FIC

FIC: The Financial Intelligence Centre

The Financial Intelligence Centre, FIC, is South Africa’s financial intelligence unit.  It was established under the Financial Intelligence Centre Act No. 38 of 2001, commonly known as the FIC Act.

The FIC helps identify the proceeds of crime and combats money laundering, terrorist financing and proliferation financing.  It receives and analyses information submitted by businesses and shares financial intelligence with law-enforcement agencies, supervisory bodies and other competent authorities where permitted by law.

Its focus is protecting South Africa’s financial system from criminal abuse.

Objectives

The FIC’s main responsibilities include:

• Identifying proceeds connected to unlawful activities.
• Assisting in the fight against money laundering.
• Assisting in combating terrorist financing.
• Assisting in combating proliferation financing.
• Receiving and analysing regulatory reports.
• Developing financial intelligence for competent authorities.
• Maintaining South Africa’s targeted financial sanctions information.
• Sharing permitted information with local and international authorities.
• Supervising and enforcing compliance with the FIC Act.
• Supporting other supervisory bodies in monitoring accountable institutions.
• Issuing guidance and directives on FIC Act compliance.

In simple terms, the FIC helps prevent criminals from using legitimate businesses and financial systems to hide, move or benefit from unlawful money.

FIC Accounting Authority

The FIC is led by its Director, who is also its Accounting Authority.

The Director reports to the Minister of Finance through National Treasury and to Parliament.  This reporting structure provides oversight of the FIC’s governance, finances and performance.

The FIC works with law-enforcement agencies, prosecuting authorities, intelligence services, supervisory bodies, regulators and international financial intelligence organisations.

FIC Act No 38 of 2001

The Financial Intelligence Centre Act No. 38 of 2001 establishes the FIC and creates the compliance framework used to combat money laundering, terrorist financing and proliferation financing.

The FIC Act works alongside other legislation dealing with organised crime, corruption, terrorism, tax offences, sanctions and the recovery of criminal proceeds.

The Act places specific duties on businesses called accountable institutions.  It also creates reporting obligations that may apply more widely to people who carry on, manage or are employed by a business.

Money Laundering

Money laundering is the process of hiding or disguising the proceeds of crime so that the money or property appears to come from a lawful source.

Criminals may attempt to launder money by:

• Buying or selling property;
• Moving money through trusts or companies;
• Using third parties to make or receive payments;
• Paying unusually large amounts in cash;
• Creating false loans, invoices or transactions;
• Moving funds through several accounts or entities;
• Buying high-value assets; or
• Using legitimate professionals and businesses to make a transaction appear respectable.

Property is attractive to criminals because it can hold significant value, generate income and be bought through companies, trusts, partnerships or other structures that may hide the true owner.

Terrorism and Proliferation

Terrorist financing involves collecting, providing or using funds or property to support terrorist activities or organisations.

Proliferation financing involves funding or supporting the development, possession, transport or use of weapons of mass destruction and related materials.

The money used for these activities does not always come from crime.  Lawfully earned money can also be used for an unlawful purpose.  Accountable institutions must therefore consider both the source of funds and the people, entities and activities connected to a transaction.

Accountable Institutions

An accountable institution is a person or business listed in Schedule 1 to the FIC Act.

These businesses are considered more vulnerable to being misused for money laundering, terrorist financing or proliferation financing because of the products or services they provide.

Accountable institutions include specified categories of:

• Property practitioners;
• Legal practitioners;
• Banks and certain other financial institutions;
• Financial services providers;
• Trust and company service providers;
• Credit providers;
• Gambling businesses;
• High-value goods dealers;
• Crypto asset service providers;
• Money or value transfer providers; and
• Other businesses listed in Schedule 1.

The complete Schedule and applicable guidance should be checked to establish whether a business must register.

Property Practitioners as Accountable Institutions

Property practitioners covered by the relevant Schedule 1 category are accountable institutions and must comply with the FIC Act.

This may include property businesses and practitioners involved in activities such as:

• Selling property;
• Purchasing property on behalf of clients;
• Letting or renting property;
• Managing property for another person;
• Auctioning property;
• Facilitating property transactions; and
• Performing other activities falling within the applicable definition.

The business must consider its actual services and the FIC Act definition.  Holding a PPRA Fidelity Fund Certificate and registering with the FIC are separate requirements.

Registering with the FIC

An accountable institution must register with the FIC within 90 days after commencing business.  PPRA registration requires a FIC registration number.

Registration is completed electronically through the FIC’s registration and reporting platform, known as goAML. Registration is free.

Once registration has been approved, the business receives an organisation identity number, commonly known as an Org ID. This enables the institution to access the reporting system and submit regulatory reports.

Registration information must remain accurate.  The FIC must be updated when relevant information changes, including changes to the business, compliance officer, contact information or accountable institution category.

A business must register because it falls within Schedule 1.

The Compliance Officer

An accountable institution must appoint an appropriately authorised person to oversee its FIC Act compliance.

The compliance officer’s responsibilities include:

• Managing the goAML registration and access;
• Overseeing the Risk Management and Compliance Programme;
• Monitoring implementation of FIC controls;
• Ensuring that staff receive suitable training;
• Overseeing customer due diligence and risk assessments;
• Monitoring regulatory reporting obligations;
• Maintaining required records;
• Responding to inspections and information requests; and
• Reporting compliance concerns to senior management or the governing body.

Appointing a compliance officer does not remove responsibility from the owners, directors or senior management.  The governing body or person exercising the highest authority remains responsible for ensuring that the institution complies with the FIC Act.

The Risk-Based Approach

The FIC Act requires accountable institutions to follow a risk-based approach.

This means that a business must identify, assess, monitor, manage and reduce the particular money laundering, terrorist financing and proliferation financing risks it faces.

The business should consider risk factors such as:

• The types of clients it serves;
• The products and services it offers;
• The value and nature of transactions;
• The countries and geographic areas involved;
• The payment methods used;
• The use of companies, trusts, partnerships and other legal structures;
• Whether transactions are conducted remotely;
• The involvement of third parties;
• The source of funds and source of wealth; and
• Unusual behaviour or transaction patterns.

Higher-risk clients and transactions require stronger checks, closer monitoring and enhanced due diligence.  Lower-risk relationships may qualify for simplified measures where the RMCP and the FIC Act permit them.

The risk-based approach does not allow a business to ignore a legal obligation simply because it considers a client low risk.

Business Risk Assessment

Before developing its compliance controls, an accountable institution should assess the money laundering, terrorist financing and proliferation financing risks faced by the business as a whole.

The assessment should consider the institution’s size, structure, locations, clients, services, transaction values, delivery channels and operating environment.

It should be documented, approved at the appropriate level and reviewed whenever the business, legislation or risk environment changes.

The business-wide risk assessment informs the institution’s RMCP and its client-level risk-rating process.

Risk Management and Compliance Programme – RMCP

Every accountable institution must develop, document, maintain and implement a Risk Management and Compliance Programme, an RMCP.

The RMCP is the business’s practical plan for meeting its FIC Act obligations.  It must be appropriate to the nature, size and complexity of the institution.

The RMCP should explain how the business will:

• Identify, assess and rate its risks;
• Accept or decline clients;
• Identify and verify clients and relevant persons;
• Establish and verify beneficial ownership;
• Understand business relationships and transactions;
• Apply simplified, standard or enhanced due diligence;
• Identify domestic and foreign politically exposed or influential persons;
• Screen relevant parties against targeted financial sanctions lists;
• Monitor transactions and business relationships;
• Identify and submit regulatory reports;
• Keep prescribed records;
• Train employees;
• Manage goAML access and reporting;
• Deal with non-compliance; and
• Review and update its controls.

An RMCP downloaded from another business or purchased as a generic template is not sufficient unless it is properly adapted, approved and implemented according to the institution’s own risks and operations.

Customer Due Diligence – CDD

Customer Due Diligence, commonly known as CDD, is the process of understanding who the client is, who ultimately owns or controls the client and why the business relationship or transaction is taking place.

CDD is sometimes called Know Your Client or KYC.  However, collecting an identity document and proof of address alone is not full FIC compliance.

Depending on the client and risk, the accountable institution may need to:

• Identify and verify the client;
• Identify and verify the person acting for the client;
• Confirm that the representative is authorised;
• Establish whether the client is acting for another person;
• Identify the natural persons who ultimately own or control a legal entity;
• Understand the purpose and intended nature of the relationship;
• Establish the source of funds and, where appropriate, source of wealth;
• Determine whether a person is politically exposed or influential;
• Conduct targeted financial sanctions screening;
• Assign and record a risk rating; and
• Apply ongoing monitoring.

The required documents and checks depend on whether the client is an individual, company, close corporation, trust, partnership, non-profit organisation, organ of state or another legal arrangement.

If the accountable institution cannot complete the required due diligence, it may not be permitted to establish the relationship or complete the transaction. It must also consider whether the circumstances are suspicious and reportable.

Beneficial Ownership

A beneficial owner is the natural person who ultimately owns, controls or benefits from a legal entity or arrangement.

When the client is a company, trust, partnership or other structure, the accountable institution must look beyond the name appearing on the registration documents and identify the people who ultimately exercise ownership or control.

For a company, this may require examining:

• Shareholders and the securities register;
• Voting rights;
• Ownership held through other companies or trusts;
• Agreements that give a person control; and
• The person who otherwise exercises effective control.

For a trust, relevant persons may include:

• The founder, donor or settlor;
• Trustees;
• Named or identifiable beneficiaries;
• A protector, where applicable; and
• Any other natural person who exercises effective control.

Beneficial ownership information must be accurate, adequate and kept up to date.  A CIPC beneficial ownership filing does not automatically satisfy the accountable institution’s separate duty to identify and verify its client’s beneficial owners.

Politically Exposed and Influential Persons

The FIC Act requires accountable institutions to identify clients and beneficial owners who hold, or have held, prominent public or influential positions.

These persons include:

• Foreign prominent public officials;
• Domestic politically exposed persons;
• Prominent influential persons; and
• Certain family members and known close associates.

Being politically exposed does not mean that a person is involved in crime.  It indicates that the relationship may present additional corruption, bribery or financial crime risks.

Where the law and the institution’s risk assessment require it, enhanced measures include:

• Obtaining senior management approval;
• Establishing source of wealth and source of funds;
• Applying enhanced ongoing monitoring; and
• Recording the reasons for accepting or continuing the relationship.

Targeted Financial Sanctions – TFS

Targeted Financial Sanctions, commonly known as TFS, restrict access to funds, property and services by people or entities designated in terms of applicable United Nations Security Council resolutions.

Property practitioners must screen relevant parties against the TFS list.  This includes, where applicable:

• The client;
• The client’s representative;
• A person on whose behalf the client acts;
• Beneficial owners; and
• Other parties to the transaction.

Screening is required regardless of the risk rating assigned to the client.

Where there is a confirmed match, the accountable institution must act without delay.  This may include freezing affected property, not proceeding with the transaction and submitting a Terrorist Property Report to the FIC.

A possible name match must be investigated carefully to establish whether it relates to the designated person or entity.

Ongoing Monitoring

FIC compliance does not end once the client has been onboarded.

The accountable institution must monitor the relationship and transactions to determine whether they remain consistent with what is known about the client, the business relationship, the source of funds and the assigned risk rating.

Ongoing monitoring includes:

• Updating expired or changed client information;
• Reviewing beneficial ownership;
• Repeating sanctions and politically exposed person screening;
• Monitoring payment methods and third-party payments;
• Comparing transactions with the expected client activity;
• Investigating unusual instructions or behaviour; and
• Revising the risk rating when circumstances change.

Higher-risk relationships should be reviewed more frequently and in greater depth.

Record Keeping

Accountable institutions must keep prescribed customer due diligence and transaction records.

• Identification and verification documents;
• Beneficial ownership information;
• Authority to act on behalf of a client;
• Risk assessments and risk ratings;
• Sanctions and politically exposed person screening results;
• Source of funds and source of wealth information;
• Transaction and payment records;
• Mandates, agreements and correspondence;
• Ongoing monitoring records;
• Internal decisions and approvals; and
• Regulatory reporting information.

Records must generally be retained for at least five years from the date prescribed by the FIC Act, depending on whether the record relates to a transaction or a business relationship.

Records may be stored electronically if they remain secure, complete and readily available to the FIC or supervisory body when lawfully requested.

Training

Employees must understand the FIC Act obligations relevant to their work and the procedures contained in the institution’s RMCP.

Training should cover:

• The purpose of the FIC Act;
• Customer due diligence;
• Client and transaction risk indicators;
• Beneficial ownership;
• Politically exposed and influential persons;
• Targeted financial sanctions;
• Suspicious and unusual activity;
• Reporting procedures;
• Record keeping;
• Confidentiality and the prohibition on tipping off; and
• The consequences of non-compliance.

Training should be provided when employees join, refreshed regularly and updated when requirements or business risks change.  The institution should keep attendance records and evidence of the training provided.

Regulatory Reports

The FIC Act requires specified transactions, activities and property to be reported to the FIC through goAML.

The three reports most relevant to property practitioners are:

• Cash Threshold Reports;
• Suspicious Transaction or Suspicious Activity Reports; and
• Terrorist Property Reports.

Submitting one type of report does not remove the obligation to submit another report where both apply.

Cash Threshold Reports – CTR

A Cash Threshold Report, commonly known as a CTR, must be submitted when physical cash exceeding R49 999.99 (at 2026) is received or paid in circumstances covered by section 28 of the FIC Act.

In practical terms, a physical cash amount of R50 000 or more is reportable.

Cash includes notes, coins and travellers’ cheques. It does not include an electronic funds transfer, bank cheque, bank draft or other payment method that does not involve the physical transfer of cash.

The report must be submitted as soon as possible and no later than three business days after the accountable institution or its employee becomes aware of the transaction.

The duty may still apply where the cash is received through an agent or third party in connection with the transaction.  A report by the bank does not remove the accountable institution’s separate reporting obligation.

A CTR does not mean that the transaction is necessarily suspicious.  If the transaction is also suspicious, a separate STR or SAR must be considered.

Suspicious Transaction and Activity Reports – STR and SAR

A Suspicious Transaction Report, known as an STR, relates to a transaction that has taken place and creates knowledge or suspicion of money laundering, terrorist financing, proliferation financing or another reportable concern.

A Suspicious Activity Report, known as an SAR, may apply where suspicious conduct or an attempted, abandoned, interrupted or incomplete transaction has occurred.

There is no minimum monetary threshold. A suspicious matter must be considered for reporting regardless of the amount involved.

The person making the report does not need to prove that a crime occurred. A report may be based on a reasonable suspicion arising from the facts, behaviour or circumstances.

An STR or SAR must be submitted without delay and no later than 15 days, excluding Saturdays, Sundays and public holidays, after the relevant person becomes aware of the facts giving rise to the knowledge or suspicion.

Property Transaction Warning Signs

No single warning sign proves criminal activity.  However, the following may require further investigation and possible reporting:

• A client refuses or delays providing identification or beneficial ownership information.
• Ownership is hidden through unnecessary or overly complex entities.
• A third party pays without a clear commercial explanation.
• The buyer appears unconcerned about the price, condition or location of the property.
• The transaction value is inconsistent with the client’s known financial position.
• The client wants to use large amounts of physical cash.
• Funds come from an unexplained foreign or high-risk source.
• The client changes payment arrangements without a reasonable explanation.
• Property is repeatedly bought and sold over a short period.
• The client wants the agreement to record an incorrect price.
• The transaction has no clear economic or lawful purpose.
• The client attempts to avoid normal checks or reporting thresholds.
• The client abandons the transaction after being asked for FIC information.
• Instructions are unusual, rushed or unnecessarily secretive.

Employees should report concerns internally according to the RMCP.  The compliance officer must then determine whether a regulatory report is required.

Terrorist Property Reports – TPR

A Terrorist Property Report, known as a TPR, must be submitted where the accountable institution knows that it possesses or controls property linked to a designated person, terrorist activity or proliferation financing activity.

The institution must act without delay, freeze the affected property where required and not continue with the prohibited transaction.

The TPR must be filed without delay and no later than five days after the institution becomes aware of the relevant facts.

Because these reports involve sanctions and prohibited dealings, the institution should follow its RMCP and the applicable FIC guidance carefully.

Confidentiality and Tipping Off

Regulatory reports and related information are confidential.

A person must not tell a client or another unauthorised person that an STR, SAR, CTR or TPR has been – or may be – submitted where disclosure is prohibited by the FIC Act.

Warning a client may compromise an investigation and can constitute an offence.  Employees should refer all questions about a report to the authorised compliance officer and follow the institution’s RMCP.

Risk and Compliance Returns  –  RCR

The FIC may direct specified accountable institutions to complete a Risk and Compliance Return, commonly known as an RCR.

The RCR is a regulatory self-assessment. It provides information about the institution’s understanding of its financial crime risks and the controls it has implemented.

When a directive applies, the accountable institution must submit the RCR within the specified period.  Only a properly registered institution with an Org ID can complete the return.

RCR requirements and deadlines are issued through FIC directives and may change. Property businesses should monitor current FIC and PPRA communications and should not rely only on reminders.

The FIC, PPRA and Property Practitioners

The FIC and the Property Practitioners Regulatory Authority, commonly known as the PPRA, have different but connected responsibilities.

The FIC:

• Administers the FIC Act;
• Receives and analyses regulatory reports;
• Issues FIC Act guidance and directives;
• Maintains the goAML reporting platform;
• Develops financial intelligence; and
• Supervises or enforces compliance where it has jurisdiction.

The PPRA is the supervisory body responsible for monitoring applicable property practitioners’ compliance with the FIC Act.

As part of this role, the PPRA may:

• Conduct FIC Act compliance inspections;
• Request the institution’s RMCP and supporting records;
• Check FIC registration and Org ID information;
• Review customer due diligence and risk-rating processes;
• Check staff training and governance arrangements;
• Examine reporting and record-keeping controls;
• Require remedial action; and
• Impose or recommend enforcement action where permitted.

PPRA registration and FIC registration are both required where the respective legislation applies. Compliance with one does not automatically mean compliance with the other.

FIC Compliance Inspections

An accountable institution must be able to demonstrate that its FIC compliance programme exists and operates in practice.

During an inspection, the FIC or PPRA may request evidence such as:

• The goAML registration and Org ID;
• Appointment of the compliance officer;
• The approved and current RMCP;
• Business and client risk assessments;
• Completed client files;
• Beneficial ownership records;
• Sanctions and politically exposed person screening records;
• Transaction monitoring evidence;
• Staff training records;
• Regulatory reporting controls;
• Submitted RCR information; and
• Evidence that weaknesses have been identified and corrected.

A written policy without evidence of implementation is unlikely to demonstrate full compliance.

Consequences of Non-Compliance

Failure to comply with the FIC Act can expose the accountable institution and responsible persons to serious consequences.

Administrative sanctions include:

• A caution;
• A reprimand;
• A directive to take remedial action;
• Restriction or suspension of certain business activities; and
• A financial penalty of up to R10 million for a natural person or R50 million for a legal person.

Certain offences carry additional criminal penalties. Depending on the offence, these may include substantial fines or imprisonment.

Administrative sanctions are generally published unless an applicable exception or appeal prevents publication. Non-compliance may therefore cause financial, operational and reputational harm.

FIC Compliance Is Not a Once-Off Exercise

FIC compliance is not completed by registering on goAML or collecting identification documents once.

A compliant property business must continuously:

• Keep its FIC registration details current;
• Maintain and implement its RMCP;
• Review business and client risks;
• Complete customer due diligence;
• Identify and verify beneficial owners;
• Screen relevant parties;
• Monitor transactions and client relationships;
• Submit regulatory reports on time;
• Train employees;
• Keep prescribed records; and
• Respond to directives, returns and inspections.

These controls must operate every day and across every applicable client relationship and transaction.

Use Our Compliance Service For Peace Of Mind

FIC compliance is compulsory. It is detailed. And it cannot be left until a regulator asks for it.

An outdated RMCP, incomplete client files, missed screening or an unsubmitted report can expose your business to serious penalties and reputational damage.

PPs provides practical FIC compliance support for property businesses. We train you to:

• Register and update your business on goAML;
• Develop and maintain a business-specific RMCP from our template;
• Complete business and client risk assessments, reports and notices using our guidance;
• Establish workable customer due diligence procedures;
• Identify beneficial owners;
• Implement sanctions and politically exposed person screening;
• Train your property practitioners and staff using our staff-ready online course material;
• Prepare for PPRA or FIC inspections;
• Monitor important reporting requirements and deadlines; and
• Keep your compliance programme current – we prompt you when required.

Let PPs Be Your Compliance Watchdog

We offer a full range of compliance packages which you can view here.   Then contact us to discuss your requirements – we are here to help.

Disclaimer:

This information was accurate at the date of publication. However, legislation, directives, guidance, reporting thresholds, deadlines and regulatory requirements may change without notice. This content is provided for general information and should not be regarded as legal or financial advice. Always confirm the latest requirements with the FIC, PPRA or an appropriately qualified adviser before acting.