FATF Alignment
Summary
A definitive mapping of InTouch's platform features and capabilities to each of the Financial Action Task Force's 40 Recommendations — demonstrating how InTouch helps South African accountable institutions fulfil their obligations under the global AML/CFT framework that underpins the FIC Act.
FATF, the FIC Act, and InTouch
The Financial Action Task Force's 40 Recommendations are the internationally agreed global standard for combating money laundering, terrorist financing, and proliferation financing. South Africa's FIC Act is the domestic legislative implementation of these Recommendations — meaning every FATF-aligned obligation flows directly into what accountable institutions must do.
South Africa's February 2023 FATF greylisting identified specific gaps across several Recommendation areas. The resulting legislative amendments — including the December 2022 FIC Act changes and the TPCA — directly tightened obligations for accountable institutions, particularly around beneficial ownership, CDD, PEP identification, and high-value sector oversight. This document maps how InTouch's platform directly supports compliance with those obligations.
This summary is structured around the six FATF pillars, with a detailed mapping table for all 40 Recommendations, a coverage rating for each, and the specific InTouch feature or capability that enables compliance where applicable.
Each of the 40 Recommendations is assessed for direct relevance to accountable institutions (private sector). Recommendations primarily addressed at government, law enforcement, or competent authorities are flagged as contextual — they define the regulatory environment InTouch operates within, but compliance is not a platform-level obligation. Where InTouch provides direct or partial coverage, the specific feature is named and explained.
The Six FATF Pillars
The 40 Recommendations are organised into six thematic pillars. The pillar with the highest relevance to accountable institutions — and where InTouch's coverage is deepest — is the Preventive Measures pillar (Recommendations 9–23).
Policies & Coordination
National AML/CFT risk assessments and inter-agency coordination frameworks.
ML & Confiscation
Criminalisation of money laundering and asset confiscation powers.
TF & Proliferation Financing
Terrorist financing offences, targeted financial sanctions, and NPO oversight.
Preventive Measures
CDD, record keeping, PEP identification, correspondent banking, wire transfers, and reporting — the core private-sector obligations.
Transparency & Beneficial Ownership
Beneficial ownership registers for companies and trusts.
Powers & International Cooperation
Supervisory authorities, law enforcement powers, FIU functions, and international cooperation.
How InTouch Coverage is Rated
Policies & Coordination
These Recommendations establish the national-level AML/CFT framework within which accountable institutions operate. They define what the government must do; they inform what institutions must implement.
Recommendations 1–2: Risk Assessment & National Cooperation
R.1–2| Rec. | Recommendation | Institutional Obligation & InTouch Response | Coverage |
|---|---|---|---|
| R.1 | Assessing Risks & Applying a Risk-Based Approach (RBA) Countries and institutions must identify, assess, and understand their ML/TF risks and apply resources accordingly. | InTouch Risk Rating Engine operationalises the RBA at client level — scoring every individual and entity across 10 weighted risk categories (customer type, interaction method, source of wealth, geographic risk, AML screening results, etc.). This enables institutions to differentiate CDD, SDD, and EDD treatment based on documented, auditable risk reasoning — the essence of R.1 compliance at the institutional level. | ✓ Full |
| R.2 | National Cooperation & Coordination Government authorities must coordinate nationally on AML/CFT policy. | Government and regulatory obligation. InTouch operates in alignment with the national frameworks established under R.2 — including the FIC Act, FSCA supervisory frameworks, and SAPS coordination. Not a platform-level obligation for accountable institutions, but InTouch's goAML-compatible reporting outputs support institutions in meeting their obligations within this framework. | Context |
Money Laundering & Confiscation
These Recommendations require the criminalisation of ML and the establishment of confiscation powers — legislative and enforcement obligations. Accountable institutions benefit from understanding these as the "why" behind their reporting obligations.
Recommendations 3–4: ML Offences & Confiscation
R.3–4| Rec. | Recommendation | Institutional Obligation & InTouch Response | Coverage |
|---|---|---|---|
| R.3 | Money Laundering Offence ML must be criminalised in accordance with the Vienna and Palermo Conventions, across all serious predicate offences. | Legislative obligation enacted in South Africa via POCA (Prevention of Organised Crime Act) and the FIC Act. Accountable institutions' primary obligation under R.3 is to detect and report suspicious transactions (STRs) that may indicate ML. InTouch AML Screening and transaction monitoring capabilities support institutions in identifying activity consistent with ML typologies, generating the evidence base for STR decisions. | ◐ Partial |
| R.4 | Confiscation & Provisional Measures Countries must adopt measures to confiscate proceeds of crime and instrumentalities of ML/TF. | Law enforcement and court-level obligation. Accountable institutions contribute by freezing assets upon receiving a directive from the FIC or relevant authority under POCA. InTouch's UN Sanctions and targeted financial sanctions screening identifies parties against whom asset freezing obligations may apply — enabling institutions to act correctly when freeze directives are issued. | ◐ Partial |
Terrorist Financing & Proliferation Financing
These Recommendations criminalise terrorist financing, require implementation of UN targeted financial sanctions, and establish obligations around NPOs and proliferation financing. Several carry direct screening obligations for accountable institutions.
Recommendations 5–8: TF Offences, Targeted Sanctions, NPOs & Proliferation
R.5–8| Rec. | Recommendation | Institutional Obligation & InTouch Response | Coverage |
|---|---|---|---|
| R.5 | Terrorist Financing Offence TF must be criminalised. Accountable institutions must report any property associated with TF. | Enacted in South Africa via the POCDATARA and FIC Act (Terrorist Property Reports — TPRs). InTouch AML Screening screens all clients against UN, OFAC, EU, and HMT lists including terrorism-related designations, enabling institutions to identify and report in accordance with TPR obligations before any property is dealt with. | ✓ Full |
| R.6 | Targeted Financial Sanctions — Terrorism & TF Institutions must implement UN Security Council TFS resolutions without delay — freezing assets and prohibiting transactions with designated parties. | InTouch Sanctions Screening covers all active UN Security Council consolidated lists (1267, 1373, and related resolutions), OFAC SDN list, EU consolidated sanctions, HM Treasury, and other major designating bodies. Screening occurs in real time at onboarding and can be re-run at any interval. Results are logged with timestamp — creating the documented evidence of TFS compliance regulators require. Any match triggers immediate EDD escalation. | ✓ Full |
| R.7 | Targeted Financial Sanctions — Proliferation Financing Institutions must implement UN TFS related to proliferation of weapons of mass destruction without delay. | InTouch Sanctions Screening includes UN proliferation-related designations (DPRK, Iran, and related UN Security Council resolutions). Screening covers all relevant entity and individual designations, ensuring that institutions can identify and freeze assets or refuse transactions involving proliferation-designated parties in compliance with R.7 and FIC Act Section 28B obligations. | ✓ Full |
| R.8 | Non-Profit Organisations (NPOs) NPOs must not be abused for TF purposes. Supervisors must apply risk-proportionate oversight to NPOs. | Primarily a supervisory and NPO sector obligation. For accountable institutions with NPO clients, R.8 informs the InTouch Risk Rating — NPOs are treated as a higher-risk customer type, triggering enhanced due diligence, source-of-funds verification, and more frequent review cycles. InTouch's KYB capability verifies NPO registration status and governance structures. | ◐ Partial |
Preventive Measures — The Core Private-Sector Pillar
Recommendations 9–23 constitute the primary obligations of accountable institutions under FATF. This is the pillar where InTouch's coverage is deepest and most direct, addressing CDD, record keeping, PEP identification, wire transfers, new technologies, reliance, and reporting — the operational backbone of every compliance programme.
Financial Institution Secrecy Laws (R.9)
R.9| Rec. | Recommendation | Institutional Obligation & InTouch Response | Coverage |
|---|---|---|---|
| R.9 | Financial Institution Secrecy Laws Secrecy laws must not inhibit implementation of FATF Recommendations. | Regulatory and legislative obligation. InTouch operates within the legal framework that balances secrecy (POPIA) with disclosure (FIC Act). InTouch's Data Processing Agreement and POPIA Compliance Statement formalise the lawful basis under which verification data is processed — ensuring that CDD is conducted within the law, not in breach of it. | Context |
Customer Due Diligence — R.10, 11, 12
R.10–12| Rec. | Recommendation | Institutional Obligation & InTouch Response | Coverage |
|---|---|---|---|
| R.10 | Customer Due Diligence Institutions must identify and verify customers, understand the nature of the business relationship, conduct ongoing due diligence, and identify beneficial owners. | The most directly applicable Recommendation to InTouch's core platform. InTouch delivers full R.10 compliance through: (a) Identity Verification — full name, DOB, ID number verified against DHA/HANIS in real time; (b) Biometric Liveness Check — confirming the person presenting is the verified identity; (c) KYB / CIPC Lookup — entity identification and verification; (d) Risk Rating — purpose and nature of the business relationship assessed and documented; (e) Ongoing monitoring scheduling — next-review dates automatically set; (f) UBO identification — beneficial owners identified and individually verified. | ✓ Full |
| R.11 | Record Keeping All CDD information and transaction records must be maintained for a minimum of 5 years and made available to competent authorities. | InTouch Audit Trail automatically retains every verification record — including the full data collected, sources queried, results returned, timestamps, and the identity of the operator who ran the check — for a minimum of 5 years from the conclusion of the business relationship. Records are cryptographically sealed (SHA-256 hash), making tampering immediately detectable. Exportable as PDF on demand — available to regulators within minutes, not days. | ✓ Full |
| R.12 | Politically Exposed Persons Institutions must apply EDD to foreign PEPs (mandatory) and domestic PEPs/international organisation PEPs (risk-based). Senior management approval required; source of wealth must be established. | InTouch PEP Screening identifies Domestic PEPs (DPEPs), Foreign PEPs (FPEPs), and Prominent Influential Persons (PIPs) at onboarding and on an ongoing basis. PEP detection automatically triggers EDD routing — escalating the record to a senior compliance officer, flagging for source-of-wealth documentation, and applying enhanced review scheduling. All PEP identification events are logged with the screening basis and response. Covers family members and close associates of designated PEPs. | ✓ Full |
Correspondent Banking, Shell Banks & New Technologies — R.13, 14, 15
R.13–15| Rec. | Recommendation | Institutional Obligation & InTouch Response | Coverage |
|---|---|---|---|
| R.13 | Correspondent Banking Institutions must apply EDD to cross-border correspondent banking relationships and assess the respondent institution's AML/CFT controls. | Primarily relevant to banking institutions. InTouch supports R.13 compliance for institutions with correspondent banking activities by enabling AML screening and EDD workflows for correspondent institution counterparties, including sanctions screening and adverse media review of the respondent institution's jurisdiction and leadership. | ◐ Partial |
| R.14 | Money or Value Transfer Services (MVTS) MVTS providers must be licensed, registered, and subject to AML/CFT measures. | Primarily a registration and supervisory obligation for MVTS providers. For institutions that use or deal with MVTS providers, InTouch's KYB capability can verify the registration status of MVTS counterparties and screen their key personnel for AML, PEP, and sanctions exposure. | ◐ Partial |
| R.15 | New Technologies Institutions must assess ML/TF risks of new products, services, and technologies before launch, and manage those risks. | InTouch directly enables R.15 compliance for institutions deploying digital onboarding, remote identity verification, and virtual asset services. The platform's biometric liveness detection, AI-powered document authentication, and synthetic identity fraud detection controls are specifically designed to manage the elevated risk of digital-channel customer acquisition — the core concern of R.15 in the modern financial services environment. | ✓ Full |
Wire Transfers & Reliance on Third Parties — R.16, 17
R.16–17| Rec. | Recommendation | Institutional Obligation & InTouch Response | Coverage |
|---|---|---|---|
| R.16 | Wire Transfers Institutions must include and verify required originator and beneficiary information in wire transfers, and screen against TFS lists. | For institutions conducting wire transfers, R.16 requires beneficiary screening before funds are released. InTouch Sanctions and AML Screening can be run on both originating and beneficiary parties for any transfer, ensuring that funds are not transmitted to sanctioned or TFS-designated parties. The sub-3-second screening time enables real-time payment screening without operational friction. | ✓ Full |
| R.17 | Reliance on Third Parties Institutions may rely on third parties to perform CDD, but ultimate responsibility remains with the relying institution. Third parties must be regulated and compliant. | InTouch provides CDD enablement infrastructure that accountable institutions may use to fulfill their customer due diligence obligations under R.17 — however, ultimate responsibility for CDD compliance remains with the institution. InTouch's POPIA compliance, DHA/HANIS and CIPC integration, and full audit trail documentation support institutions in meeting their CDD requirements. The Data Processing Agreement formalises the relationship. | ◐ Partial |
Internal Controls, DNFBPs, Reporting & Tipping Off — R.18–21
R.18–21| Rec. | Recommendation | Institutional Obligation & InTouch Response | Coverage |
|---|---|---|---|
| R.18 | Internal Controls & Foreign Branches Institutions must implement group-wide AML/CFT programmes including internal controls, compliance management, and employee screening. | InTouch supports R.18 internal control implementation through: role-based access controls (ensuring segregation of duties), operator-level audit logging (every action attributed to a named user), risk rating documentation (written rationale for every CDD decision), and review scheduling (systematic ongoing monitoring). These controls form the verifiable, auditable backbone of a compliant internal AML/CFT programme. | ✓ Full |
| R.19 | Higher-Risk Countries Institutions must apply EDD to customers and transactions involving countries identified by FATF as high-risk. | InTouch Risk Rating incorporates geographic risk as a weighted category. Countries on the FATF high-risk and monitored lists (including FATF Public Statements) are flagged in the risk assessment, automatically elevating the risk score and triggering EDD treatment. The platform's screening covers international sanctions and watchlists relevant to high-risk jurisdictions. Geographic risk weightings are configurable to match each institution's risk framework. | ✓ Full |
| R.20 | Reporting of Suspicious Transactions Institutions must report suspicious transactions (STRs) to the FIU promptly, regardless of value. | InTouch AML Screening and Risk Rating generate the documented evidence base that informs STR decisions. When a screening match, high risk score, or flagged transaction pattern is identified, InTouch creates an audit-ready record of the detection, the basis for suspicion, and the escalation pathway — all of which are required to support a well-documented STR submission to the FIC via goAML. STR submission itself is completed directly through the goAML portal. | ◐ Partial |
| R.21 | Tipping-Off & Confidentiality Institutions must not disclose to a customer that an STR has been filed or that they are under investigation. Staff must be protected from liability for good-faith reporting. | InTouch's platform workflow design supports tipping-off prevention by separating screening results (visible to compliance staff) from client-facing communications. EDD escalation and STR preparation workflows are conducted within the portal — not via email or channels that could inadvertently reach the subject. Staff conducting EDD reviews within InTouch are protected under the FIC Act's safe harbour provisions for good-faith reporting. | ◐ Partial |
Designated Non-Financial Businesses & Professions (DNFBPs) — R.22, 23
R.22–23| Rec. | Recommendation | Institutional Obligation & InTouch Response | Coverage |
|---|---|---|---|
| R.22 | DNFBPs — Customer Due Diligence The same CDD obligations that apply to financial institutions apply to DNFBPs: lawyers, accountants, real estate agents, dealers in precious metals/stones, and trust/company service providers. | InTouch's platform serves DNFBP accountable institutions directly. Legal firms, accountancy practices, real estate agencies, and high-value goods dealers can conduct the same full KYC, AML, PEP screening, UBO identification, and risk rating workflows as financial institutions — using the same platform. The audit trail supports demonstrating CDD compliance to the FIC and relevant supervisory bodies (LSSA, SAICA, EAAB, etc.). | ✓ Full |
| R.23 | DNFBPs — Other Measures DNFBPs must apply the same internal controls, record keeping, and STR reporting measures as financial institutions. | InTouch's record keeping, audit trail, and risk rating capabilities apply equally to DNFBP clients. The platform's role-based access controls, 5-year retention, and PDF export functionality directly satisfy R.23 record-keeping requirements for law firms, accountants, and other DNFBPs. Internal rule documentation is supported through the Risk Rating framework's configurable policy settings. | ✓ Full |
Transparency & Beneficial Ownership
Recommendations 24 and 25 address the transparency of legal persons and arrangements — the obligations around identifying who ultimately owns and controls companies and trusts. These were among the specific areas where South Africa received adverse FATF findings, making them particularly high-priority for accountable institutions.
Recommendations 24–25: Companies & Trusts
R.24–25| Rec. | Recommendation | Institutional Obligation & InTouch Response | Coverage |
|---|---|---|---|
| R.24 | Transparency & Beneficial Ownership of Legal Persons Countries must ensure adequate, accurate, and up-to-date beneficial ownership information is available for all legal persons, and that institutions can access this information. | InTouch KYB capability delivers R.24 compliance at the institutional level. For every legal entity client, InTouch: (a) verifies company registration via real-time CIPC lookup; (b) identifies all directors and authorised signatories; (c) individually verifies all UBOs (natural persons with ≥5% ownership); (d) where no majority shareholder exists, identifies and verifies controlling officers (CEO, CFO, COO). Every UBO is run through the full identity verification and AML screening workflow. Ownership structures are documented in the audit trail with source references. | ✓ Full |
| R.25 | Transparency & Beneficial Ownership of Legal Arrangements (Trusts) Trustees must maintain adequate, accurate, and current beneficial ownership information and disclose their status to institutions. Institutions must identify and verify trustees, settlors, beneficiaries, and protectors. | InTouch Trust KYB workflows address R.25 obligations for institutions with trust clients. The platform captures and verifies: the founder/settlor (identity verified against DHA); all trustees (individually identity-verified); named and discretionary beneficiaries (identified and documented); and the Letter of Authority from the Master of the High Court. Where beneficiaries are a class (unborn, undetermined), the class description and distribution criteria are documented. All trust-related persons are screened for AML, PEP, and sanctions exposure. | ✓ Full |
Powers, Supervision & International Cooperation
Recommendations 26–40 primarily address the obligations of competent authorities — regulators, the FIC, law enforcement, and government agencies. They define the environment within which accountable institutions operate, and several create indirect obligations for institutions. InTouch's audit trail and record-keeping capabilities are the primary institutional contribution to Pillar VI compliance.
Recommendations 26–35: Regulatory Powers, Supervision & FIU
R.26–35| Rec. | Recommendation | Institutional Obligation & InTouch Response | Coverage |
|---|---|---|---|
| R.26 | Regulation & Supervision of Financial Institutions Competent authorities must supervise financial institutions for AML/CFT compliance. | FSCA and Prudential Authority obligation. InTouch supports supervised institutions in demonstrating compliance during supervisory examinations through its on-demand audit trail exports, risk rating documentation, and screening result archives — enabling institutions to respond to regulatory information requests within hours rather than days. | Context |
| R.27 | Powers of Supervisors Supervisors must have adequate powers to supervise, inspect, and sanction institutions. | Regulatory power — not an institutional obligation. InTouch's audit trail ensures that when supervisors exercise their inspection powers, institutions can produce complete, structured, and credible compliance records in response. | Context |
| R.28 | Regulation & Supervision of DNFBPs DNFBPs must be subject to effective AML/CFT supervision. | Supervisory obligation for the LSSA, SAICA, EAAB, and other DNFBP-sector supervisors. InTouch's platform equips DNFBP institutions to meet the CDD standards that their supervisors will examine — creating the documented evidence of compliance that supervisory reviews expect. | Context |
| R.29 | Financial Intelligence Units Countries must establish an FIU to receive, analyse, and disseminate financial intelligence. | FIC (Financial Intelligence Centre) in South Africa. Accountable institutions report to the FIC via goAML. InTouch's AML workflows generate the structured evidence — screening results, risk ratings, suspicious indicators — that informs the STR and CTR submissions institutions make to the FIC. | ◐ Partial |
| R.30 | Responsibilities of Law Enforcement & Investigative Authorities | SAPS, NPA, and Hawks obligation. Not an institutional compliance requirement. InTouch records support law enforcement investigations by providing auditable evidence of institution-level CDD when requested under compulsory process. | Gov Only |
| R.31 | Powers of Law Enforcement & Investigation | Law enforcement powers — government obligation. InTouch records are available to law enforcement under applicable legal processes (court orders, FIC directives). | Gov Only |
| R.32 | Cash Couriers Declaration or disclosure systems for cross-border physical currency movements. | SARB and SARS border control obligation. Not directly applicable to most accountable institution platform functions. InTouch's IFTR-supporting workflows assist institutions that process cross-border electronic transfers, but physical cash courier declarations are a separate regulatory process. | Gov Only |
| R.33 | Statistics Countries must maintain comprehensive statistics on AML/CFT matters. | FIC and competent authority obligation. InTouch's bulk reporting and export capabilities allow accountable institutions to compile and submit statistical data on verification volumes, risk ratings, and screening results when requested by regulators — supporting the national statistics function indirectly. | Context |
| R.34 | Guidance & Feedback Competent authorities must provide guidance and feedback to institutions. | FIC, FSCA, and supervisory body obligation. InTouch monitors and incorporates FIC Guidance Notes into platform updates — ensuring that when the FIC issues guidance (e.g., the 2024 Guidance on Synthetic Identity Fraud), InTouch's controls are updated to reflect the latest regulatory expectations. | Context |
| R.35 | Sanctions Countries must apply effective, proportionate, and dissuasive sanctions for non-compliance. | Regulatory enforcement obligation. InTouch directly reduces institutions' exposure to sanctions under R.35 by providing the compliance infrastructure required to meet FATF-aligned obligations — meaning the risk of non-compliance findings that attract sanctions is substantially reduced. | Context |
Recommendations 36–40: International Cooperation
R.36–40| Rec. | Recommendation | Institutional Obligation & InTouch Response | Coverage |
|---|---|---|---|
| R.36 | International Instruments | Government obligation — ratification of UNTOC, Vienna Convention, Palermo Convention, and related instruments. Implemented in South Africa via POCA, POCDATARA, and the FIC Act. | Gov Only |
| R.37 | Mutual Legal Assistance | DOJ and NPA obligation. InTouch audit records can support MLA requests where an institution's customer records are relevant to foreign proceedings — provided through proper legal process. | Gov Only |
| R.38 | Mutual Legal Assistance — Freezing & Confiscation | Law enforcement and court obligation. InTouch's Sanctions Screening ensures institutions can respond correctly to international freezing requests by having already identified sanctioned counterparties before any transaction occurs. | ◐ Partial |
| R.39 | Extradition | Government obligation. No direct institutional application. InTouch AML screening covers Interpol notices and international law enforcement databases as part of the adverse media and watchlist screening suite. | Gov Only |
| R.40 | Other Forms of International Cooperation Competent authorities must be able to share financial intelligence internationally. | FIC and competent authority obligation. InTouch's global screening databases — covering OFAC, EU, HMT, UN, and over 1,400 international lists — enable South African institutions to identify counterparties of concern to foreign FIUs before transactions occur, indirectly supporting the international cooperation framework that R.40 establishes. | ◐ Partial |
Complete Coverage Summary — All 40 Recommendations
The table below provides a concise overview of InTouch's coverage position across all 40 FATF Recommendations, the pillar each belongs to, and the primary InTouch feature or capability involved.
| Rec. | Short Title | Pillar | Primary InTouch Feature | Coverage |
|---|---|---|---|---|
| R.1 | Risk-Based Approach | Policies | Risk Rating Engine (10-category weighted scoring) | ✓ Full |
| R.2 | National Coordination | Policies | Framework context — goAML reporting support | Context |
| R.3 | ML Offence | ML/Confiscation | AML Screening — STR evidence base | ◐ Partial |
| R.4 | Confiscation | ML/Confiscation | UN Sanctions Screening — freeze directive enablement | ◐ Partial |
| R.5 | TF Offence | TF/PF | AML Screening — terrorism designations, TPR support | ✓ Full |
| R.6 | Targeted Financial Sanctions — TF | TF/PF | Sanctions Screening — UN, OFAC, EU, HMT lists | ✓ Full |
| R.7 | Targeted Financial Sanctions — PF | TF/PF | Sanctions Screening — proliferation designations (DPRK, Iran) | ✓ Full |
| R.8 | Non-Profit Organisations | TF/PF | Risk Rating — NPO customer type; KYB verification | ◐ Partial |
| R.9 | Financial Secrecy Laws | Preventive | POPIA-aligned Data Processing Agreement | Context |
| R.10 | Customer Due Diligence | Preventive | Identity Verification + KYB + Biometrics + Risk Rating + UBO | ✓ Full |
| R.11 | Record Keeping | Preventive | Audit Trail — 5-year tamper-proof retention, PDF export | ✓ Full |
| R.12 | Politically Exposed Persons | Preventive | PEP Screening — DPEP, FPEP, PIP + EDD routing | ✓ Full |
| R.13 | Correspondent Banking | Preventive | AML + KYB for correspondent institution counterparties | ◐ Partial |
| R.14 | MVTS Providers | Preventive | KYB for MVTS counterparty verification | ◐ Partial |
| R.15 | New Technologies | Preventive | Biometric liveness, AI doc auth, synthetic identity detection | ✓ Full |
| R.16 | Wire Transfers | Preventive | Real-time Sanctions + AML Screening for payment parties | ✓ Full |
| R.17 | Reliance on Third Parties | Preventive | InTouch as compliant third-party CDD provider (DPA) | ✓ Full |
| R.18 | Internal Controls | Preventive | RBAC, operator logging, risk documentation, review scheduling | ✓ Full |
| R.19 | Higher-Risk Countries | Preventive | Geographic risk category in Risk Rating, FATF list integration | ✓ Full |
| R.20 | Suspicious Transaction Reporting | Preventive | AML evidence base for STR decisions — goAML submission separate | ◐ Partial |
| R.21 | Tipping-Off & Confidentiality | Preventive | Internal workflow separation — screening results not client-facing | ◐ Partial |
| R.22 | DNFBPs — CDD | Preventive | Full KYC/AML/PEP platform available to all DNFBP sectors | ✓ Full |
| R.23 | DNFBPs — Other Measures | Preventive | Record keeping + audit trail + risk framework for DNFBPs | ✓ Full |
| R.24 | BO of Legal Persons | Transparency | KYB — CIPC + UBO identification + individual ID verification | ✓ Full |
| R.25 | BO of Legal Arrangements | Transparency | Trust KYB — founder, trustee, beneficiary verification | ✓ Full |
| R.26 | Regulation of FIs | Powers | Audit trail supports supervisory examinations | Context |
| R.27 | Powers of Supervisors | Powers | On-demand record export for supervisor inspection | Context |
| R.28 | Regulation of DNFBPs | Powers | Platform compliance evidence for DNFBP supervisors | Context |
| R.29 | Financial Intelligence Units | Powers | AML screening evidence to support FIC reporting | ◐ Partial |
| R.30 | Law Enforcement Responsibilities | Powers | Government / law enforcement only | Gov Only |
| R.31 | Powers of Law Enforcement | Powers | Government / law enforcement only | Gov Only |
| R.32 | Cash Couriers | Powers | Government / SARB / SARS border control only | Gov Only |
| R.33 | Statistics | Powers | Bulk export supports institutional statistical reporting | Context |
| R.34 | Guidance & Feedback | Powers | FIC Guidance incorporated into platform updates | Context |
| R.35 | Sanctions for Non-Compliance | Powers | Compliance infrastructure reduces sanction exposure | Context |
| R.36 | International Instruments | Int'l Coop. | Government treaty obligation | Gov Only |
| R.37 | Mutual Legal Assistance | Int'l Coop. | Government / DOJ obligation | Gov Only |
| R.38 | MLA — Freezing & Confiscation | Int'l Coop. | Sanctions Screening — pre-transaction freeze enablement | ◐ Partial |
| R.39 | Extradition | Int'l Coop. | Government obligation — Interpol coverage in adverse media | Gov Only |
| R.40 | Other Int'l Cooperation | Int'l Coop. | 1,400+ global lists support international intelligence alignment | ◐ Partial |
InTouch Features — FATF Recommendation Cross-Reference
The inverse view: each InTouch platform feature and the specific FATF Recommendations it directly supports.
Identity Verification (DHA/HANIS)
Real-time government database lookupVerifies full name, DOB, and ID number of natural persons against the Department of Home Affairs national identity register in real time.
Biometric Liveness Detection
AI facial match + liveness checkConfirms the person presenting is the verified identity using 3D liveness analysis and facial comparison. Detects synthetic identities and presentation attacks.
AML & Sanctions Screening
1,400+ global lists in <3 secondsScreens individuals and entities against UN, OFAC, EU, HMT, and global watchlists simultaneously. Covers TF, PF, and ML designations.
PEP Screening
DPEP, FPEP, PIP + EDD routingIdentifies domestic and foreign PEPs and Prominent Influential Persons. Automatically triggers Enhanced Due Diligence workflows and senior management escalation for all matches.
Risk Rating Engine
10-category weighted RBA scoringOperationalises the FATF Risk-Based Approach at client level. Documents risk reasoning, assigns CDD/SDD/EDD treatment, and schedules ongoing review cycles.
KYB — Company & Trust Verification
CIPC + UBO identificationVerifies legal entities via CIPC, verifies all directors, beneficial owners (≥5%), and trust parties. Individually verifies each natural person through the full identity and AML workflow.
Audit Trail & Record Keeping
SHA-256 sealed, 5-year retentionEvery verification is automatically logged with a tamper-proof timestamp and cryptographic seal. Exportable as PDF on demand. Retained for 5 years from end of relationship.
Consent Service
POPIA-compliant digital consentDelivers, records, and timestamps informed consent before any personal information is processed — satisfying POPIA Section 11 and the lawful processing requirements that underpin every FATF CDD obligation.
Bulk Automations
Thousands of records via single uploadEnables periodic re-screening of entire client books for AML, PEP, and sanctions — essential for R.10 ongoing monitoring and the institution-wide risk reassessments required under R.1.
FATF's 2023 greylisting of South Africa identified specific deficiencies across R.6 (Targeted Financial Sanctions), R.10 (CDD — particularly beneficial ownership), R.12 (PEP identification), R.24 and R.25 (Transparency and beneficial ownership of legal persons and trusts), and R.28 (Supervision of DNFBPs). InTouch delivers full or primary coverage across all five of these greylisting trigger areas — directly addressing the gaps that regulators are most closely scrutinising.
InTouch Screening Universe — Every Source, Every Region
The following is the complete, verified list of data sources powering InTouch's AML, sanctions, enforcement, PEP/PIP, and adverse media screening capabilities. Sources are monitored continuously and updated in real time. This breadth of coverage is what allows InTouch to make a single screening check meaningful across all applicable FATF Recommendation areas.
The Three Screening Layers
InTouch screens against every major global sanctions regime simultaneously. Covers designated individuals, entities, vessels, and aircraft across all active UN Security Council resolutions, OFAC SDN and non-SDN lists, EU consolidated restrictive measures, and HMT/OFSI regimes.
- ›UN Security Council Resolutions (1267, 1373, 1988, 1970, 1718, 2140, 2206, 2253, 2653 + all active regimes)
- ›OFAC SDN List — 40+ programme-specific lists (counter-terrorism, counter-narcotics, Iran, Russia, North Korea, Cuba, Syria, Venezuela, Global Magnitsky, Cyber, Non-Proliferation, and more)
- ›OFAC non-SDN lists — SSI, FSE, NS-PLC, CAPTA, NS-MBS, NS-CMIC
- ›EU Consolidated Restrictive Measures — 50+ active regimes covering terrorism, human rights, proliferation, country-specific programmes
- ›HMT/OFSI — 30+ regime-specific lists (Afghanistan, Belarus, Russia, Iran, Myanmar, ISIL/Al-Qaida, Global Human Rights, Cyber, Counter-Terrorism, and more)
- ›Asian Development Bank Sanctions List
- ›Regional sanctions: Australia DFAT, Canada Global Affairs, Japan MoF, Singapore MAS, New Zealand, and 20+ other national programmes
- ›MEA-specific: Bahrain, Egypt, Jordan, Qatar, UAE, Saudi Arabia, Nigeria national terrorist and sanctions lists
InTouch identifies Politically Exposed Persons (PEPs), Prominent Influential Persons (PIPs), and their close associates and family members across all jurisdictions — covering domestic, foreign, and international organisation PEPs as required by FATF R.12 and the FIC Act.
- ✓Domestic PEPs (DPEPs) — Current and former holders of prominent public functions in South Africa: senior government officials, members of Cabinet and Parliament, executive officers of state-owned enterprises, senior judiciary, senior military and police leadership
- ✓Foreign PEPs (FPEPs) — Prominent political figures from all foreign jurisdictions: heads of state, senior politicians, senior government, judicial and military officials across 220+ countries
- ✓International Organisation PEPs — Senior officials of international bodies: UN, AU, IMF, World Bank, FATF, Interpol, and other supranational entities
- ✓Prominent Influential Persons (PIPs) — Individuals with significant influence in business, civil society, or media who may present elevated ML/CF risk
- ✓Close Associates & Family Members — Spouses, children, parents, and known close business associates of all PEP categories
- ✓Former PEPs — Individuals who previously held qualifying positions, subject to appropriate risk-based lookback period
InTouch screens against billions of global news articles and media sources to identify adverse coverage linked to money laundering, fraud, corruption, terrorism, sanctions evasion, and other financial crime typologies. Adverse media is a core component of the risk-based approach required by FATF R.1 and R.10.
- ›Money laundering — Criminal charges, investigations, convictions, regulatory actions
- ›Fraud & financial crime — Investment fraud, banking fraud, Ponzi schemes, embezzlement
- ›Corruption & bribery — Public sector corruption, state capture, procurement fraud
- ›Terrorism & extremism — Financing links, affiliation, material support
- ›Narcotics & trafficking — Drug trade, human trafficking, smuggling
- ›Sanctions evasion — Attempts to circumvent designated party restrictions
- ›Tax evasion — Offshore schemes, undeclared income, criminal tax cases
- ›Regulatory enforcement actions — Fines, bans, licence revocations, public censures globally
Financial Regulatory & Law Enforcement Source List
InTouch's enforcement screening covers financial regulatory enforcement actions, criminal law enforcement wanted lists, court decisions, exchange disciplinary actions, and anti-corruption body press releases — across four regional desks. The following is the verified source list as published by InTouch.
When your compliance officer runs a single check on InTouch, the platform simultaneously queries all applicable sources from across this entire database — in under 3 seconds. For a South African institution, that single check covers: the FIC's own watchlists, FSCA enforcement actions, SAPS wanted lists, CIPC company status, SARB regulatory actions, SARS enforcement, all active UN Security Council designations, the full OFAC SDN list across all 40+ programmes, the EU consolidated restrictive measures (50+ regimes), HMT/OFSI lists (30+ regimes), and 1,400+ additional enforcement and regulatory lists — plus PEP/PIP screening across all categories and adverse media in 30+ languages.
This is the breadth of coverage that the FIC Act's requirement to "apply a risk-based approach" demands in practice. No single compliance officer, no manual process, and no legacy vendor arrangement can replicate this in under 3 seconds with a full, timestamped, cryptographically sealed audit record attached.
Source List Disclaimer: The enforcement and sanctions source lists contained in this document are reproduced from InTouch's published source documentation (Enforcement Lists and Sanctions Sources, © 2026 InTouch International). These lists are subject to continuous update. The complete, current source list is available at portal.intouch.io. Accountable institutions remain responsible for ensuring their screening programme is adequate for their specific risk profile. This document does not constitute legal advice.
Demonstrate your FATF alignment today
InTouch gives your compliance team the tools, the audit trail, and the documented evidence to satisfy every applicable FATF Recommendation. Start your free trial or book a compliance-focused demo with our team.
No credit card required · Cancel anytime