Bill Hughes 🦊@BillHughesDC
I am frankly dumbstruck by the news out of South Africa 🇿🇦 that newly proposed regulations would upend self custody in that country.
South Africa's National Treasury has published draft Capital Flow Management Regulations (treasury.gov.za/public%20comme…) to replace its 1961 exchange-control regime, and the proposal extends sixty-five-year-old capital controls designed for gold bullion and foreign banknotes directly onto self-custodied crypto.
The result is one of the most invasive treatments of non-custodial wallets proposed anywhere in the world.
The mechanics are clear and severe. Any purchase, sale, loan, or transfer of crypto above a Treasury-set threshold must run through a licensed "authorised crypto asset service provider." Cross-border movement of crypto requires permission. Holdings above the threshold must be declared within thirty days, and Treasury can compel their sale at market price. Crypto can be attached by administrative order, without prior judicial process, on reasonable suspicion of contravention. Penalties run to R1 million, five years in prison, or the full value of the crypto involved.
The provision that is the real showstopper is Regulation 25(5). Where crypto has been forfeited to the state, the owner must "furnish full particulars in writing of all and any passwords, personal identification numbers or codes" necessary to give Treasury access.
That seems to be a statutory compelled disclosure of seed phrases and private keys.
There is no carve-out, no judicial check inside the regulation itself, no recognition that the keys are not separable from the user's right against self-incrimination or right to privacy under the South African Constitution.
The reason that provision appears to exist is Treasury understands that, without it, the rest of the framework cannot reach a self-custody user. Exchange-control logic depends on gatekeepers — banks, dealers, intermediaries that the state can appoint and command. Self-custody removes the gatekeeper by design. So the regulation reaches the only places it still can: the on-ramp, the holder's declaration, and ultimately the holder's body and devices at the border. Regulations 4 and 5 give enforcement officers the power to search travelers entering or leaving the country, demand they "produce" any crypto in their possession or control, and seize it on suspicion alone.
As you well know, this is not how most of the rest of the world is approaching self-custody. The EU's Markets in Crypto-Assets framework regulates issuers and crypto-asset service providers and explicitly leaves self-custody alone. The UK's financial services regime regulates exchanges and custodians and treats unhosted wallet software as out of scope. The US has spent the last two years walking back its most aggressive theories — the SAB 121 reversal, the broker-dealer rule rollback, the IRS DeFi broker rule rescission — precisely because policymakers across both parties recognized that you cannot regulate non-custodial software the way you regulate a bank. FATF's own guidance distinguishes wallet software publishers from custodial intermediaries.
South Africa's draft does the opposite. It very much intends to reach through the software to the user.
The technical reality the draft ignores is that a non-custodial wallet is a key-management tool, not a financial intermediary. @MetaMask does not hold user funds. It does not see private keys. It cannot freeze, seize, or surrender anything to a regulator. Compelling its users to declare, surrender, or hand over keys does not make Treasury more effective at managing capital flows. It makes ordinary South Africans criminally liable for using software the rest of the world treats as legitimate self-custody infrastructure.
Treasury has opened a public comment period, and anyone with a dog in the fight should ask that the compelled-key provision be struck. The cross-border search-and-seizure regime should not extend to self-custodied wallets. And the framework should distinguish — as nearly every other major jurisdiction now does — between intermediated services and the user's own software.
