Luno: Compliance as a Competitive Strategy

Luno is the clearest South African example of compliance used as a competitive strategy. This story covers the founding, the emerging market focus, custody and security, the regulatory approach, revenue cyclicality, the acquisition and the risks that remain — part of the South Africa Company Stories hub.

Why focus on emerging markets?

Because the underlying demand is stronger. In economies with currency volatility, capital controls, expensive remittances and limited access to international investment products, an alternative store of value and transfer mechanism has obvious practical appeal.

Competition was also thinner. Global exchanges concentrated on developed markets with deeper liquidity, leaving emerging market customers served by informal traders, offshore platforms with no local support, and outright scams.

The operational difficulty is what deterred others: local payment rails, local banking relationships, local regulation and local customer support in multiple languages are all expensive and cannot be built remotely.

Why treat compliance as a strategy?

Because the alternative was a business that could be shut down by any single regulatory decision. Engaging with regulators, obtaining licences where frameworks existed and building anti-money-laundering and verification processes from the start made the business durable.

It also solved the banking problem. Exchanges without credible compliance repeatedly lost banking relationships, which cut off customer deposits and withdrawals and effectively ended their ability to operate.

The cost is real: verification friction reduces sign-up conversion, and refusing certain products or jurisdictions cedes revenue to less cautious competitors. That trade-off looked expensive for years and looked correct when several of those competitors collapsed.

What does custody actually involve?

Holding customer assets securely, which in this industry means the overwhelming majority in offline storage with multi-signature controls, geographically distributed key material and strict procedures for any movement.

The threat model is unusual. Assets are bearer instruments: a successful theft is irreversible, cannot be recalled and has no insurer of last resort, which makes security architecture existential rather than operational.

Internal risk matters as much as external. Most large losses in this industry have involved insiders, poor key management or the commingling of customer and company funds, which is why segregation and procedural controls are the substance of custody rather than the technology.

How does the revenue model work?

Principally through trading fees, plus spreads on instant buy and sell services and fees on certain transfers. Revenue is therefore a function of trading volume, which is a function of price volatility and public attention.

This produces extreme cyclicality. Enthusiastic markets generate enormous volume and revenue; quiet markets can see activity fall by the large majority for extended periods, while the cost base of compliance, custody and support remains fixed.

Diversification into savings products, business services and payment functionality is the standard response, and none of them yet substitute for trading revenue in a bull market.

Managing that cycle is the central operating discipline: hiring and spending during a boom that funds a multi-year downturn is what separates the platforms that survive from those that do not.

Why did the acquisition make sense?

For the acquirer, immediate presence in emerging markets with an established, licensed, locally banked operation and a large retail customer base — assets that would take years and considerable regulatory patience to build.

For the company and its investors, access to the parent’s capital, liquidity infrastructure and product range, plus the balance sheet strength to operate through downturns that have destroyed independent competitors.

It also reflects the industry’s consolidation logic: regulatory compliance, custody infrastructure and liquidity all have large fixed costs, which favours scale and makes independent mid-sized exchanges structurally difficult.

What is the remittance angle?

Cross-border transfers between emerging markets are expensive and slow through correspondent banking, with fees that fall heaviest on the smallest transfers — exactly the ones migrant workers send home.

Digital assets can move value across borders quickly at low cost, and where local on-ramps and off-ramps exist on both ends, the total cost can be materially below traditional channels.

The practical constraints are conversion at each end, regulatory treatment of the transaction and price volatility during transfer, which is why stable-value instruments have taken most of this use case rather than volatile assets.

What are the risks in this business?

Regulatory change is the largest. A jurisdiction can restrict or prohibit activity with limited notice, and a platform operating across many markets must be able to withdraw from one without threatening the whole.

Security is the second, and it is absolute: a single major custody failure ends a business regardless of how well everything else was run.

The third is reputational contagion. Failures elsewhere in the industry damage confidence in every operator, and a compliant, well-run platform still loses customers when a competitor collapses.

What is the lesson?

That in a young industry, the durable strategy is to build for the regulation that will exist rather than the regulation that does. Companies that optimized for the absence of rules were competing for a temporary advantage.

The second lesson concerns operating discipline in cyclical businesses. Revenue that varies by an order of magnitude between good and bad years requires a cost base sized for the bad ones.

The third is about emerging market technology exits. Building locally — payment rails, banking relationships, support in local languages — created exactly the asset an international acquirer could not replicate, which is what made the exit possible.

Why are local payment rails so hard to build?

Because each market has its own banking system, settlement conventions, identity verification requirements and consumer payment habits, and none of them can be served with a single integration.

Obtaining and keeping bank accounts is the harder half. Banks assess this sector as high risk, and a platform must demonstrate compliance capability continuously to retain the accounts that let customers deposit and withdraw.

That work is unglamorous, slow and jurisdiction-specific, which is precisely why it constitutes a real barrier to entry and why an acquirer will pay for a business that has already done it.

What does customer education involve?

Explaining volatility honestly, warning about scams that impersonate the platform, discouraging borrowing to invest, and making clear that the assets are not deposits and carry no guarantee.

It is commercially awkward, because the same education reduces trading by customers who should not be trading, and it is what distinguishes a platform building a long-term customer base from one maximizing short-term volume.

Regulators in several markets now require risk disclosure and appropriateness assessment, which has formalized what responsible operators were doing voluntarily and closed the gap with those who were not.

What did the 2013 founding environment look like?

Almost nothing existed. There were no local exchanges of consequence, no regulatory framework, limited banking willingness and a customer base that had mostly never encountered the technology.

Building in that environment meant creating the education, the payment integrations and the trust simultaneously, which is slower than entering an established market and produces a much stronger position if it works.

It also meant the founders had time. Competition arrived years later, by which point the local banking relationships, licences and customer base were established.

How do exchanges handle market downturns operationally?

By cutting discretionary spending sharply, pausing hiring and market entry, and protecting the functions that cannot degrade — custody, compliance and customer support — regardless of revenue.

The businesses that failed generally did the opposite: they had lent out customer assets, taken proprietary positions or funded expansion from balances that were never theirs to use.

The durable operators treat the downturn as the design case, holding sufficient capital and keeping customer assets fully segregated so that a quiet market is merely unprofitable rather than existential.

What is the outlook for the sector in Africa?

Shaped more by currency and remittance economics than by speculation. Where local currencies are volatile and cross-border transfers are expensive, demand for alternatives persists through market cycles.

Regulation is arriving steadily rather than suddenly, with several African jurisdictions introducing licensing frameworks that legitimize compliant operators and exclude the rest.

The likely structure is a small number of licensed, banked platforms serving the retail market, with the informal trading that dominated the early years pushed to the margins by both regulation and consumer preference for recourse.

Why do most exchanges fail?

Through some combination of commingling customer assets with company funds, taking proprietary trading positions, lending out customer holdings, or building a cost base sized for a boom that did not last.

Each of these is a governance failure rather than a technology one, and each was visible in advance to anyone examining how customer assets were segregated and who could authorize their movement.

The operators that survived multiple cycles did so by holding customer assets one-for-one, keeping proprietary activity out of the business entirely and treating capital adequacy as a discipline rather than a regulatory box.

What does an emerging market technology exit require?

Something the acquirer cannot build: licences already granted, banking relationships already established, local payment integrations already working and a customer base already trusting the brand.

Software alone almost never qualifies, because a well-funded acquirer can write software. What it cannot compress is the years of regulatory engagement and relationship building that operating locally requires.

That is the general lesson for founders in smaller markets: build the asset that is expensive in time rather than in capital, because time is the one input an acquirer cannot buy more of.

Frequently Asked Questions