Most Bitcoin investors do not have a clear mental model of what happens to their data when they buy Bitcoin on a licensed exchange. They know SARS can see it somehow, but the exact visibility is unclear. This article traces the data path from start to finish. At onboarding, you provide identity and financial information. During holding, the exchange has your account but SARS does not. At reporting, CARF sends SARS a structured summary. The result is that SARS sees your transaction history, not your current holdings. It sees what you bought, what you sold, and the amounts. It does not see what you still own unless you declare it.
Understanding this distinction is important. It shapes your compliance obligations and explains why the choice of provider matters for your record.
The Onboarding Data
When you open an account with SimplB or any FSCA-licensed Bitcoin provider, you go through FICA Know Your Client (KYC) onboarding. This process captures your legal identity, your residential address, your tax file number, and your beneficial ownership status. For transactions above certain thresholds, you also declare your source of funds.
This KYC data is what the exchange is required to collect under FICA. The exchange holds this data in its own systems. At the moment of onboarding, nothing is reported to SARS. FICA requires the exchange to have the information, not to share it with SARS immediately. The exchange is your counterparty in the transaction, not SARS’s agent at that moment.
The exchange is, however, required to report suspicious transactions to the Financial Intelligence Centre. If the pattern of your activity looks unusual or the amounts seem disconnected from your declared source of funds, the exchange flags it. Most onboarding goes without incident. But the requirement exists to catch potential money laundering.
For larger transactions, enhanced due diligence applies. If you are buying Bitcoin with a R500,000 lump sum, the exchange will ask you to prove the source. A recent bank statement showing that you transferred the money from your salary account is sufficient. An unexplained source (a suitcase of cash, an inheritance not yet documented) will trigger further questions. This is not prosecution. It is standard for any South African financial institution.
The Holding Period
Once your account is open and you own Bitcoin, the data picture becomes clearer. You have Bitcoin stored on the exchange’s infrastructure (or in custody, if you are using a multi-signature vault). The exchange knows you own it. SARS does not receive any automatic notification about your holding.
This is the critical distinction. Holding Bitcoin on an exchange is visible to the exchange, not to SARS in real time. SARS does not receive a daily or monthly report of everyone’s holdings. It receives annual transaction summaries through CARF. If you buy Bitcoin in January and never sell it, SARS knows about the purchase, but it does not automatically know you still own it unless you declare it elsewhere.
Self-custody is even more opaque. If you withdraw your Bitcoin from an exchange into a personal wallet, SARS’s visibility ends. SARS sees the withdrawal from the exchange’s perspective, but the exchange does not see inside your wallet. Only you know what you own.
This creates a gap in SARS’s visibility. For investors who hold Bitcoin entirely in self-custody, SARS’s knowledge is limited to what appears in their hands through other channels: a gift declaration, an estate when they die, or a voluntary tax disclosure.
The CARF Reporting
On or around June each year, every FSCA-licensed exchange sends SARS a structured file containing annual transaction data for all South African clients. The file includes your name, tax number, every buy and sell transaction, the dates, the rand amounts, and the Bitcoin quantities. This is what CARF mandates.
SARS’s systems process this file and match it against your tax return. Did you declare the gains from Bitcoin sales? Did you report income from Bitcoin staking or yield? If the CARF data shows transactions that do not appear on your return, SARS flags it.
The reporting is annual, not real-time. If you buy Bitcoin in March and sell it in April, SARS does not know about the sale for months. It learns about it when the exchange submits the CARF file. This delay matters because it means you have a window between the transaction and the reporting to correct errors or disclose omissions.
The CARF data is also only as good as the exchange’s records. If the exchange miscalculates your cost basis, the CARF report contains the error. If you made an error in your own records that the exchange relied on, that error flows to SARS. For this reason, precision in your purchase records matters. Keep your own records of cost basis and dates, independent of the exchange.
What SARS Cannot See
SARS cannot see Bitcoin held in self-custody. There is no intermediary reporting your holding to anyone. Only you and whoever you tell know what you own. This is the point of self-custody: the decentralisation of visibility.
SARS also cannot see peer-to-peer Bitcoin transactions between individuals. If you sold Bitcoin to a friend, and neither of you reported the transaction to any exchange or service provider, SARS has no automatic visibility. SARS can assess you on income if you should have declared the transaction, but the initial detection depends on your disclosure or on SARS identifying the mismatch in your cost basis at some later point.
Bitcoin held on unregistered foreign platforms exists in a grey zone. If you own Bitcoin on a small, unregulated offshore exchange, SARS does not receive CARF data from that platform because it is not regulated. However, SARS participates in AEOI (Automatic Exchange of Information) with 50 countries. If the platform is based in one of those countries and is captured under that country’s reporting regime, your data may reach SARS indirectly.
The practical point is that unregistered platforms are riskier than licensed platforms, not because they are inherently criminal, but because they create a record that depends on another country’s enforcement and information-sharing with SARS. If SARS requests data through the OECD AEOI network and the platform is based in Germany or Canada, that data will likely be provided. If the platform is in an uncooperative jurisdiction or is already defunct, SARS’s visibility is limited.
The Contrast: Licensed vs Unlicensed
The difference between holding Bitcoin on a licensed South African provider and an unlicensed foreign provider shapes your compliance footprint fundamentally. With a licensed SA provider, you have FICA compliance (identity verification), CARF reporting (SARS gets the data automatically), and local recourse (you can pursue the provider through FSCA if there is a problem). Your record is clean and integrated with the SA tax system.
With an unlicensed foreign provider, you have none of these protections. Your identity verification may be minimal. The provider is not required to report to SARS (though some jurisdictions compel reporting through AEOI). If the provider is hacked or fails, you have no local regulatory recourse. Your record is potentially invisible to SARS unless SARS specifically investigates.
From a compliance perspective, the licensed SA provider creates a defensible record. You can point to CARF data showing your transactions, your cost basis, your tax payments. From an enforcement perspective, SARS can easily reconcile your declared position against the provider’s report. There is less friction, fewer questions.
From a custodial perspective, the licensed provider also provides institutional infrastructure. If you die, your executor can contact the provider and gain access to your Bitcoin through a will or court order. If you lose your hardware wallet, there is no recovery. The licensed provider creates a backstop.
The Self-Custody Reality
Self-custody holds Bitcoin outside the reporting system, which appeals to privacy-conscious investors. SARS cannot see what you hold until you dispose of it. But self-custody creates compliance risks at disposal. When you eventually sell self-custody Bitcoin, your own records of cost basis become critical. SARS will assess you on the gain, and you must be able to prove your acquisition cost and date.
The estate problem with self-custody is severe. If you die without documenting your private keys or leaving access instructions, your Bitcoin is irretrievably lost. Your heirs will never know it existed. SARS may still assess estate duty on the presumed value of your assets, but the coins will be inaccessible. This is the irreversibility of self-custody.
For this reason, most financial advisors recommend that a portion of a Bitcoin holding remain on a licensed exchange or in professional custody. It creates a trail for your executors and a clear record for SARS. The trade-off is that your exchange account is visible to SARS in a way a hardware wallet is not. Many investors find this trade-off rational.
The Foreign Exchange Question
If you hold Bitcoin on a foreign exchange (licensed in another country but not in South Africa), your visibility to SARS depends on whether that exchange’s jurisdiction participates in AEOI. Most developed-country jurisdictions do. The United States, European Union, Canada, and Australia all have AEOI agreements with South Africa.
When you open an account on a foreign licensed exchange, you provide identity and tax information. That exchange reports your activity to its local tax authority. That authority exchanges the information with SARS through the OECD’s framework. The data typically arrives with a lag of one to two years. By the time SARS receives it, your transactions may be a year old.
This lag creates a different compliance timeline. If you have unreported Bitcoin activity on a foreign licensed platform, SARS may not see it for months or years. But it will eventually see it. The absence of immediate visibility should not be confused with absence of visibility altogether.
Practical Documentation
For every Bitcoin transaction, keep a record showing the date, the amount in Bitcoin, the rand value at the time, your cost basis, and the source of funds if relevant. If you are using a licensed SA provider, download your transaction history and keep it backed up. If you are using a foreign platform, take the same approach.
The reason this matters is that your own records become the defence if SARS queries your declared gains. If CARF data and your own records both show the same cost basis and date, SARS’s reconciliation is straightforward. If they differ, you will need to explain the difference or recalculate based on evidence.
For self-custody Bitcoin, the documentation challenge is higher because the exchange is not keeping records for you. You must maintain precise records of every acquisition, the price paid, the date, and any later disposals. This is laborious, but it is the price of privacy.
The critical insight is that SARS’s visibility increases over time and across jurisdictions. From local exchange transactions, SARS sees relatively immediately through CARF. From foreign licensed exchanges, SARS sees within one to two years through AEOI. From self-custody, SARS sees only what you disclose or what forces you to disclose (an audit, a disposal, an inheritance).
For most South African investors, a balanced approach makes sense: hold a portion of Bitcoin on a licensed local provider to create a clear compliance record, and hold the remainder as you choose, whether self-custody or foreign exchanges. The licensed holding is transparent and integrated with SARS. It makes the rest of your position defensible by showing that you are engaged with the regulated system.
This article is for general educational purposes only and does not constitute financial, legal, tax, or exchange control advice. The information reflects the regulatory position as at the date of publication. Your individual circumstances may differ and you should seek qualified professional advice before making any decisions.
