FICA / AML Compliance for Accountable Institutions

The list covers legal practitioners, trust and company service providers, estate agents, banks, long term insurers, gambling operators, credit providers, financial services providers, money remitters, high value goods dealers and crypto asset service providers, among others.

Any dealer who receives R100 000 or more for goods, in a single transaction or in linked transactions, in any form of payment and not only cash, is caught by item 20.

A business can fall under more than one item, and must register separately under each. Group registration is not permitted, and registering under the wrong item is itself a compliance failure.

Registration is electronic and free, and must happen within 90 days of commencing business or of the Schedule 1 amendment that brought you in. You cannot file any report until you are registered.

Any change to your particulars, including contact person, address, ownership or activity, must be notified in writing within 90 days. Stale details are a common inspection finding.

The board must appoint a person with sufficient competence and seniority to run the compliance function. That person supports the board, and does not absorb its responsibility.

The board, senior management or other highest level of authority must approve the Risk Management and Compliance Programme. Keep the dated approval record, because inspectors ask for it.

It must cover risk identification and assessment, the controls you apply, and how you monitor whether those controls work, across the matters listed in section 42(2)(a) to (s).

Establish and verify the identity of the client, anyone acting for them and anyone they act for, from reliable and independent sources. Accounts in anonymous or fictitious names are prohibited.

Go behind the entity to the natural persons who own or control it: controlling ownership interest first, then control by other means, then control over management. The CIPC and Master registers alone are not enough.

Determine whether a client or beneficial owner is a foreign or domestic politically exposed person, or a family member or close associate. Foreign PEPs are always high risk and need senior management approval.

Screening applies to every client, beneficial owner, representative and transaction party, regardless of assigned risk. On a confirmed match you must not transact, must freeze immediately, and must report.

Ongoing training must equip employees to meet the obligations relevant to their roles, and the RMCP document must be made available to each employee.

A cash threshold report is required where cash above R49 999.99 is received from or paid to a client. Cash includes notes, coin and travellers cheques.

The duty arises where you know or ought reasonably to have suspected proceeds of unlawful activity, a transaction with no apparent lawful purpose, structuring to avoid reporting, terrorist financing or tax evasion.

This one is knowledge based, not suspicion based. The clock runs from the point of the list match.

This applies only to authorised dealers, authorised dealers with limited authority, certain financial services providers and the South African Postbank, at R20 000 and above, within three business days.

Customer due diligence records for five years after the relationship ends, transaction records for five years after the transaction, and report copies for five years after submission. Outsourcing storage does not outsource accountability.

Directive 11 of 2026 required a return covering 2023 to 2026 from Schedule 1 items 1, 2, 3, 9, 11 excluding banks, 14, 20, 21 and 22. The deadlines of 30 June and 31 July 2026 have passed, and non-submission carries an administrative sanction.

Board approval, RMCP version history, training registers, screening logs, client files and submitted reports in one place. Recurring inspection findings are no sanctions screening, an undocumented RMCP, and incomplete beneficial ownership.