FIC Act Compliance
Covered by InTouch
A comprehensive guide to South Africa's Financial Intelligence Centre Act (FIC Act), its specific requirements for identity verification, KYC, AML, and bank account verification — and how InTouch's platform addresses every obligation for accountable institutions.
Contents
What is the FIC Act?
The Financial Intelligence Centre Act (Act 38 of 2001), commonly known as the FIC Act or FICA, is South Africa's primary legislative framework for combating money laundering, terrorist financing, and related financial crimes.
The Act establishes the Financial Intelligence Centre (FIC) — South Africa's financial intelligence unit — tasked with collecting, analysing, and disseminating financial intelligence to support law enforcement, regulatory bodies, and the South African Revenue Service. The FIC Act was enacted in 2003 and underwent major amendments in 2017 and again in December 2022, each time broadening the scope of obligations and tightening compliance standards to align with Financial Action Task Force (FATF) recommendations.
In February 2023, South Africa was placed on the FATF "greylist" due to deficiencies in its anti-money laundering measures. This has dramatically elevated the regulatory pressure on all accountable institutions to demonstrate airtight compliance — a burden that can only be effectively managed through reliable, automated systems.
Failure to comply with FIC Act obligations can result in administrative fines of up to R100 million, reputational damage, regulatory sanctions, and in serious cases, criminal prosecution and imprisonment.
Who Must Comply — Accountable Institutions
The FIC Act applies to a broad range of entities designated as "Accountable Institutions." Registration with the FIC is mandatory and must be completed via the goAML system within 90 days of commencing business.
Financial Services & Banking
Banks, credit unions, insurers, investment firms, payment service providers, cryptocurrency exchanges
Legal & Professional Services
Attorneys, advocates, accountants, auditors, and trust company practitioners
Property & Real Estate
Estate agents, property developers, and companies managing high-value property transactions
High-Value Goods Dealers
Auctioneers, dealers in precious metals/stones, and luxury goods merchants
Money Services & Forex
Forex dealers, money transfer operators, and remittance service providers
Other Regulated Entities
FSPs, financial advisors, loan providers, and any entity facilitating financial transactions
Core Obligations & Reporting Requirements
Every accountable institution must implement a comprehensive AML/CFT compliance programme covering registration, customer due diligence, risk management, transaction monitoring, reporting, internal governance, and record keeping.
Mandatory Reporting to the FIC (via goAML)
| Report Type | Trigger | Threshold |
|---|---|---|
| Cash Threshold Report (CTR) | Cash transaction received or paid | Above R49,999.99 — Must be filed within 3 days |
| Suspicious Transaction Report (STR) | Any suspicious or unusual activity | No threshold — all suspicious transactions |
| Terrorist Property Report (TPR) | Transaction involving a UN sanctions-listed party | Any value |
| International Funds Transfer Report (IFTR) | Cross-border electronic funds transfers | Above R19,999.99 |
| Cash Conveyance Report (CCR) | Cash physically crossing SA borders | Above prescribed threshold |
Internal Governance Requirements
Compliance Officer (MLRO)
Appoint a designated Money Laundering Reporting Officer responsible for overseeing compliance programme implementation and FIC reporting.
Internal Rules & Policies
Formulate documented procedures for client identification, verification, record management, and transaction monitoring.
Staff Training
Regular training for all relevant employees to recognise suspicious activity and understand their reporting obligations.
Record Keeping
Retain all KYC records, transaction records, and verification documentation for at least 5 years after the business relationship ends.
Identity Verification Requirements
Section 21 and Regulations 3–6 of the FIC Act set out explicit requirements for establishing and verifying the identity of both natural persons and legal entities before establishing a business relationship or concluding a transaction.
Natural Persons — What Must Be Collected & Verified
- ›Full name (first name, initials, and surname)
- ›Date of birth
- ›South African ID number (or passport number for foreign nationals)
- ›Residential address (established and verified)
- ›Contact information
- ›Photograph-bearing identity document
- ›POPIA-compliant consent before collection
- ✓SA Smart ID Card or green barcoded ID book
- ✓Verified against Department of Home Affairs (DHA/HANIS) database in real time
- ✓Passport accepted for foreign nationals (issued by country of citizenship)
- ✓Utility bill, bank statement, or lease agreement for address (≤3 months recommended)
- ✓Biometric liveness detection + facial match to ID document photo
- ✓Digital consent captured before verification commences
Legal Entities (Companies, CCs, Trusts, Partnerships)
| Entity Type | Key Documents Required | Related Parties to Verify |
|---|---|---|
| SA Company / CC | CIPC registration certificate, Memorandum of Incorporation, registered address | Directors, authorised signatories, UBOs (≥5% shareholders) |
| Trust (Inter Vivos) | Trust Deed, Letter of Authority from the Master of the High Court | Founder, trustees, beneficiaries (or class of beneficiaries) |
| Trust (Testamentary) | Will, Letter of Executorship | Executor, trustees, beneficiaries |
| Partnership | Partnership agreement | All partners (jointly and severally liable) |
| Foreign Company | Foreign registration documents, translated and certified | Directors, authorised persons, beneficial owners |
The FIC Act expressly permits remote (digital) identity verification as a valid alternative to in-person verification, provided the process includes document authentication via AI/OCR, real-time DHA database lookup, and biometric liveness verification. Simply receiving an uploaded ID image without running authenticity checks does not satisfy FICA requirements.
KYC — Know Your Customer
KYC under the FIC Act is not a one-time event — it is an ongoing, risk-calibrated process governed by Sections 21, 21A, 21B, and 21C. Institutions must identify, verify, risk-score, and continuously monitor every customer relationship.
The Six-Step KYC Process
Due Diligence Tiers
Simplified Due Diligence (SDD)
Applied for demonstrably low-risk customers where specific FICA exemptions apply. Reduced documentation requirements but not zero verification.
Standard CDD
Baseline requirement for all customers. Full identity verification, address confirmation, risk assessment, and beneficial ownership determination.
Enhanced Due Diligence (EDD)
Mandatory for high-risk customers including PEPs, FPEPs, PIPs, foreign nationals, shell companies, and those from high-risk jurisdictions. Includes source-of-funds documentation and enhanced monitoring.
AML — Anti-Money Laundering Requirements
The FIC Act implements the full FATF 40 Recommendations framework. AML obligations extend beyond onboarding to encompass an institution-wide risk-based approach, ongoing transaction monitoring, and multi-layered screening.
Risk-Based Approach
Institutions must conduct a Business Risk Assessment (BRA) at an organisational level, evaluating their inherent exposure to money laundering and terrorist financing risk across all products, services, customers, and geographies. This assessment must be documented, reviewed regularly, and used to calibrate the intensity of CDD controls applied at client level.
Screening Requirements
- ›UN Targeted Financial Sanctions Lists (mandatory)
- ›Domestic Politically Exposed Persons (DPEP)
- ›Foreign Politically Exposed Persons (FPEP)
- ›Prominent Influential Persons (PIP)
- ›OFAC / EU / HMT / other international sanctions lists
- ›Adverse media (global news sources)
- ›Crime and watchlists (Crimelist screening)
- ✓At onboarding — before establishing any business relationship
- ✓On an ongoing basis throughout the relationship
- ✓When processing transactions above prescribed thresholds
- ✓When a customer's circumstances materially change
- ✓When STR indicators are observed
- ✓Periodic refresh at intervals determined by risk rating
Transaction Monitoring
Institutions must monitor customer transactions on an ongoing basis to detect activity that is inconsistent with the customer's established profile, business type, or historical patterns. Suspicious activity must be reported to the FIC via an STR within a reasonable period of detection — there is no threshold for STR reporting.
Written AML Policies — Documented procedures approved at board/senior management level.
Designated MLRO — A compliance officer accountable for AML reporting and oversight.
Staff Training — Regular, documented training covering red flags, typologies, and reporting duties.
Independent Audit — Periodic internal or external testing of AML programme effectiveness.
Audit Trail — Every screening result, risk decision, and verification event must be logged with timestamps and accessible to regulators on demand.
Bank Account Verification
While the FIC Act does not contain a standalone "bank account verification" provision, bank account verification is a critical practical component of FICA compliance — linking a verified identity to actual financial activity.
Why Bank Account Verification Matters for FICA Compliance
Identity-to-Account Linkage
Confirming that the bank account presented belongs to the verified individual or entity prevents third-party and money mule account use — a primary AML red flag under the FIC Act.
Proof of Address Dual Purpose
Bank statements are explicitly accepted under FICA Regulations as a valid proof-of-address document and simultaneously evidence financial activity patterns relevant to ongoing monitoring.
Source of Funds (EDD)
For high-risk clients requiring Enhanced Due Diligence, bank account verification supports Source of Funds (SoF) and Source of Wealth (SoW) documentation requirements under the risk-based approach.
Fraud & Payment Risk Mitigation
Verifying account validity and ownership reduces payment fraud, prevents disbursements to unverified third parties, and protects both institution and client from financial loss.
What a Valid Bank Account Verification Must Confirm
How InTouch Covers Every Requirement
InTouch's compliance platform — accessible at portal.intouch.io — is purpose-built to help South African accountable institutions meet every dimension of their FIC Act obligations. From consent collection through to audit-trail export, every step is handled in a single, unified platform.
The InTouch Platform — Feature by Feature
InTouch is a RegTech platform offering 15+ verification automation types, sub-3-second average response times, and a fully audit-trailed environment designed around FICA, POPIA, and FATF standards.
1. Consent Service — POPIA-Compliant Collection
Before any verification can begin, the FIC Act (read alongside POPIA Section 11) requires informed, documented consent from the individual. InTouch's Consent Service resolves this entirely:
Consent Request Delivery
Send consent requests via any preferred channel. Customers review and approve on a branded, secure page.
Tamper-Proof Audit Log
Every response is logged with a timestamp and full audit history. Holds up under regulatory scrutiny and POPIA compliance review.
Custom Consent Flows
Build any authentication or consent workflow. Supports biometric authentication consent as required for digital KYC onboarding.
2. Identity Verification — DHA-Linked, Real-Time
InTouch's identity verification automation directly addresses FICA Regulations 3–6, verifying full name, date of birth, ID number, and address against government and trusted data sources in real time:
- ›Full name, date of birth, ID number
- ›Verified against ID document
- ›Residential address verified independently
- ›Document authenticity confirmed
- ›Biometric match to document
- ✓SA Smart ID, green ID book, or passport captured via device camera
- ✓AI-powered OCR extracts and validates document data
- ✓Real-time DHA/HANIS database lookup confirms authenticity
- ✓Biometric liveness detection + facial match prevents synthetic identity fraud
- ✓Address cross-referenced against trusted third-party data sources
3. KYC & Risk Rating — Automated, Weighted, Auditable
InTouch's Risk Rating engine operationalises the FIC Act's risk-based approach — scoring individuals and organisations across up to 10 weighted categories to determine the appropriate level of due diligence:
10-Category Risk Assessment
Customer type, AML/PEP screening results, interaction method, customer activities, source of wealth, geography, transaction size, and more — all weighted and automatically scored.
Risk Bands: Low to Ultra High
Clear risk thresholds map to SDD, standard CDD, or EDD treatment. High-risk clients are automatically flagged for human review before onboarding proceeds.
Ongoing Review Scheduling
Every risk rating includes a next-review date, ensuring Section 21C ongoing monitoring obligations are met and KYC information remains current.
Custom Risk Frameworks
Build risk rating models tailored to your institution's specific client base, products, and regulatory risk appetite. Every decision is fully auditable.
4. Full AML Screening — Sanctions, PEP, Watchlists & Adverse Media
InTouch delivers comprehensive AML screening covering every screening obligation under the FIC Act and FATF recommendations — for both individuals and organisations, in single or bulk mode:
- ›UN Targeted Financial Sanctions (mandatory)
- ›DPEP / FPEP / PIP identification
- ›International sanctions (OFAC, EU, HMT)
- ›Adverse media screening
- ›Crimelist / watchlist screening
- ›Ongoing monitoring throughout relationship
- ✓UN, OFAC, EU, HMT, and other global sanctions databases
- ✓PEP lists — domestic and international, updated continuously
- ✓Adverse media scan across billions of global news articles
- ✓Watchlist and crimelist cross-referencing
- ✓Single check in under 3 seconds
- ✓Bulk AML screening — thousands of records via single upload
5. Know Your Business (KYB) — CIPC & Beneficial Ownership
For legal entity clients, InTouch provides automated company and beneficial ownership verification aligned to Section 21B requirements:
CIPC Company Verification
Real-time company registration status, registered name, address, and directorship details from the Companies and Intellectual Property Commission.
Director & Signatory Verification
Individual identity verification (including DHA lookup and biometrics) for each director, authorised signatory, and related party of the entity.
6. Bank Account Verification — Instant, Automated
InTouch's bank account verification workflow directly addresses the FICA practical requirement of linking a verified identity to financial account ownership:
Account Validity & Ownership
Verify that the account exists, is active, and that the account holder's name matches the identity verified during KYC — closing the identity-to-account gap.
All Major SA Banks Supported
Checks are run against live banking infrastructure covering all major South African banks.
Source of Funds Support
Supports EDD source-of-funds documentation workflows for high-risk clients requiring enhanced account-level verification.
7. Audit Trail & Record Keeping — 5-Year Retention Ready
Every action in the InTouch platform is automatically logged with a complete, tamper-proof audit trail — satisfying the 5-year record retention obligations under FICA Sections 22–23 and providing the documentation required when regulators or auditors arrive.
Every verification run (identity, AML, address, bank account), consent requests and approvals, risk rating decisions with reasons and review dates, all screening results including hits and clear results, bulk automation run details and per-record outcomes, and export timestamps for compliance reporting. Every record is exportable as a PDF Verification Report.
8. Bulk Automations — Entire Client Books at Scale
For existing client books requiring retrospective FICA remediation, or for high-volume onboarding pipelines, InTouch's bulk automation capability processes thousands of records from a single spreadsheet upload. Download the template, fill in client data, upload, and the system processes every row against live data sources — with per-record status tracking (successful, partial, flagged) and full exportable results.
Complete FIC Act Compliance Mapping
The table below maps every key FIC Act obligation to the specific InTouch feature that addresses it — giving your compliance officer a clear overview of coverage.
| FIC Act Requirement | FICA Reference | InTouch Feature | Status |
|---|---|---|---|
| POPIA consent before verification | POPIA s.11 + FICA | Consent Service — digital consent with audit log | Covered |
| Identity verification (natural persons) | Regs 3–6 | ID Verification — DHA/HANIS real-time lookup | Covered |
| Document authenticity check | Guidance Note 3A | AI OCR + document authentication checks | Covered |
| Biometric liveness verification | FIC 2024 Guidance | Biometric face scan + liveness detection | Covered |
| Proof of address verification | Regs 3–6 | Address Validation automation | Covered |
| Risk profile assessment (risk-based approach) | s.21A | Risk Rating — 10-category weighted scoring | Covered |
| KYC / CDD for all customers | s.21 | KYC Verification automation | Covered |
| Enhanced Due Diligence (EDD) | s.21A | EDD flag + human review routing in Risk Rating | Covered |
| Beneficial ownership identification | s.21B | KYB — CIPC verification + UBO capture | Covered |
| Ongoing customer monitoring | s.21C | Periodic KYC refresh + review scheduling | Covered |
| UN Sanctions screening | s.28A (TPR) | AML Screening — UN, OFAC, EU, HMT lists | Covered |
| PEP / DPEP / FPEP / PIP identification | s.21A + Regs | PEP Check automation — domestic & international | Covered |
| Adverse media screening | Risk-based approach | Adverse Media Check — global news scan | Covered |
| Watchlist / crimelist screening | Risk-based approach | Sanctions Check + AML Screening automation | Covered |
| Bank account ownership verification | AML / fraud risk | Bank Account Verification automation | Covered |
| KYB — company/entity verification | Regs 7–12 | CIPC company lookup + director verification | Covered |
| 5-year record retention | s.22–23 | Automated audit trail + PDF export per record | Covered |
| Bulk client book screening / remediation | General obligation | Bulk Automations — spreadsheet upload, batch processing | Covered |
The obligation to register with the FIC via goAML, appoint a compliance officer (MLRO), submit regulatory reports (CTR, STR, IFTR, TPR), and conduct staff training are institutional governance obligations that fall outside the scope of a verification platform. InTouch covers all data verification, screening, and audit-trail requirements. Regulatory report submission to the FIC must be completed directly via the goAML portal.
The Business Case for InTouch
Speed — Under 3 Seconds
Verification results in under 3 seconds on average. No more waiting for manual responses, chasing results, or copying data between portals.
One Platform, Zero Fragmentation
AML, KYC, identity, address, bank account — all in a single environment. One login, one invoice, one audit trail. No more juggling multiple vendors.
Audit-Ready by Default
Every verification is automatically logged. When auditors arrive, there is no scrambling through spreadsheets or email threads — everything is exportable on demand.
Scales From 1 to 1,000,000
Single checks for individual onboarding, or bulk automations for entire client books. The same platform, the same compliance quality, at any scale.
POPIA Compliant by Design
Consent is collected, recorded, and timestamped before any personal information is processed. Built for South Africa's privacy law landscape from the ground up.
API-First Developer Integration
Full API access via the InTouch Developer Portal (developer.intouch.io) allows seamless integration into existing CRM, onboarding, and compliance systems.
This document is intended as an informational guide only and does not constitute legal advice. The FIC Act and related regulations are subject to ongoing amendment by the Financial Intelligence Centre and National Treasury. Accountable institutions should consult with a qualified compliance officer or legal advisor to ensure their full compliance programme meets the specific requirements applicable to their institution and risk profile. For the most current regulatory guidance, refer to fic.gov.za.
Ready to make FICA compliance effortless?
Join South African accountable institutions already running faster, cleaner, and more defensible verification with InTouch.
No credit card required · Cancel anytime