South Africa has licensed more than 300 crypto asset service providers (CASPs), but the rapid growth of decentralised finance (DeFi) is creating new regulatory challenges for the Financial Sector Conduct Authority (FSCA).
This was the word from Unathi Kamlana, commissioner of the FSCA, delivering the 2026 Annual Public Lecture at the University of Cape Town, last week.
The lecture, themed: “Governing the invisible: Leadership, innovation and accountability in the financial sector", explored how artificial intelligence (AI), DeFi and open finance are reshaping financial services and challenging traditional approaches to regulation, governance and accountability.
According to Kamlana, as an increasing share of crypto activity moves beyond traditional, licensed intermediaries, the regulator has established a functioning supervisory perimeter for centralised crypto actors; however, DeFi is increasingly challenging the principles underpinning conventional financial regulation.
SA was the first jurisdiction on the African continent to establish a licensing framework for CASPs at scale, taking a “measured and pragmatic approach” to regulating the crypto asset ecosystem, focusing on licensing and supervising entities providing crypto asset services, rather than attempting to regulate the underlying technology, he noted.
“Today, more than 300 CASPs have been licensed by the FSCA. This has taken place alongside the rapid growth of the crypto asset ecosystem. An estimated 7.8 million South Africans now own or trade crypto assets, while stable coins are increasingly being used for cross-border payments and remittances across the SADC region,” noted Kamlana.
He said this represented a significant shift from an uncertain regulatory environment, to one with a functioning supervisory perimeter around centralised actors serving the expanding crypto market.
However, Kamlana warned that the regulatory progress around centralised crypto businesses represents only part of the picture.
“The reality is that an increasing share of activity within this market is no longer taking place through licensed, centralised intermediaries. Instead, it is taking place through DeFi protocols. This presents a fundamentally different regulatory question.”
Code cannot hold FSCA licence
Decentralised finance refers to financial services delivered through blockchain networks and smart contracts, rather than traditional intermediaries, such as banks, brokers or insurers.
Kamlana described AI, DeFi and open finance as increasingly “invisible” technologies because they operate in the background of financial services.
AI influences decisions, DeFi replaces traditional intermediaries with distributed networks and smart contracts, while open finance makes the movement of customers’ financial data less visible.
“As these technologies become less visible, governance and accountability must become more visible. Although each is transforming the financial sector in different ways, they share one defining characteristic: they are increasingly invisible.”
Kamlana pointed out DeFi fundamentally challenges the traditional model of financial regulation because it can remove the identifiable intermediary around which regulation has historically been built.
Traditional financial-sector regulation assumes there is an intermediary that can be identified, licensed, supervised and, where necessary, held accountable. DeFi changes that model by allowing distributed networks and self-executing computer code, known as smart contracts, to perform intermediary functions, he continued.
“The intermediary has not disappeared; it has simply become invisible. This is exactly where the challenge of governing the invisible becomes real.
“We are now increasingly regulating activity performed through invisible digital infrastructure – where there may be no company, no board of directors, no chief executive officer, no registered office and, in many instances, no natural person to supervise or hold accountable. And code, at least for now, cannot apply for or hold a FSCA licence.”
The problem is particularly acute because smart contracts execute transactions according to their programming, without the discretion or fiduciary obligations associated with human intermediaries.
Kamlana added smart contracts could not pause to determine whether a transaction appeared suspicious, or whether a consumer was vulnerable. When a DeFi protocol is exploited, the consequences can be severe, with losses potentially running into billions of rands.
He cited the 2022 Mango Markets incident as an example. The decentralised lending and trading platform lost approximately $116 million, after an attacker manipulated prices in a manner the protocol's smart contracts were designed to accept.
Despite this, the regulator does not believe the response should be to prohibit DeFi, he added.
“None of this suggests that DeFi should be prohibited. It does, however, require regulators to rethink how regulatory objectives can be achieved in an environment where traditional intermediaries may no longer exist.”
Regulate function, not tech
Kamlana said the regulatory approach should increasingly focus on what a protocol actually does, rather than the technology or legal structure underpinning it.
He argued that regulators should identify individuals or groups exercising effective control over DeFi protocols, including those controlling governance tokens, approving software upgrades or setting key operational parameters, and attach corresponding regulatory responsibilities to them.
“In other words, we should follow the function, not just the form. If a protocol performs the economic role of an exchange, a lending platform or another regulated financial service, then it must meet the standards that are commensurate with that activity,” said Kamlana.
“The invisibility of the intermediary cannot become a shield against the obligations associated with that activity. I believe this will be the next chapter of crypto regulation, not only in South Africa but globally.”
This approach could mark an important evolution in crypto regulation as financial services increasingly become embedded in software and decentralised networks rather than delivered through conventional institutions.
Kamlana added the FSCA is updating its 2023 Crypto Asset Market Study to better understand how the market has evolved since the first licences were issued.
The study will examine changes in consumer behaviour, the development of DeFi and how the broader crypto ecosystem has changed following South Africa's exit from the Financial Action Task Force's grey list in October 2025.
“You cannot govern what you cannot measure. That is why evidence, data and market intelligence remain central to the FSCA's approach,” he said.
“Only by understanding how these markets evolve can regulation evolve with them.”
Share
