South Africa

FICA compliance, made simple

20 yes/no questions on the Financial Intelligence Centre Act for businesses on Schedule 1 (accountable institutions): registration, your risk management and compliance programme, knowing your client, record keeping, reporting and training. You get a score for each area and a list of gaps with what to do about each one.

ComplianceDesk gives you 14 pre-built FICA controls, an evidence vault, audit-ready reports, and reminders before anything falls overdue — so proving FICA compliance stops being a spreadsheet exercise.

Start free trial

How ready is your business for FICA?

Take the free self-assessment: a score for each area and a list of gaps to close.

Take the self-assessment

What is FICA?

Official name: FICA Self-Assessment (Anti-Money Laundering)
Status: In force. Shown as in force as we understand it. Check the current text with the regulator or an attorney, since provisions can be amended or commence at different times.

Who it applies to

Whether it applies to you depends on your size, activities and licences. Use the free "Which laws apply to me?" checker, or read the first section of the self-assessment.
FICA applies to the businesses listed in Schedule 1 (for example attorneys, estate agents, banks, financial services providers, trust companies and, since the 2022 amendments, a wider group such as certain dealers and credit providers). Even if you are not on Schedule 1, section 29 reporting applies to anyone who carries on a business. Check your own position against Schedule 1.

What you have to do

Are you covered, and are you registered?

A business should be able to show that it can answer yes to these: Have you checked whether your business falls in Schedule 1 of FICA, and written down the answer? If you are an accountable institution, are you registered with the Financial Intelligence Centre? Do you tell the FIC in writing within 90 days when any of your registered details change? Have you appointed a compliance officer who is responsible for FICA, with the authority and resources to do the job?

Risk Management and Compliance Programme (RMCP)

A business should be able to show that it can answer yes to these: Do you have a documented RMCP that sets out how you identify, assess, monitor, mitigate and manage the risk of money laundering, terrorist financing and proliferation financing in your products and services? Does your RMCP cover how you identify and verify clients, handle politically exposed persons, apply enhanced and simplified due diligence, monitor ongoing relationships, keep records and report to the FIC? Has the board of directors, or the person or group with the highest authority in the business, approved the RMCP? Do you review the RMCP at regular intervals and make it available to the staff who need it? Can you give a copy of your RMCP to the FIC or your supervisory body when asked?

Knowing your client

A business should be able to show that it can answer yes to these: When you take on a client, do you establish and verify their identity, and the identity and authority of anyone acting for them or on whose behalf they act, as your RMCP requires? For clients that are companies, trusts or partnerships, do you identify the people who ultimately own or control them (the beneficial owners)? Do you rate each client's money laundering risk and apply more checks to higher-risk clients, including politically exposed persons? Do you keep monitoring existing clients, and update their information as their activity or circumstances change? Do you screen clients against the UN Security Council and other targeted sanctions lists before dealing with them?

Records, reporting and training

A business should be able to show that it can answer yes to these: Do you keep records of the business relationship for at least five years after it ends, and of each transaction for at least five years after it is concluded? Do you report to the FIC any cash transaction above the prescribed threshold, within the prescribed period? Does everyone who runs or works in your business know they must report knowledge or suspicion of proceeds of crime, terrorist financing, or transactions with no apparent lawful purpose, to the FIC? Do you keep a suspicious transaction report confidential and never tell the client or anyone else that you have made it, except where the Act allows? Do you train your staff on FICA and your RMCP, on joining and regularly afterwards, and keep a record of the training? Are you ready for an inspection by the FIC or your supervisory body, with your registration, RMCP, client files and training records at hand?

How to comply, step by step

Are you covered, and are you registered?. Read Schedule 1 against your activities, record the decision, and get advice if unsure. If you are not on Schedule 1, you can answer Not applicable in the sections that follow, except Section 29 reporting. Register on the FIC's goAML portal and keep the confirmation. Answer Not applicable if you are not an accountable institution. Add the FIC details to your change checklist, so any new address, director or compliance officer is reported on time. Answer Not applicable if you are not registered. Appoint the person in writing, record their duties, and tell the FIC. Answer Not applicable if you are not an accountable institution.
Risk Management and Compliance Programme (RMCP). Write an RMCP covering your clients, products, delivery channels and countries, with a risk rating method. Use the s42(2) list as a checklist. If a part does not apply to you, say so in the RMCP and give the reason. Minute the approval, with the date, and re-approve after each revision. Set a yearly review date, keep version history, and share the RMCP with every employee who deals with clients. Keep a clean, current copy ready, and know who in the business will send it.
Knowing your client. Create a client onboarding checklist with the identity and address documents you accept, and who checks them. Add a beneficial owner section to your onboarding form and verify the people named. Give every client a low, medium or high rating on onboarding, with extra steps for the high ones. Review client files on a schedule that matches the risk rating, and when something unusual happens. Run every new client and every payee through the current sanctions lists, and record the result.
Records, reporting and training. Set a retention rule of five years from the end of the relationship or the transaction, whichever applies, in written or electronic form. Answer Not applicable if you are not an accountable institution. Find out the current cash threshold and deadline, and set up a trigger in your till or accounting system. Answer Not applicable if you never handle cash. Train staff to recognise red flags and put a simple internal route for reporting to the compliance officer. Make sure this applies even if you are not on Schedule 1. Brief staff that tipping off is an offence, and limit who can see the report. Run induction and a yearly refresher, and keep attendance records. Answer Not applicable if you are not an accountable institution. Run a yearly self-review of a sample of client files against your RMCP. Penalties for non-compliance can be large, up to R10 million for a person and R50 million for a legal entity.

Sources and review status

Compiled from the public sources below. It is not legal advice and has not been reviewed by a lawyer. Last researched 2026-10-31. This is general information, not legal advice. Laws change, so check the current text and the regulator's notices before relying on it.

Every FICA control, organised for you

The real control library ComplianceDesk seeds the moment you activate FICA — 14 controls across 5 categories.

Customer Due Diligence

FICA-1.1 Client identification and verification process
FICA-1.2 Ongoing due diligence and transaction monitoring
FICA-1.3 Enhanced due diligence for high-risk clients and PEPs

Record-Keeping

FICA-2.1 Client and transaction records retained for 5 years
FICA-2.2 Records readily retrievable for the FIC/regulator

Reporting Obligations

FICA-3.1 Registered as an accountable institution with the FIC
FICA-3.2 Suspicious and unusual transaction reporting process
FICA-3.3 Cash threshold reporting process
FICA-3.4 Sanctions and terrorist financing screening

Risk Management & Compliance Programme

FICA-4.1 Risk Management and Compliance Programme approved
FICA-4.2 RMCP reviewed periodically

Training & Governance

FICA-5.1 Compliance officer appointed
FICA-5.2 AML/CTF staff training programme
FICA-5.3 Independent compliance audit conducted

Frequently asked questions

How can I check where my business stands on FICA Self-Assessment (Anti-Money Laundering)?

Take the free self-assessment. It scores each area, lists your gaps with what to do about each one, and does not say you are compliant. You can save the result to ComplianceDesk to turn each gap into a task with an owner and a due date.

Is this guide written by a lawyer?

No. It was assembled from the public sources listed below and has not been reviewed by a lawyer. Treat it as a starting point and check the current law before relying on it.

How many controls does ComplianceDesk track for FICA?

14, organised into 5 categories, ready to assign to an owner as soon as you activate the framework.

Can I track FICA alongside other frameworks?

Yes — most teams activate several frameworks at once. Controls that overlap across frameworks can share the same evidence, so you don't collect the same document twice.

How long does it take to set up FICA in ComplianceDesk?

Activating FICA instantly seeds its full control library. Most teams assign owners and get their first controls moving within a day.

Other South Africa frameworks

B-BBEE B-BBEE Agri Sector Code B-BBEE Construction Sector Code B-BBEE Financial Sector Code

See your full compliance picture

193 frameworks, one system of record.

Start free trial