Financial Intelligence Centre Act: Duties, Reports, and Penalties

The Financial Intelligence Centre Act’s obligations and penalties fall into two clear halves: what an accountable institution must do, and what happens when it doesn’t. On the obligation side, the Act requires client identification, beneficial ownership checks, a written compliance programme, transaction and threshold reporting, and five-year record retention. On the penalty side, the Financial Intelligence Centre can impose administrative fines of up to R10 million on individuals and R50 million on companies, while criminal convictions for the most serious offences carry up to 15 years in prison or a R100 million fine.¹ The framework was tightened by the General Laws (Anti-Money Laundering and Combating Terrorism Financing) Amendment Act 22 of 2022, which broadened the list of accountable institutions and sharpened due diligence rules.²

Who the Act Applies To

FICA’s full obligations bind the businesses listed in Schedule 1 of the Act, known as accountable institutions. The list includes commercial banks, long-term insurers, credit providers, legal practitioners, estate agents, and casinos.³ What ties them together is exposure to significant capital flows or high-value transactions, the kinds of channels most attractive for disguising illegal money.

Since 19 December 2022, crypto asset service providers are also accountable institutions under Items 12 and 22 of Schedule 1. That covers anyone who exchanges crypto assets for fiat currency or other crypto assets, transfers crypto assets between addresses, or provides safekeeping and administration of crypto assets for clients.⁴ If your business isn’t on Schedule 1, the reporting and RMCP duties described below don’t apply to you as an accountable institution.

Client Identification and Beneficial Ownership

Section 21 of the Act requires an accountable institution to establish and verify the identity of each client, of anyone acting on the client’s behalf, and of that representative’s authority to act.¹ The Act does not prescribe a fixed document list. Each institution sets its own verification standards inside its Risk Management and Compliance Programme.

For individual clients, this typically means capturing the full legal name, date of birth, and South African identity or passport number, backed by a smart ID or passport. Proof of residential address is standard, and most institutions accept a utility bill less than three months old, a lease agreement, a recent payslip, or a mortgage statement. Electronic utility bills sent by email are generally accepted. A client who shares accommodation and has no bill in their own name is usually asked for a signed declaration from the property owner, together with a copy of the owner’s ID and a recent utility bill.

Corporate clients face a further layer. Section 21B requires institutions to identify the beneficial owners of companies, trusts, and other legal structures, and to take reasonable steps to verify those identities. A beneficial owner is the natural person who directly or indirectly owns or exercises effective control over the entity.⁵

For companies, the FIC recommends working through three steps in order: identify any natural person holding 5% or more of the ownership interest; then check whether any outside party exercises control through other means, such as unusual transaction patterns; then, if neither produces a name, identify the individuals who control management, such as the CEO or directors.⁵ For trusts, every natural person connected to the trust must be identified, including trustees, founders, donors, protectors, and named beneficiaries. For partnerships, that means each partner, silent partners included. Where a partner is itself a legal entity, the same elimination process runs through until a natural person is reached.

The Risk Management and Compliance Programme

Section 42 requires every accountable institution to develop, maintain, and implement a Risk Management and Compliance Programme, known as the RMCP. It is the institution’s internal playbook for preventing money laundering, terrorist financing, and proliferation financing. The programme must cover customer due diligence procedures, record-keeping processes, reporting controls, employee training, and a risk-based approach tailored to the specific threats the institution faces.⁶

The RMCP is not a document you file once and forget. It must be updated as the institution’s risk profile, client base, and regulatory environment change. A workable RMCP also addresses targeted financial sanctions screening, controls for politically exposed persons, account monitoring, and governance that assigns clear accountability for compliance decisions.⁶ The institution’s compliance officer is responsible for implementing the RMCP, training staff, filing reports with the FIC, and keeping the institution’s FIC registration current.

Enhanced Scrutiny for Politically Exposed Clients

FICA applies heightened scrutiny to clients who hold or have recently held positions of public power, because those roles carry a higher exposure to corruption and bribery. The Act treats foreign and domestic categories slightly differently.

When an accountable institution identifies a prospective client or beneficial owner as a foreign politically exposed person, enhanced due diligence is mandatory regardless of the assessed risk. Senior management must approve the relationship, the institution must take reasonable steps to establish source of wealth and source of funds, and enhanced ongoing monitoring applies.¹

Domestic prominent influential persons are not automatically high risk. The institution first assesses whether the relationship presents a higher risk under its RMCP; only if it does do the same enhanced measures apply. Qualifying positions include the President or Deputy President, government ministers, provincial premiers, executive mayors, leaders of registered political parties, senior military officers, constitutional court judges, and senior executives of public entities.⁷

The same enhanced measures extend to immediate family and known close associates of both foreign and domestic politically exposed persons. Immediate family includes spouses, current and former civil or life partners, children and stepchildren, parents, and siblings.¹ Institutions are also encouraged to check whether a client has held a qualifying position at any point, since past connections to political power remain relevant to money laundering risk.⁷

Reports You Must File

Accountable institutions file three main report types with the FIC, each with its own trigger and timeline.

Cash Threshold Reports

Section 28 requires a Cash Threshold Report for any cash transaction exceeding R49,999.99. It applies to physical currency only, not electronic transfers, and gives the FIC visibility into large cash movements that could point to illicit funds entering the banking system.⁸

Suspicious Transaction Reports

Under Section 29, anyone at an accountable institution who knows or reasonably suspects that a transaction involves the proceeds of unlawful activity, may facilitate the transfer of illegal funds, has no apparent business purpose, or relates to terrorist financing must file a Suspicious Transaction Report. The trigger is actual knowledge or circumstances where a reasonable person would form the same suspicion. Reports are filed electronically within 15 business days of becoming aware of the suspicious facts.⁹

The Act strictly prohibits tipping off. Anyone involved in making a report cannot tell the client, or anyone else, that a report has been filed or that suspicious activity is being investigated. The only exceptions are disclosures made within a person’s legal duties, for the purpose of carrying out the Act, or in legal proceedings. A tipping-off breach is a criminal offence carrying up to 15 years in prison or a fine of up to R100 million.⁹

Terrorist Property Reports

Section 28A creates a shorter, more urgent obligation. If an accountable institution knows it holds or controls property owned by or on behalf of a person or entity linked to terrorism under the Protection of Constitutional Democracy against Terrorist and Related Activities Act, or anyone listed under a United Nations Security Council resolution, it must report this to the FIC within five days.¹⁰

Unlike a suspicious transaction report, which rests on subjective suspicion, a terrorist property report is based on actual knowledge derived from objective facts. Once the report is filed, the institution must freeze the property and cease all business with the affected entity. Continuing to deal with that property after reporting is itself a criminal offence. The five-day clock starts when the institution becomes aware of the facts, and the FIC has been clear that internal screening delays and investigation processes cannot extend the deadline.¹⁰

Records You Must Keep

Section 23 requires accountable institutions to keep three categories of records for at least five years each. Client identification and verification records must be kept for five years after the business relationship ends. Transactional records must be kept for five years from the date each transaction was concluded. Regulatory reports filed with the FIC, such as suspicious transaction reports, must be kept for five years from the date of submission.¹¹

Deliberately tampering with or destroying records outside the rules of Section 23 is a criminal offence under Section 48, carrying a maximum of 15 years in prison or a R100 million fine.¹

Penalties for Non-Compliance

FICA separates administrative sanctions from criminal prosecution, and the distinction matters. The FIC imposes administrative penalties. Criminal sentences come from the courts.

Administrative Sanctions

Section 45C allows the FIC to issue a caution, a reprimand, a directive to take corrective steps, or a restriction on business activities. The most severe administrative tool is a financial penalty capped at R10 million for a natural person and R50 million for a legal entity such as a company or trust.¹² The FIC is not a court and cannot order imprisonment through this process.

Criminal Penalties

Where non-compliance crosses into criminal territory, the numbers rise sharply. Section 68(1) provides that most FICA offences carry up to 15 years in prison or a fine of up to R100 million. Offences at this level include failing to file a cash threshold report, failing to report a suspicious transaction, failing to report terrorist property, tampering with or destroying records, and tipping off.¹

A second tier under Section 68(2) carries a lighter maximum of five years in prison or a R10 million fine. These cover violations of specific sections dealing with access to information and obstruction-related conduct.¹ Even negligent non-compliance can create criminal exposure. Section 52(2) makes it an offence to fail to report a suspicious transaction when a person reasonably ought to have known or suspected the relevant facts. Deliberate blindness is not required; overlooking red flags carelessly is enough.

Appealing an Administrative Sanction

If the FIC imposes an administrative sanction you believe is unjust, Section 45D gives you a right of appeal to an independent Appeal Board. The appeal is lodged by delivering a formal notice of appeal to the Appeal Board Secretariat and serving it on all other parties to the decision. The notice must include the original decision, any statement of reasons provided by the FIC, and an affidavit setting out the grounds for the appeal.¹³

Once the appeal is filed, the process runs on set timelines. The FIC has 15 days to file a notice to oppose, then a further 15 days to submit its answering affidavit. The appellant has 10 days to reply. Each side then has 15 days to submit written legal arguments. The period from 16 December to 15 January each year is excluded from these deadlines. A late appeal must include an affidavit explaining the delay and requesting condonation.¹³

1
Financial Intelligence Centre. Financial Intelligence Centre Act 2001, Act 38 of 2001
2
South African Government. General Laws (Anti-Money Laundering and Combating Terrorism Financing) Amendment Act
3
South African Government. Financial Intelligence Centre Act Schedule 1 – List of Accountable Institutions Amendment
4
South African Government. Financial Intelligence Centre Act Amendment of Schedules 1, 2 and 3
5
Financial Intelligence Centre. What Are the Beneficial Ownership Obligations for Business
6
Financial Intelligence Centre. Drafting a Risk Management and Compliance Programme
7
Financial Intelligence Centre. PCC 51 – Guidance on Measures Relating to Foreign Prominent Public Official, Domestic Prominent Influential Persons, Their Immediate Family Members and Known Close Associates
8
Financial Intelligence Centre. What Is a Cash Threshold Report (CTR)
9
Financial Intelligence Centre. Guidance Note 4B – Suspicious Transaction Reports
10
Financial Intelligence Centre. Guidance Note 6A – Terrorist Property Reporting Obligations
11
Financial Intelligence Centre. Reference Guide for All Accountable Institutions
12
Financial Intelligence Centre. Consequences of Non-Compliance with the Financial Intelligence Centre Act
13
Financial Intelligence Centre. Financial Intelligence Centre Act Appeal Board Rules