CARF changed everything. SA exchanges now automatically report every crypto transaction to SARS. If your ITR12 doesn't match what your exchange reported, SARS will notice — and they will act.
What Triggers a Crypto Audit
SARS uses risk-based selection. The most common triggers for crypto-related audits include:
- CARF mismatch — exchange reports show activity but your ITR12 shows no crypto income or gains
- No ITR12 filed — if you're registered as a taxpayer and CARF data shows you have crypto, expect a prompt
- Large transfers with no declared source — crypto sales that land in your bank account without a corresponding tax declaration
- High frequency trading declared as CGT — if CARF data shows daily or weekly trading but you filed as an investor
- Wealth vs income mismatch — significant crypto holdings visible to SARS that aren't proportionate to declared income
Types of SARS Correspondence
Verification Request (Section 42)
SARS asks you to confirm specific information on your return. Less serious than a full audit. Respond within 21 days with supporting documents.
Audit (Section 40–41)
A formal examination of your tax affairs. SARS may request transaction records, bank statements, and exchange statements going back up to 5 years (longer if fraud is suspected).
SARS 369 Letter
A notice of understatement or additional assessment. This arrives after SARS has already made a determination. You have 30 days to object if you disagree.
Documents SARS Will Request
If you receive audit correspondence, start gathering:
- Complete transaction history from all exchanges (Luno, VALR, Binance, etc.)
- Bank statements showing ZAR deposits and withdrawals linked to crypto
- Proof of purchase prices (date, ZAR value, exchange rate if purchased in USD)
- Proof of all fees paid
- Prior year ITR12 submissions showing your crypto declarations
Understatement Penalties
If SARS finds that you understated your income or gains, penalties apply based on the behaviour type:
- Substantial understatement (>R1m or >20% of tax): 25%
- Reasonable care not taken: 25%
- No reasonable grounds for position: 50%
- Impermissible avoidance: 75%
- Intentional tax evasion: 100–200%
Plus interest (currently ~10.25% per year) on any unpaid tax from the date it was due.
If You Haven't Filed Yet: Act First
The Voluntary Disclosure Programme (VDP) allows you to correct prior non-disclosure with 100% penalty relief — but only if SARS has not yet contacted you. Once you receive any audit letter, the VDP window closes for that matter.
The proactive option: engage a registered tax practitioner (tax attorney or SARS-registered tax practitioner) before SARS makes contact.
Check Your Risk Level Now
Our free CARF Compliance Checker takes 2 minutes and tells you whether your current crypto activity creates an audit risk — and what to do about it.