counterpart CASPs. Complying with this requirement could entail the ordering CASP engaging with the AML supervisory body in the counterpart CASP's jurisdiction to obtain information regarding licensing and registration.

3.19.7. The risk level of the jurisdiction within which the counterpart CASP is located or is operating from.

3.19.8. Historic transaction pattern of the CASP and indicators of compliance.

3.19.9. Whether or not the counterpart CASP is implementing the travel rule.

PUBLIC COMPLIANCE COMMUNICATION 61 OF 2026 (PCC 61) ON PROVIDING GUIDANCE CONCERNING THE IMPLEMENTATION OF THE "TRAVEL RULE" RELATING TO CRYPTO ASSET TRANSFERS AS DIRECTED BY DIRECTIVE 9 OF 2024, WHICH CAME INTO EFFECT ON 30 APRIL 2025.

3.19.10. Full disclosure on the locations of the counterpart CASP's clients.

3.19.11. Published information about regulatory sanctions by supervisory bodies.

3.19.12. Whether the counterpart CASP can reasonably be expected to protect the confidentiality of the information transmitted.

3.19.13. Whether the counterpart CASP can reasonably be expected to avoid dealing with designated persons or entities that are identified on the TFS list pursuant to a resolution of the UNSC.

3.20. While counterpart CASP due diligence is not required for every individual crypto asset transaction, the CASP should nevertheless refresh their counterpart CASP due diligence on an ongoing basis and when a risk emerges from the relationship in line with the CASP's risk-based approach.

3.21. The Centre recommends that CASPs should conduct assessments on an ongoing basis (or regularly) to determine interoperability and compatibility with counterpart CASPs travel rule compliance tools.

What are the sunrise considerations?

A 'sunrise consideration' pertains to the scenario where two CASPs are based in different jurisdictions, and only one of the jurisdictions applies the travel rule. This could mean that the potential counterpart CASP does not comply with the travel rule requirements. CASPs that are subject to Directive 9 are reminded that they must comply with the requirements of the travel rule in all instances and therefore must receive and send the required information concerning the crypto asset transfer as set out in Directive 9.

PUBLIC COMPLIANCE COMMUNICATION 61 OF 2026 (PCC 61) ON PROVIDING GUIDANCE CONCERNING THE IMPLEMENTATION OF THE "TRAVEL RULE" RELATING TO CRYPTO ASSET TRANSFERS AS DIRECTED BY DIRECTIVE 9 OF 2024, WHICH CAME INTO EFFECT ON 30 APRIL 2025.

PUBLIC COMPLIANCE COMMUNICATION 61 OF 2026 (PCC 61) ON PROVIDING GUIDANCE CONCERNING THE IMPLEMENTATION OF THE "TRAVEL RULE" RELATING TO CRYPTO ASSET TRANSFERS AS DIRECTED BY DIRECTIVE 9 OF 2024, WHICH CAME INTO EFFECT ON 30 APRIL 2025.

Intermediary CASP considerations

3.22. From the definition in Directive 9 of an 'intermediary crypto asset service provider', the intermediary does not necessarily establish a business relationship with either the originator or beneficiary.

Scenario A

Financial services provider (FSP) CASP A onboards client X and provides financial advisory services on which crypto asset to purchase and refers the client to CASP B for the purchase of the crypto asset. Client X then purchases the crypto assets directly from CASP B and thereafter transacts via CASP B's platform. In this scenario, at a minimum FSP CASP A conducted a single transaction with client X, while CASP B has established a business relationship with client X, through its ongoing transactions. Where FSP CASP A provides ongoing financial advisory services to client X, a business relationship exists for advisory purposes; however, Directive 9 obligations apply only where the FSP CASP actually provides or engages in crypto asset transfers as contemplated in items 12 or 22 of Schedule 1 to the FIC Act.

CASP B is not an intermediary in this scenario, as a direct business relationship has been formed with client X. CASP B must comply with Directive 9.

Scenario B

FSP CASP A onboards client X and provides financial advisory services on which crypto asset to purchase. Client X then purchases crypto via FSP CASP A's platform. FSP CASP A platform is supported by CASP B platform in the background. Client X interacts with FSP CASP A. CASP B provides intermediary crypto asset transaction processing services to FSP CASP A. FSP CASP A has established a business relationship with the client X, through its ongoing transactions.

CASP B is an intermediary in this scenario. However, CASP B must still comply with Directive 9 as well as FSP CASP A.

Page 14 of 24

3.23. Where the CASP receives a crypto transaction from originating CASPs via blockchain and on sends to a beneficiary CASP, then the CASP acts as an intermediary for purposes of the Directive 9.

4. TRAVEL RULE DATA MONITORING CONSIDERATIONS

4.1. As the CASP must follow a risk-based approach, the applied operating systems by the CASP should enable and ensure risk-based compliance. The Centre does not prescribe the technology or software that the CASP should use to ensure risk-based compliance with the Directive 9 obligations. The Centre encourages CASPs to assess whether their chosen and applied travel rule solution aligns to interoperable standards to enable and foster timely information exchanges.

4.2. CASPs should implement effective real-time monitoring measures to identify promptly instances of non-compliance with the travel rule.

4.3. Real-time monitoring is recommended in order to identify crypto asset transfers that lack the information as required in Directive 9 and then enable the swift suspending of transactions that are non-compliant.

4.4. Directive 9 also requires accountable institutions to conduct post event monitoring, in addition to conducting real-time monitoring to identify instance of non-compliance.

4.5. CASPs can use blockchain analytic tools to assist them monitor transactions to identify transactions that are not compliant with the travel rule requirements. While blockchain analytics may cluster wallet addresses with CASP groups, the Centre cautions that it is not guaranteed such analytical software, without any further human intervention and application of mind, can at all times readily and reliably identify specific legal entities, identity of wallet beneficial owners, or definitively

PUBLIC COMPLIANCE COMMUNICATION 61 OF 2026 (PCC 61) ON PROVIDING GUIDANCE CONCERNING THE IMPLEMENTATION OF THE "TRAVEL RULE" RELATING TO CRYPTO ASSET TRANSFERS AS DIRECTED BY DIRECTIVE 9 OF 2024, WHICH CAME INTO EFFECT ON 30 APRIL 2025.

confirm sanctions exposure. Blockchain analytics, when used by the CASP, may therefore supplement, but cannot substitute for an enquiry and analysis of the "travel rule" data requirements and crypto asset transfer transmission obligations.

4.6. CASPs are advised to have independent compliance functions capability that could conduct sample testing to determine levels of compliance post the crypto asset transfer event.

4.7. Monitoring tools should assess or analyse compliance with the travel rule requirement at both client and jurisdictional level. In this way, clear patterns of non-compliance can be identified.

4.8. Monitoring tools should assess or analyse the levels of volume and value transfer to or from unhosted wallets, as higher levels of transfers may indicate heightened risks of ML, TF, and PF.

4.9. Where the CASP uses an external third-party system to monitor compliance with the travel rule requirements, the CASP remains accountable to ensure the system as a control is adequate and effective.

4.10. Where an accountable institution uses monitoring systems, such systems used to comply with the travel rule obligation for the safe and immediate transmission of the relevant originator and beneficiary data, storing, and monitoring, should enable the following:

- Interoperability with internal and external systems.

- Ability to handle the volumes of transactions processed.

- Ability to identify and suspend or block transactions that are non-compliant (missing information or inaccurate or incomplete information).

Execute or suspend execution, or return a transfer

PUBLIC COMPLIANCE COMMUNICATION 61 OF 2026 (PCC 61) ON PROVIDING GUIDANCE CONCERNING THE IMPLEMENTATION OF THE "TRAVEL RULE" RELATING TO CRYPTO ASSET TRANSFERS AS DIRECTED BY DIRECTIVE 9 OF 2024, WHICH CAME INTO EFFECT ON 30 APRIL 2025.

4.11. The intermediary CASP and the recipient CASP should only execute (complete) a crypto asset transfer when full information, as required in Directive 9 in respect of the originator and beneficiary, is provided to the intermediary and recipient CASPs either prior to or simultaneously with the transfer.

4.12. The requirement to suspend applies to cross-border crypto asset transfers. The CASP should develop a process to suspend a transaction, and where required, request relevant information from the counterpart CASP.

4.13. Where the crypto asset transfer relates to a designated person as envisioned in section 26A of the FIC Act, the CASP's obligation to freeze and file a terrorist property report in terms of section 28A to the Centre applies.

4.14. In the event that a CASP is required to freeze crypto assets, the CASP must immediately, without delay (which is interpreted by the FATF Methodology to be within twenty-four hours), freeze the crypto assets held within the CASP's control (e.g. in the CASP's custodial wallet). Refer to PCC 44A which sets out guidance on targeted financial sanctions, and related matters.

4.15. If the Centre issues a directive under section 34 of the FIC Act to a CASP, the CASP must immediately freeze for a period of 10 working days the transaction or wallet address mentioned in the section 34 directive.

4.16. The RMCP of the CASP must provide for the manner and process by which it will execute, suspend execution, freeze, reject or return crypto asset transfers, in accordance with Directive 9 and section 26B of the FIC Act.

4.17. Where the client of the CASP does not provide the required "travel rule" related information, the CASP may either:

PUBLIC COMPLIANCE COMMUNICATION 61 OF 2026 (PCC 61) ON PROVIDING GUIDANCE CONCERNING THE IMPLEMENTATION OF THE "TRAVEL RULE" RELATING TO CRYPTO ASSET TRANSFERS AS DIRECTED BY DIRECTIVE 9 OF 2024, WHICH CAME INTO EFFECT ON 30 APRIL 2025.

Page 17 of 24

4.17.1. Suspend the given value to the client until such time the required "travel rule" related information, is provided, or

4.17.2. Reject the transaction, and transfer the funds back to the sender, where the client is a beneficiary (provided no designated persons are involved in the transaction). Refer to the public compliance communication 44A which provides guidance on freezing of funds.

4.17.3. The challenge regarding the suspension of funds becomes apparent when clients do not provide the travel rule information prior to or simultaneously with the transaction, resulting in the CASP holding the funds which are meant for their client as beneficiaries, in suspense indefinitely. In this scenario the CASP must consider filing a suspicious or unusual transaction report in terms of section 29 of the FIC Act. The CASP can only return the funds to the sender, where there are no designated persons involved and the sender is not a designated person. This scenario highlights the benefit of following a pre-authorization approach.

4.17.4. The CASP must not give value to a client as beneficiary, where funds are held in suspense pending travel rule information, until such time the travel rule information is obtained.

4.17.5. The CASP must reject transactions where their clients are the originator, where travel rule information has not been provided.

4.18. A process of escalation when non-compliant transactions are identified must be developed and implemented. The process should provide for either the remediation followed by execution of a transaction, the suspension of a non-compliant transaction, and the rejection where required information is not provided within escalation timelines. There are no exemptions to the travel rule obligation.

PUBLIC COMPLIANCE COMMUNICATION 61 OF 2026 (PCC 61) ON PROVIDING GUIDANCE CONCERNING THE IMPLEMENTATION OF THE "TRAVEL RULE" RELATING TO CRYPTO ASSET TRANSFERS AS DIRECTED BY DIRECTIVE 9 OF 2024, WHICH CAME INTO EFFECT ON 30 APRIL 2025.

Clear breach and remediation processes should be set out as part of a CASP's RMCP.

Monitoring to identify STR, reportable transactions

4.19. Where CASPs detect activity with a client that seems to be counterpart CASP type activity, such as high volume of transactions, this should be reported to the Centre, as it could indicate that the client is an unlicensed or unregistered CASP.

4.20. Given the nature of crypto asset transfers, and the speed thereof, CASPs are discouraged from adopting end-to-end manual screening measures, and are strongly encouraged to automate the monitoring of transactions. CASPs should consider the use of blockchain analytics to monitor transactions across a blockchain to identify possible suspicious and unusual transactions. Accountable institutions are advised to consider the use of automated monitoring of crypto asset transfers to identify reportable transactions or activity in line with the FIC Directive 5, read together with PCC 45.

Targeted financial sanctions screening

4.21. Accountable institutions are advised to consider the use of real-time automated sanctions screening of crypto asset transfers to ensure compliance with section 26B of the FIC Act, read together with section 28A of the FIC Act. Kindly refer to PCC 44A for guidance on targeted financial sanctions, read together with the FIC targeted financial sanctions manual.

4.22. All crypto asset transfers must be scrutinised against the UNSC targeted financial sanctions list, which is also available on the FIC website www.fic.gov.za, to determine whether any designated persons or entities are linked to the crypto asset transfer. This includes, but is not limited to, the information regarding the originator, beneficiary and counterpart CASP which could include an intermediary CASP and wallet addresses (distributed ledger address).

PUBLIC COMPLIANCE COMMUNICATION 61 OF 2026 (PCC 61) ON PROVIDING GUIDANCE CONCERNING THE IMPLEMENTATION OF THE "TRAVEL RULE" RELATING TO CRYPTO ASSET TRANSFERS AS DIRECTED BY DIRECTIVE 9 OF 2024, WHICH CAME INTO EFFECT ON 30 APRIL 2025.

4.23. In no scenario may the crypto asset value be given to the client prior to scrutinising the information concerning the client against the targeted financial sanctions list. The CASP must comply with the targeted financial sanctions obligations as set out in section 26A, 26B, 26C and 28A of the FIC Act.

4.24. The CASP must apply an immediate automatic obligation to freeze crypto assets where it is linked to a designated person or entity.

4.25. The manner and processes by which the CASP ensures compliance with the travel rule Directive and targeted financial sanctions obligations must be documented in the CASP's RMCP.

Counterpart CASP system considerations

4.26. The CASP should consider assessing whether the counterpart CASP has the required systems and travel rule compliance tools which enables the counterpart to:

4.26.1. Send and receive all the information as required in Directive 9, regardless of the amount of the crypto asset transfer.

4.26.2. Transmit or receive the relevant information within the period required, that is either as part of the crypto asset message prior to or simultaneously.

4.26.3. Scrutinise the information sent and received against the targeted financial sanctions list before the transaction is completed on the blockchain and where required immediately apply a freeze without delay.

4.26.4. Ensure that the required crypto asset transfer data fields and message standards are applied and cater for a range of various crypto asset transfers (different crypto assets have different address fields etc.).

4.26.5. Ensure that it is able to detect missing information, and apply the requirements to execute, suspend or return a crypto asset transfer.

PUBLIC COMPLIANCE COMMUNICATION 61 OF 2026 (PCC 61) ON PROVIDING GUIDANCE CONCERNING THE IMPLEMENTATION OF THE "TRAVEL RULE" RELATING TO CRYPTO ASSET TRANSFERS AS DIRECTED BY DIRECTIVE 9 OF 2024, WHICH CAME INTO EFFECT ON 30 APRIL 2025.

4.26.6. Ensure there is system functionality that enables further queries or information on the impacted crypto asset transfer to be communicated.

4.26.7. Ensure it is possible to identify the correct counterpart CASPs – the CASP's systems should enable sending of the travel rule data to the correct counterpart.

4.26.8. Enable monitoring of crypto asset transactions (including Directive 9 monitoring, reportable transaction monitoring, sanctions screening etc.).

4.26.9. Enable data protection and privacy.

4.26.10. Enable record keeping and audit trails.

4.26.11. Automated crypto assets transaction monitoring systems, and compliance with Directive 5 and PCC 45. Adequate processes and/or technology in place to monitor market trends.

CASPS and transfers to or from unhosted wallets

4.27. Where the CASP is the ordering or recipient CASP and is transferring or receiving the crypto asset for or on behalf of their client to an unhosted wallet, they should obtain information from their client regarding the identity of the person holding the unhosted wallet in order to comply with the requirements of Directive 9. Therefore, the CASP must collect the required originator and beneficiary information even when an unhosted wallet is involved in a transfer.

4.28. Transfers from the CASP's client to unhosted wallets does pose a heightened risk of ML, TF, and PF, as there is no beneficiary CASP that has conducted CDD on its client. The CASP should apply enhanced due diligence on its client that requests the CASP to process transfers to unhosted wallets, as such clients may pose a heightened ML, TF, and PF risk. The CASP should consider whether the circumstances give rise for the need to file a suspicious activity or transaction report with respect of its client relating to this risk enhancing activity.

PUBLIC COMPLIANCE COMMUNICATION 61 OF 2026 (PCC 61) ON PROVIDING GUIDANCE CONCERNING THE IMPLEMENTATION OF THE "TRAVEL RULE" RELATING TO CRYPTO ASSET TRANSFERS AS DIRECTED BY DIRECTIVE 9 OF 2024, WHICH CAME INTO EFFECT ON 30 APRIL 2025.

4.29. Where the transaction involves an unhosted wallet where the beneficiary or the originator is an unhosted wallet, sufficient control measures must be implemented to ensure compliance with Directive 9.

4.30. The CASP should obtain travel rule information from reliable and verifiable data sources on the unhosted wallet recipient, which may include information obtained from the client, supplemented where appropriate by additional independent checks, in accordance with a risk-based approach.

4.31. The CASP must monitor client transactions to determine patterns of transfers to or from unhosted wallets. A comprehensive client profile should be established to fully understand the nature of the client's business, source of funds, purpose of the transactions, volume and value of transactions and duration of business relationship. This is all considered to determine a client's profile.

4.32. Peer-to-peer crypto transfers, or unhosted- to-unhosted wallets face a heightened risk of being abused for ML, TF, and PF because an accountable institution is not a party to the transfer which essentially bypasses compliance obligations. CASP should also consider whether the circumstances give rise for the need to file a suspicious activity or transaction report with respect of its client relating to this risk enhancing activity.

Training and record keeping

4.33. The CASP must provide adequate training to their employees on travel rule compliance requirements. Systems should be developed to ensure the relevant information is captured.

4.34. The CASP must provide adequate training to employees who are involved in the processing and monitoring of crypto asset transfers to enable them to understand

PUBLIC COMPLIANCE COMMUNICATION 61 OF 2026 (PCC 61) ON PROVIDING GUIDANCE CONCERNING THE IMPLEMENTATION OF THE "TRAVEL RULE" RELATING TO CRYPTO ASSET TRANSFERS AS DIRECTED BY DIRECTIVE 9 OF 2024, WHICH CAME INTO EFFECT ON 30 APRIL 2025.

the requirements of travel rule compliance and detect instances of non-compliance.

4.35. In order for the RMCP and its risk-based approach being applied by the CASP accountable institution, being considered adequate with the FIC Act, read with Directive 9, the CASP should regularly consider and assess, and then take into account and mitigate those identified high risk factors relating to travel rule compliance. These mitigation steps are important to ensure the CASP proactively through time manages its risks, as these risks are evolving and dynamic. As a consequence, the CASP should ensure that its risk assessments are conducted regularly and must be reviewed and updated, for instance, when trigger events occur and from time to time.

4.36. CASPs must provide safe record keeping of travel rule information. CASPs must be able to provide travel rule information, upon request by any competent authority, such as the regulator or supervisory body.

**Travel rule tools: interoperability challenge and tool deficiencies**

4.37. CASP systems should be developed to ensure that compliance with the travel rule requirement is possible. This includes, but is not limited to, interoperability with counterpart CASPs systems to enable the transfer of the relevant information when the crypto asset transfers are processed.

4.38. Where an accountable institution adopts a third-party service provider to comply with the travel rule requirements, the accountable institution remains responsible for ensuring the system is fit for purpose and actually holds, transmits, and stores originator and beneficiary information securely and immediately, in accordance with Directive 9.

PUBLIC COMPLIANCE COMMUNICATION 61 OF 2026 (PCC 61) ON PROVIDING GUIDANCE CONCERNING THE IMPLEMENTATION OF THE "TRAVEL RULE" RELATING TO CRYPTO ASSET TRANSFERS AS DIRECTED BY DIRECTIVE 9 OF 2024, WHICH CAME INTO EFFECT ON 30 APRIL 2025.

4.39. Accountable institutions are advised to seek independent testing (either internal or external) to determine whether their compliance controls (including systems) are functioning in a manner which ensures compliance with the travel rule.

5. COMMUNICATION WITH THE CENTRE

5.1. The Centre has a dedicated compliance contact centre geared to assist accountable institutions to understand their FIC Act obligations in terms of the FIC Act. Call the compliance contact centre on telephone number: (012) 641 6000 and select option 1.

5.2. Alternatively, compliance queries may also be submitted online by clicking on: https://www.fic.gov.za/compliance-queries/ or visiting the Centre's website and submitting an online compliance query.

Issued By:

The Acting Director

Financial Intelligence Centre

30 March 2026

PUBLIC COMPLIANCE COMMUNICATION 61 OF 2026 (PCC 61) ON PROVIDING GUIDANCE CONCERNING THE IMPLEMENTATION OF THE "TRAVEL RULE" RELATING TO CRYPTO ASSET TRANSFERS AS DIRECTED BY DIRECTIVE 9 OF 2024, WHICH CAME INTO EFFECT ON 30 APRIL 2025.