FICA is the Financial Intelligence Centre Act 38 of 2001, South Africa’s anti-money-laundering law. It requires accountable institutions, such as banks, to establish and verify who their clients are before they conclude a transaction or start a business relationship. That is why a bank asks you for an identity document and proof of address.
If you run a business, the question is different: FICA requirements apply to you only if you are an accountable institution, and then they go well beyond collecting documents. The Financial Intelligence Centre (FIC) is the country’s financial intelligence unit and the body to confirm your obligations with.
Business Requirements at a Glance
An accountable institution must do the following.
- Register with the FIC on its goAML platform (free, and within 90 days of the business commencing)
- Develop, document and implement a Risk Management and Compliance Programme (RMCP)
- Establish and verify the identity of each client, including the beneficial owners of legal persons
- Keep records for at least five years
- Report cash transactions of R50 000 or more, suspicious and unusual transactions, and certain other transactions to the FIC
The FIC’s own FIC FAQ page explains registration and reporting.
Registration and Legal Requirements
Accountable institutions are those listed in Schedule 1 to the Act. The FIC’s registration page lists them as legal practitioners, trust and company service providers, estate agents, authorised users of an exchange, collective investment scheme managers, banks, mutual banks, co-operative banks, life insurance businesses, gambling businesses, dealers in foreign exchange, credit providers, financial services providers, issuers of travellers’ cheques and money orders, Postbank, money or value transfer providers, high-value goods dealers, the South African Mint Company, crypto asset service providers and clearing system participants.
The Schedule was amended with effect from 19 December 2022. The changes added co-operative banks, company service providers, a wider range of credit providers, high-value goods dealers, the SA Mint, crypto asset service providers, hawaladars and payment clearing operators.
Registration with the FIC is compulsory for Schedule 1 institutions. Failing to register is an offence that carries a fine of up to R10 million. If you are not sure whether your business is listed, confirm with the FIC or your sector supervisory body before assuming that it is not.
Documents and Ownership Information Required
There is no single list that every institution must use. Institutions set their own document rules on a risk basis, so a bank may ask for more or fewer documents than the examples below. The FIC’s older Guidance Note 3A gives these examples.
- Identity: a South African green bar-coded identity document for citizens and residents. In exceptional cases a South African driver’s licence or passport may be accepted. Foreign non-residents use a passport.
- Proof of residential address: for example a utility bill, a bank statement from another bank, a recent lease, a municipal rates invoice, a mortgage statement, or a telephone or cellphone account.
- Age of documents: they must be current, and the guidance treats less than three months old as good practice.
The address slip in a Home Affairs identity document does not by itself count as proof of your current address, in the FIC’s stated view.
For companies and other legal persons, the institution must also establish the nature of the business, its ownership and control structure, and the identity of the beneficial owners. Beneficial owners are the natural persons who hold a controlling ownership interest.
Tax, Licence and Compliance Requirements
Records must be kept for at least five years, counted from the end of the business relationship, from the date of the transaction, or from the date a report was submitted.
Non-compliance is costly. A conviction can lead to up to 15 years’ imprisonment or a fine of up to R100 million. Administrative financial penalties go up to R10 million for natural persons and R50 million for legal persons.
Process, Deadlines and Ongoing Obligations
Reports have strict deadlines, set out in the Act and the Money Laundering and Terrorist Financing Control Regulations.
- Cash transactions above R49 999.99 (that is, R50 000 and above) must be reported to the FIC as a cash threshold report (CTR), as soon as possible and no later than 3 days after you become aware of the fact.
- Suspicious and unusual transaction reports must go in as soon as possible and no later than 15 days after you become aware of the fact.
- Terrorist property reports are due within 5 days, and international funds transfer reports within 3 days.
Directive 12 also required specified accountable institutions (Schedule 1 items 1, 2, 9 and 11) to submit their RMCP to the FIC by 9 October 2026, a date that has just passed. If that applies to you, check the FIC notice on RMCP submissions straight away.
Frequently Asked Questions
What is FICA?
FICA is the Financial Intelligence Centre Act 38 of 2001. It makes banks and other listed businesses identify and verify their clients, keep records and report certain transactions to the FIC.
What does FICA mean?
The letters stand for the Financial Intelligence Centre Act. It is South Africa’s anti-money-laundering law, and the FIC is the body that administers it.
What documents do I need for FICA?
Usually an identity document or passport and proof of residential address, such as a utility bill, bank statement, lease or rates invoice, ideally less than three months old. Each institution applies its own risk-based rules, so ask what yours needs.
What documents are required for a business?
In addition to the above for the people involved, the institution must establish the nature of the business, its ownership and control structure, and the identity of its beneficial owners. Ask the institution for its exact list.
What is the FICA threshold?
Accountable institutions must report cash transactions above R49 999.99 (R50 000 and above) to the FIC within 3 days of becoming aware of them.
What is the FICA verification process?
The institution establishes and verifies your identity before it concludes a transaction or starts a business relationship, in line with its own RMCP. It then continues to monitor the relationship.
Why do banks ask for proof of address?
Because the Act requires them to establish and verify a client’s identity before doing business, and they use proof of address as part of that process.
Is my business an accountable institution?
Only if it falls under one of the categories in Schedule 1, listed above. Confirm with the FIC or your supervisory body.
Confirm your obligations with the Financial Intelligence Centre (FIC) and your supervisory body. See business and compliance requirements and company registration requirements for related guidance.