FICA
Financial Intelligence Centre Act, 2001 (Act No. 38 of 2001)
The Act that decides whether you may take a client on at all, what you must keep, what you must report to the Financial Intelligence Centre and how fast, and makes telling the client you reported them a separate offence.
Sections
22
Duties
28
Questions
48
Assessment from
R 30 200
What it covers
FICA is South Africa's anti money laundering, counter terrorist financing and counter proliferation financing statute. It binds an accountable institution listed in Schedule 1, which is banks, authorised financial services providers, long term insurers, attorneys and trust companies holding client money, estate agents, casinos and other gambling institutions, money remitters, foreign exchange dealers, high value goods dealers, co-operative banks, credit providers and, since item 22 was added in December 2022, crypto asset service providers. A shorter list of reporting institutions in Schedule 3, currently motor vehicle dealers and Kruger Rand dealers, carries the cash reporting duties only. The 2017 amendment turned the Act from a checklist into a programme. Before it, the law told you which documents to collect. After it, s 42 requires you to write your own Risk Management and Compliance Programme, and almost every due diligence duty in the Act is then expressed as a duty to act in accordance with that programme. That is why an institution with a thick file of client copies and no RMCP is non compliant, and why an RMCP that says something the business does not actually do is worse than no RMCP at all: it is the standard you have set for yourself and will be inspected against. Four duties carry most of the exposure. Section 21 read with ss 21A to 21H requires you to establish and verify who your client is, who is behind the client, and whether anybody in that chain is a politically exposed person, before you transact. Section 21E then says that if you cannot complete that, you may not establish the relationship, may not conclude the transaction, and must terminate an existing relationship. Section 28 requires a cash threshold report within three days of a cash transaction above R49 999,99. Section 29 requires a suspicious or unusual transaction report as soon as possible and no later than fifteen days, and ss 29(3) and 29(4) make it a separate criminal offence, carrying up to fifteen years, to tell the client or anybody else that the report exists. Enforcement does not need a court. Under s 45C the Centre or a supervisory body may impose a financial penalty of up to R50 million on a legal person on the facts available to it, after giving notice and considering representations, and may publish the sanction. South Africa's February 2023 Financial Action Task Force greylisting, exited in October 2025, was driven in large part by weak supervision of exactly these duties, and the inspection appetite it created has not gone away. This assessment covers the twenty two sections that bind the institution itself. It does not cover the Centre's own powers, the supervisory bodies' inspection procedure, the appeal board, or the Minister's power to amend the schedules, because a business cannot act on any of those. Crypto asset service providers should assess FIC Directive 6 as well, which is a separate authority in this library under FICA D6.
Does this apply to you?
It applies if
- You carry on a business listed in Schedule 1 to FICA, which makes you an accountable institution: a bank or mutual bank, a long term insurer, an authorised financial services provider, an attorney or a trust company that holds client money, an estate agent, a casino or other gambling institution, a money remitter, an authorised foreign exchange dealer, a high value goods dealer, a co-operative bank, a credit provider, or a crypto asset service provider under item 22
- You carry on a business listed in Schedule 3, currently a motor vehicle dealer or a Kruger Rand dealer, which makes you a reporting institution and brings the cash reporting duties in s 28 and the registration duty in s 43B
- You accept, hold, transfer or pay out money on behalf of another person, whatever you call the product, because that is what puts you in the Schedule 1 items rather than the label on your licence
- You are the South African branch, subsidiary or group member of an accountable institution, because s 42(2)(q) and (qA) extend the programme duties to branches and majority owned subsidiaries
Thresholds that change what's required
- A cash threshold report is due for any single transaction in which cash above R49 999,99 is paid to or received from a client, under regulation 22B as substituted on 14 November 2022
- That report must reach the Centre as soon as possible and no later than three days after a person in the business became aware of the fact of the transaction, under regulation 24(4)
- A suspicious or unusual transaction report must reach the Centre as soon as possible and no later than fifteen days after becoming aware of the fact that gave rise to the suspicion, under regulation 24(3). There is no monetary threshold at all: a suspicion about a R200 transaction is reportable
- A terrorist property report under s 28A must reach the Centre within five days, under regulation 24(1)
- Records must be kept for at least five years, running from the end of the business relationship for client due diligence records, from the date of the transaction for transaction records, and from the date the report was submitted where a transaction gave rise to a s 29 report
- There is no size exemption. A sole practitioner attorney holding one client's deposit is an accountable institution on exactly the same terms as a commercial bank, except that s 42A(4) does not require a sole practitioner to appoint anybody to assist
Exemptions
- A business in neither Schedule 1 nor Schedule 3 is not an accountable or reporting institution and the Act's control measures do not apply to it. The s 29 reporting duty is the exception: it binds any person who carries on, manages or is employed by any business at all
- Simplified due diligence is permitted where your own Risk Management and Compliance Programme provides for it under s 42(2)(m), which means it has to be justified in a documented risk assessment before it is applied, not decided at the counter
- An exemption granted to a class of accountable institutions by the Minister under s 74 overrides the duty it exempts. Check the current exemption notices before concluding a duty does not apply, rather than relying on an older one
- Section 42A(2) and (4) do not require a sole practitioner that is not a legal person to appoint a person to assist with compliance. The duty to ensure compliance under s 42A(3) still binds that practitioner personally
Where this text comes from
Transcribed 2026-10-20. Check the provision against the source before relying on it in a filing.
What non-compliance costs
Maximum fine
R 100 000 000
Imprisonment
Section 68(1): a person convicted of an offence in Chapter 4 is liable to imprisonment for up to 15 years or a fine of up to R100 million. That bracket covers failing to report a suspicious or unusual transaction under s 52, disclosing the fact or contents of such a report under s 53, contravening the United Nations Security Council prohibitions under s 49A, failing to report a cash transaction under s 51(1), and conducting two or more transactions to avoid a reporting duty under s 64(1). Section 68(2) puts a five year and R10 million ceiling on the narrower offences in ss 55, 62A, 62B, 62C and 62D.
Civil exposure
Section 45C lets the Centre or a supervisory body impose an administrative sanction with no court involved, on the facts available to it, after written notice and representations. The sanctions are a caution, a reprimand, a directive to take remedial action, the restriction or suspension of specified business activities, or a financial penalty of up to R10 million for a natural person and up to R50 million for a legal person. Section 45C(4)(b) lets that penalty be directed at the individual personally responsible for the non compliance. An unpaid penalty becomes a civil judgment once the appeal period lapses, under s 45C(7)(b). Most FICA exposure arrives this way rather than through a prosecution: failure to identify a client (s 46), failure to perform due diligence (s 46A), failure to keep records (s 47), failure in respect of the Risk Management and Compliance Programme (s 61), failure to register (s 61A), failure in regard to governance (s 61B) and failure to provide training (s 62) are all administrative sanctions only.
Reputational
Administrative sanctions are published, and the restriction or suspension of specified business activities under s 45C(3)(d) stops the revenue the activity earns on the day it takes effect. A supervisory body that is also your licensing authority can run a parallel process against the licence itself. Correspondent banks and payment partners ask for the sanction history during onboarding and at every review, so a published sanction can cost a settlement relationship that the penalty itself would not have.
What the assessment covers
The assessment works through 48 questions across 28 duties, scored out of 552. Each answer generates the specific actions needed to close or prove that duty, and a “yes” only counts once its evidence is in, which is what makes the score defensible rather than self-declared.
The questions themselves are part of the assessment.
Find out where you stand on FICA
Run the assessment, get your score, and get the exact list of what to fix, with the evidence trail an auditor will ask for.