FICA KYC means customer due diligence under the Financial Intelligence Centre Act 38 of 2001. An accountable institution must establish and verify the identity of each client, and of anyone acting on the client’s behalf, in line with its Risk Management and Compliance Programme (RMCP). For legal persons that includes finding the beneficial owners.
This page is for businesses that are accountable institutions, not for the customers who supply the documents.
Business Requirements at a Glance
An accountable institution must develop, document, maintain and implement an RMCP covering anti-money-laundering, counter-terrorist-financing and proliferation-financing risk. Alongside it, you need to do the following.
- Register with the FIC on goAML. Registration is compulsory, includes compliance officer details, is free and must happen within 90 days of the business commencing. Failure to register can lead to a fine of up to R10 million.
- Identify and verify clients (section 21), understand the business relationship (section 21A), and apply additional measures for legal persons, trusts and partnerships (section 21B).
- Apply ongoing due diligence (section 21C) and the measures for prominent persons (sections 21F to 21H).
- Identify beneficial owners of legal persons: the natural persons with a controlling ownership interest.
- Keep records and report to the FIC.
- Train your employees so that they can comply with the Act and your RMCP.
To register, access the goAML platform, register the entity to receive an ORG ID, and then the compliance officer registers as the first user. See the FIC FAQ page for detail.
Registration and Legal Requirements
Whether you are an accountable institution depends on the categories listed in Schedule 1 to the Act. The FIC supervises trust and company service providers, legal practitioners, high-value goods dealers, the SA Mint, crypto asset service providers and credit providers. The Financial Sector Conduct Authority (FSCA) supervises authorised users of an exchange, collective investment scheme managers and financial services providers. Confirm who supervises your sector.
Be careful with older lists. Motor vehicle dealers and Krugerrand dealers were Schedule 3 reporting institutions, and Schedule 3 was removed from the Act with effect from 19 December 2022. Certain such businesses became high-value goods dealers under Schedule 1, which covers dealers who receive payments of R100 000 or more per item. Accountants are not a listed category in the FIC’s Schedule 1 item list.
Documents and Ownership Information Required
Your files should show how you identified and verified each client and, for legal persons, who the beneficial owners are.
- Identification and verification records for each client, and for any person acting on the client’s behalf with their authority
- The nature of the client’s business and its ownership and control structure, for legal persons
- The identity of the beneficial owners
- Your RMCP, which must list how records are kept
Records of the business relationship and transactions must be kept for at least five years. They may be kept electronically or by a third party.
Tax, Licence and Compliance Requirements
Administrative sanctions may include a reprimand, a directive, a restriction or suspension, and financial penalties of up to R10 million for natural persons and R50 million for legal persons.
The FIC’s Act does not prescribe a training format, but training must enable your staff to comply with the Act and your RMCP.
Process, Deadlines and Ongoing Obligations
Reports to the FIC have these deadlines, counted from when you become aware of the fact.
- Suspicious and unusual transactions (section 29): 15 days
- Cash threshold reports (section 28): 3 days
- International funds transfers (section 31): 3 days
- Terrorist property (section 28A): 5 days
Directive 12 required specified accountable institutions (Schedule 1 items 1, 2, 9 and 11) to submit their RMCP to the FIC by 9 October 2026, a date that has just passed. Submission needs a mandatory comment at Step 5. If this applies to your sector, read the FIC notice on RMCP submissions.
Frequently Asked Questions
What are FICA KYC requirements?
Customer due diligence under section 21 and related sections: identify and verify the client and any beneficial owners in line with your RMCP, apply ongoing due diligence, keep records for five years and report to the FIC.
Who is an accountable institution?
A business in a category listed in Schedule 1 to the Act, such as legal practitioners, estate agents, banks, credit providers, financial services providers and high-value goods dealers. Check the FIC’s current list.
What is an RMCP?
The Risk Management and Compliance Programme you must develop, document, maintain and implement to manage money-laundering, terrorist-financing and proliferation-financing risk.
What is beneficial ownership?
For a legal person, the natural persons who hold a controlling ownership interest. You must establish who they are.
How long must I keep FICA records?
At least five years. Records may be kept electronically or by a third party, as set out in your RMCP.
Confirm your obligations with the Financial Intelligence Centre (FIC) and your supervisory body. See business and compliance requirements and company registration requirements for related guidance.