Do you need an FSP licence? The FSCA & FAIS guide for South African businesses

The FSCA is the regulator South African businesses most often get wrong in both directions: some assume it applies to them when it doesn’t, and others discover far too late that it does. The distinction that settles it is simple. An FSP licence is not a general business or operating licence — it is a targeted authorisation to do one specific thing: give financial advice, or act as an intermediary in financial products, for clients. If your business does that, the Financial Sector Conduct Authority and the FAIS Act apply to you in full. If it doesn’t, you need no FSP licence.

This guide sets out who is actually in scope, the licence categories, the fit-and-proper bar you have to clear to hold a licence, the ongoing conduct duties, what the FSCA can do when conduct goes wrong — and the big change on the horizon, the COFI Bill, which as of October 2026 had not yet been tabled in Parliament.

Twin Peaks: who the FSCA actually is

In 2018 South Africa moved to a “Twin Peaks” model of financial regulation under the Financial Sector Regulation Act 9 of 2017. The two peaks split the job in two. The Prudential Authority, housed inside the Reserve Bank, worries about soundness — whether banks and insurers hold enough capital to keep their promises. The Financial Sector Conduct Authority (FSCA), operational since 1 April 2018, is the market-conduct regulator: it cares about how financial firms treat their customers — whether you’re competent, licensed to do what you do, and dealing with clients fairly. This guide is about the FSCA peak.

The question that matters first: are you even in scope?

Because the FSP licence is an authorisation for specific activities rather than a general licence, the threshold question is what you actually do. Under the FAIS Act (Financial Advisory and Intermediary Services Act 37 of 2002), you need an FSP licence, or an appointment as a representative of a licensed FSP, if you render advice or an intermediary service in relation to a financial product:

• Advice — any recommendation, guidance or proposal of a financial nature made to a client about buying, investing in, or varying a financial product.
• Intermediary service — acting between a client and a product supplier so that the client enters into (or manages) a transaction in a financial product: arranging it, collecting premiums, servicing the policy.

If you sell shoes, run a restaurant, or build software, none of that touches you. If you advise on or arrange insurance, investments, retirement products, or — since the FSCA declared crypto assets a financial product in October 2022 — crypto, you are in scope and cannot legally operate without a licence or a representative appointment. The crypto point is live: a licensing regime for crypto asset service providers opened on 1 June 2023, and the FSCA is now actively enforcing against providers operating without one.

The same conduct authority also supervises insurers, retirement funds, and collective investment scheme managers — but for most SME owners wondering “does this apply to me,” the FAIS advice-or-intermediary test is the line. If you’re on the wrong side of it, the rest of this guide is your world.

The FSP licence categories

FAIS doesn’t issue one generic licence. It issues a licence in a category matched to what you do, and within that category you’re approved only for specific product subcategories — short-term insurance, long-term insurance, pension benefits, shares, and so on. Most South African FSPs sit in Category I.

Getting the category and product subcategories right at application matters, because rendering a financial service outside what your licence authorises is itself a contravention, not a technicality.

Fit and proper: the bar to get and keep a licence

The FSCA will not license you — and won’t let you keep the licence — unless you and your key people are “fit and proper.” The requirements live in the Determination of Fit and Proper Requirements (Board Notice 194 of 2017, still the operative instrument), and they run across five areas:

• Honesty, integrity and good standing — a clean record; a history of fraud or dishonesty counts heavily against you, weighed by how serious it was and how long ago.
• Competence — a recognised qualification for your product categories, the regulatory examinations, and relevant experience.
• Continuous Professional Development — ongoing learning, every year.
• Operational ability — the systems, governance and resources to actually run a compliant FSP.
• Financial soundness — not insolvent, and able to meet your liabilities.

Two of these trip people up in practice. The regulatory examinations are pass-or-you-don’t-operate: a key individual must pass the RE1 exam before the FSCA approves them, and a representative must pass the RE5 before appointment, unless they are appointed to work under supervision, which gives them two years from first appointment. And CPD runs on a fixed annual cycle from 1 June to 31 May: 6 hours for one subclass of business, 12 for several subclasses within one class, 18 across more than one class. An FSP that can see a representative won’t make the hours can move them out of an advice role before the cycle ends; once the cycle has closed with the hours short, the FSCA says the FSP must debar the representative.

Key individuals and representatives

FAIS draws a sharp line between two roles, and the obligations differ:

• Key Individual (KI) — the person who manages and oversees the FSP’s financial-services activities. A KI has to be approved by the FSCA and is personally accountable for the firm’s conduct.
• Representative — a person who renders financial services to clients for or on behalf of the FSP, under a written mandate for which the FSP takes responsibility. A newly appointed representative may work “under supervision” while still completing the competence requirements.

The provision that gives this real weight is debarment under section 14 of the FAIS Act. If a representative is no longer fit and proper — or has materially contravened the Act — the FSP must debar them, notify the FSCA within five days, and the person is placed on the FSCA’s public Debarred Persons Register. Debarment is not a warning letter: it effectively shuts someone out of the financial-services industry. This is why, in the compliance-stack comparison, FSCA is the framework that carries the highest personal stakes — it ends careers, not just contracts.

Treating Customers Fairly, and the conduct rules

The FSCA supervises conduct through an outcomes-based framework called Treating Customers Fairly (TCF). Rather than a checklist, it asks you to demonstrate six fair-treatment outcomes across the whole product lifecycle:

Underneath TCF sits the General Code of Conduct, which turns those outcomes into concrete duties: proper disclosure to clients, suitable advice, a documented conflict-of-interest policy, a working complaints procedure, and record-keeping you can produce on demand. The recurring theme is evidence — it isn’t enough to treat customers fairly; you have to be able to show that you did.

Cybersecurity: the Joint Standard

Since 1 June 2025, the FSCA and Prudential Authority’s Joint Standard 2 of 2024 on Cybersecurity and Cyber Resilience has been in force: Joint Notice 1 of 2024, published on 26 June 2024, set that date. It requires the financial institutions it lists — banks, insurers and pension funds among them — to maintain a cybersecurity strategy, controls including multi-factor authentication, incident detection and response, regular testing, and to report material cyber incidents to the regulator.

Among FSPs, it applies to discretionary FSPs, administrative FSPs and Category I FSPs that provide investment fund administration services. If your licence is one of those, this is a hard obligation, not a best-practice aspiration. A Category I FSP that only gives advice or intermediates is outside it, and POPIA section 19’s security duties apply to every FSP either way.

What it costs to get conduct wrong

The FSCA’s enforcement toolkit runs from public warnings, directives and enforceable undertakings up to administrative penalties, licence suspension or withdrawal, and debarment. The penalties are not token, and there is no fixed rand cap — the size is driven by how serious the conduct was:

• In December 2025 the FSCA imposed penalties of R2 billion on Banxso and two of its directors jointly, plus R16 million on Banxso alone, and debarred four people for 30 years each. The people debarred have asked for the decisions to be reconsidered.
• In May 2026 it withdrew the SA Army Foundation’s FSP licence and fined two officials a combined R44.7 million, with 30-year debarments, over the mishandling of soldiers’ contributions.

The headline cases are the visible tip. For 2025/26 the FSCA reported penalties totalling R2.8 billion on 76 persons and entities, up from R119.8 million the year before. The year before is the more telling one for a small FSP: its Regulatory Actions Report for the year to 31 March 2025 records 382 licences withdrawn, and over 90% of those withdrawals were for something as unglamorous as not submitting statutory returns. In that year, most FSPs that lost a licence lost it to administration, not to scandal. In the strategy document governing the current 2025–2028 cycle, Commissioner Unathi Kamlana put the posture plainly: “We also strengthened oversight mechanisms and increased our visibility by taking firm and decisive action against misconduct, helping to build trust and confidence in the financial system.”

Clients have their own route, too. The FAIS Ombud resolves complaints against FSPs informally and for free, and can order compensation of up to R3.5 million (a ceiling raised from R800,000 when the Ombud Council published new Rules for the Office in June 2024). It is not a theoretical route: in its 2024/25 year the Office received 3,382 complaints within its jurisdiction and awarded or settled R31.7 million in compensation, closing formal cases in an average of 59 working days. For a small FSP, an adverse Ombud determination can hurt as much as an FSCA penalty.

What an FSP has to file, and keep, every year

If most licences are lost to unfiled returns, the returns are worth knowing. Under the FAIS Act, an FSP must keep full accounting records and have its annual financial statements audited by an auditor the FSCA approves, then submit them within four months of its financial year-end unless the FSCA allows longer (section 19). Its compliance reports go to the FSCA in the form, and on the matters, the FSCA sets by notice, and the FSP must make sure they are submitted (section 17(4)). It must keep records of complaints, cancelled policies and its fit-and-proper compliance for at least five years (section 18). Changes count too: the FSCA’s licence forms say any change to the information in them must be reported in writing within 15 days of the change. The FSCA’s notices set the exact dates for each category, so read them against your own year-end.

Inside Komply, the FSCA tracker keeps the registers a compliance officer reviews: key individuals and representatives with their fit-and-proper dates, a CPD ledger per person on the 1 June cycle, complaints against Komply’s own working-day targets, and conflicts of interest. When you add a person, or record a departure or a role change, it raises the 15-day notice to the FSCA with a letter you can edit. That much is on every plan. Pro and Enterprise score a quarterly snapshot of the registers and draft the compliance report, a FAIS Ombud response and a conflict-of-interest policy from them, for your compliance officer to review and sign. Komply submits nothing to the FSCA or the Ombud, and while it records each person’s debarment check with a link to the FSCA’s register, it doesn’t match names against the register itself.

COFI is coming — but FAIS is still the law

The largest change on the horizon is the Conduct of Financial Institutions (COFI) Bill, which will eventually replace FAIS’s category-based licensing with a single activity-based conduct framework that brings much of the sector’s conduct law together. It is a genuine overhaul — but timing matters, and the honest position as of October 2026 is this: COFI is not law, and has not yet been tabled. In April 2026 the Minister of Finance gazetted notice that he intends to introduce it in Parliament, and in July the FSCA still described its introduction as pending; there is no commencement date. The 2020 public draft gave the FSCA three years to re-license existing institutions; whether the 2026 Bill keeps that will be known when its text is published. For now, FAIS is the regime you comply with, and COFI is the one to keep an eye on — not a reason to wait.

FSCA is one of four regulatory regimes, not the only one

FSCA is the narrowest of South Africa’s four main compliance regimes — its licensing reaches only businesses actually in financial services, though it also polices employers that fall behind on retirement-fund contributions — but for those it does reach, it carries the highest personal stakes. The same FSP is also carrying POPIA data-protection duties, SARS tax obligations, and usually B-BBEE scorecard pressure, none of which talk to each other. We’ve mapped how the four fit together in POPIA vs B-BBEE vs SARS vs FSCA: the South African compliance stack explained, and gone deep on the tax side in the complete SARS guide and the data side in the complete POPIA guide.

Frequently asked questions

Do I need an FSP licence?

Only if you give financial advice or act as an intermediary in relation to a financial product, such as insurance, investments, retirement products or crypto. Even then you can work as an appointed representative of a licensed FSP instead of holding your own licence. Selling non-financial goods or services doesn’t bring you into scope. An FSP licence authorises specific activities; it isn’t a general business licence.

What’s the difference between a key individual and a representative?

A key individual manages and oversees the FSP’s financial-services activities and must be approved by the FSCA. A representative renders financial services to clients under the FSP’s mandate. A new representative can work under supervision while still completing the competence requirements.

What are the regulatory exams?

RE1, which a key individual must pass before the FSCA approves them, and RE5, which a representative must pass before appointment (or within two years, if appointed to work under supervision) — on top of a recognised qualification and ongoing CPD.

What happens if a representative is debarred?

The FSP must debar a representative who is no longer fit and proper or who has materially contravened FAIS, notify the FSCA within five days, and the person is listed on the public Debarred Persons Register — which effectively bars them from the financial-services industry.

Is COFI law yet?

No. In April 2026 the Minister of Finance gazetted notice that he intends to introduce the COFI Bill, but as of October 2026 it had not been tabled in Parliament, let alone passed; there is no commencement date. FAIS remains the current regime.