South Africa's cannabis regulatory landscape is still evolving, but the direction of travel is clear: formalisation. The Cannabis for Private Purposes Act (CfPPA), which came into force in 2024, decriminalised private cultivation and use. Commercial licensing frameworks are in development. And as the regulatory environment tightens, stores that have built compliance infrastructure early will be positioned to transition smoothly — those that haven't will face the same cliff edge every informal sector faces when regulation arrives.
This isn't abstract. Banks are already scrutinising cannabis businesses at account opening. Payment processors want compliance documentation. And marketplace platforms worth listing on require it. Here's what genuine compliance looks like for a South African cannabis dispensary in 2026.
Step 1: Business registration
The foundation of everything else. A cannabis dispensary operating as an unregistered sole trader has no legal separation between the owner and the business, no ability to open a business bank account, and no basis for a future licence application.
Register as a private company (Pty Ltd) with the CIPC. This takes 24–48 hours online and costs under R200. The company name, registration number, and directors list become part of your formal identity as a business.
Once registered, you can open a business bank account — though cannabis businesses should expect scrutiny. Be prepared to explain your business model clearly, provide proof of registration, and demonstrate that your operations are structured for traceability.
Step 2: FICA compliance
The Financial Intelligence Centre Act applies to all South African businesses handling financial transactions, including cannabis stores. Key obligations:
Customer Due Diligence (CDD): Verify the identity of customers, particularly for large transactions. For cannabis retail, this means age verification at minimum (18+ for all customers), and identity verification for transactions above your internal threshold.
Record keeping: Transaction records must be retained for five years minimum. This means receipts, invoices, and payment records — not just WhatsApp screenshots.
Suspicious transaction reporting: If a transaction looks unusual — large cash payments, structuring, or patterns inconsistent with a customer's normal behaviour — it should be documented and, where required, reported to the Financial Intelligence Centre.
Large cash transaction reporting: Cash transactions above R24,999 must be reported. Many compliant cannabis businesses avoid this threshold entirely by operating EFT-only. EFT payments create bank-verifiable records on both sides, which is the cleanest paper trail for a FICA audit.
Step 3: Age verification
Every customer must be 18 or older. This is both a legal requirement and a core compliance signal that distinguishes professional operations from informal ones.
Minimum practice: ID check at point of sale for all in-person customers, verified against their stated date of birth. For delivery operations, this extends to the driver confirming ID at the door before handover.
For platforms handling digital transactions, age verification at account creation — with documentation — is the standard.
Step 4: Product traceability
Where did your stock come from? This question is the one that most informal cannabis businesses cannot answer clearly, and it's the question that matters most as regulation develops.
Supplier documentation: Every product you sell should have a traceable supply source — a grower or supplier you have a documented relationship with, who can account for how the product was cultivated.
Lab testing: Products should have current Certificates of Analysis (CoAs) from accredited SA laboratories covering cannabinoid profile, terpene panel, and contaminant testing (pesticides, heavy metals, microbials). CoAs should be less than 12 months old for the specific batch being sold.
Batch records: When you receive stock, record the batch, the supplier, the date, the quantity, and the CoA reference. This creates the inventory trail that a regulator or auditor would follow.
Step 5: POPIA compliance
The Protection of Personal Information Act (POPIA) came into full effect in 2021. It governs how businesses collect, store, and use personal information — including customer names, ID numbers, contact details, and purchase histories.
For a cannabis dispensary, this means:
If you're collecting ID copies for age verification, those copies are personal information under POPIA and must be treated accordingly.
Step 6: Structured invoicing and financial records
This is where banking relationships are won or lost. A cannabis business that can hand a bank manager monthly sales summaries, supplier invoices, and a clear picture of cash flow is a fundamentally different proposition from one that operates on an informal basis.
Issue invoices for every sale. Maintain monthly reconciliations. Keep bank statements aligned with sales records. If you use an accountant, brief them specifically on the cannabis regulatory context.
If you accept cash at all, maintain a cash register record or till slip system. Every cash transaction should be documented.
The platform advantage
Much of this compliance infrastructure is difficult and expensive to build from scratch, especially for smaller operators. Listing on a structured marketplace handles several layers automatically: age verification at customer account creation, FICA flagging on large orders, traceable EFT payment rails, and structured transaction records.
This doesn't replace the store's own compliance obligations — but it provides a documented layer that supports them, and a paper trail that exists independently of the store's own records.
Galactica Express Cannabis is currently onboarding stores in Gauteng, Western Cape, and KwaZulu-Natal. For compliance queries and onboarding: vendors@galactica.co.za