Public Compliance Communications 24: PCC 53 - Guidance on RMCPs

Linked legislation

Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 21E
"terminated and consider filing a suspicious transaction report (refer to section 21E of the FIC Act)."
Financial Intelligence Centre Act 38 of 2001page 12recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 26A
"The manner in which the accountable institution will scrutinise client information in order to identify persons listed on a TFS list as published on the Centre's website in terms of section 26A of the FIC Act."
Financial Intelligence Centre Act 38 of 2001page 13recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 21C
"The manual or automated processes in place for account, transaction or activity monitoring in terms of section 21C of the FIC Act, to determine whether the transactions or activity is consistent with the client's business and risk profile."
Financial Intelligence Centre Act 38 of 2001page 14recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 42A
"XYZ assigns Mr A (insert position title), in terms of section 42A of the FIC Act, to ensure the effectiveness of the compliance function and compliance with the accountable institution's RMCP."
Financial Intelligence Centre Act 38 of 2001page 23recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 20A
"(accountable institution must state the types of transactions less than R5 000 for the purposes of section 20A of the FIC Act)."
Financial Intelligence Centre Act 38 of 2001page 26recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 29
"The following client and transaction profile scenarios are examples of potential suspicious and unusual transactions in terms of section 29 of the FIC Act (list all potential red-flag examples e."
Financial Intelligence Centre Act 38 of 2001page 37recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 42
"Public compliance communication 53 guidance on the risk management and compliance programme in terms of Section 42 of the FIC Act Page 44 of 44"
Financial Intelligence Centre Act 38 of 2001page 44recorded 10 August 2026
Cross-references
Low confidence
Money Laundering and Terrorist Financing Control Regulations, 2002
"The third party's information is as follows _______________ (insert third party's full information, as required in regulation 20 of the Money Laundering and Terrorist Financing Control regulations) Note, the accountable institution must advise the Centre in writing on a formal letterhead the information as per regulation 20."
Money Laundering and Terrorist Financing Control Regulations, 2002page 39recorded 10 August 2026

Public compliance communication 53 guidance on the risk management and compliance programme in terms of Section 42 of the FIC Act

Page 2 of 44

PCC SUMMARY

This public compliance communication 53 (PCC 53) provides guidance to accountable institutions that are designated non-financial businesses and professions (DNFBPs), on the drafting of a risk management and compliance programme (RMCP) document describing the RMCP, in line with section 42 of the Financial Intelligence Centre Act, 2001 (Act 38 of 2001) (FIC Act).

PCC 53 is limited to assisting DNFBP accountable institutions better understand how to approach money laundering, terrorist financing, and proliferation financing (ML/TF/PF) risk assessment, identification, mitigation, management and monitoring within their businesses.

This PCC 53 is intended for DNFBP accountable institutions. PCC 53 is not intended for financial institutions, DNFBPs that fall within group structures, and DNFBPs that have advanced compliance or complex structures.

THE AUTHORITATIVE NATURE OF GUIDANCE

The Financial Intelligence Centre (Centre) provides the guidance contained in this PCC in terms of its statutory function in terms of section 4(c) of the FIC Act read together with Regulation 28 of the Money Laundering and Terrorist Financing Control Regulations (Regulations) issued in terms of the FIC Act.

Section 4 (c) of the FIC Act empowers the Centre to provide guidance in relation to a number of matters concerning compliance with the obligations in terms of the FIC Act. Guidance provided by the Centre is the only form of guidance formally recognised in terms of the FIC Act and the Regulations issued in terms of the FIC Act. Accordingly, guidance provided by the Centre is authoritative in nature and must be considered when interpreting the provisions of the FIC Act or assessing compliance of an accountable or reporting institution with the obligations imposed on it by the FIC Act.

It is important to note that enforcement action may emanate as a result of non-compliance with the FIC Act in areas where there has been non-compliance with the guidance provided

Page 4

1. Introduction

1.1. Accountable institutions must develop, document, maintain and implement a risk management and compliance programme (RMCP) for anti-money laundering, and combating the financing of terrorism (AML/CTF). The RMCP must provide for all the requirements as set out in section 42 of the FIC Act. In addition, the Centre strongly encourages accountable institutions to identify, assess, monitor, mitigate and manage the risk of proliferation financing (PF), and include counter proliferation financing risk (CPF) mitigation measures in the RMCP.

1.2. The Centre recommends that accountable institutions that are designated non-financial businesses and professions (DNFBPs) describe their RMCP in a consolidated document, which is referred to as the RMCP document.

1.3. A DNFBP accountable institution must express and include the money laundering, and terrorist financing (ML/TF) risks, and its understanding flowing from the risk assessments, and the risk mitigation, monitoring as well as the management measures in the RMCP document.

1.4. A DNFBP accountable institution should note that in response to a request for documentation in terms of section 42(4) of the FIC Act, the accountable institution should provide the RMCP document. Failure to produce an RMCP document to the supervisory body or the Centre would amount to non-compliance.

1.5. A DNFBP accountable institution must make its RMCP document available to each of its employees.

1.6. PCC 53 is intended for DNFBP accountable institutions (such as trust service providers) that do not form part of group structures and do not have advanced compliance or complex structures. This PCC 53 is not intended for financial institutions and larger accountable institutions that have advanced compliance or complex structures, including DNFBP accountable institutions within those structures.

Public compliance communication 53 guidance on the risk management and compliance programme in terms of Section 42 of the FIC Act

Page 4 of 44

Page 23

1.2.1. Mr A with the following role and responsibilities __________ (e.g. head of compliance function, drafting of RMCP and approval of all high-risk clients).

1.2.2. Mrs B with the following role and responsibilities __________ (e.g. acts as the money laundering reporting officer (MLRO) and reports to the Centre on goAML)

1.2.3. Ms C with the following role and responsibilities __________ (e.g. the CDD consultant who will collect all FIC Act related documentation and information and will update on the client profile. Will report all suspicions to Mr A)

1.3. All staff at XYZ will be required to comply with this RMCP and report all suspicious behaviour to Mr A.

1.4. XYZ assigns Mr A (insert position title), in terms of section 42A of the FIC Act, to ensure the effectiveness of the compliance function and compliance with the accountable institution's RMCP.

1.5. Mr A holds the following qualifications and experience __________ (insert qualifications and experience. Demonstrate sufficient competence and seniority)

RMCP approval

1.6. The RMCP has been approved by:

a. Mr Y (insert position title) date and signature; and

b. Mr Z (insert position title) date and signature.

RMCP review

1.7. The RMCP will be reviewed and updated:

1.7.1. At regular intervals at minimum (e.g. annually).

1.7.2. Where there is a material change to any process, within X months of this change being made (__________ other examples: on a regular basis, insert interval, e.g., annually, every six months etc.)

1.7.3. Where there is a legislative change to relevant legislation, within X (__________ insert period e.g., months/days/weeks etc) of this change being made.

Applicability

1.8. The RMCP applies to all employees and branches including foreign subsidiaries (indicate various branches where applicable) of XYZ and is made available via the following distribution channels: (insert channels, e-mail, intranet, physical delivery etc.) to the employees and various branches of the accountable institution.

Public compliance communication 53 guidance on the risk management and compliance programme in terms of Section 42 of the FIC Act

Page 23 of 44

Page 24

Public compliance communication 53 guidance on the risk management and compliance programme in terms of Section 42 of the FIC Act

Page 24 of 44

Branch application (applicable where accountable institution has branches)

1.9. The RMCP will be implemented in the following manner in the branches, subsidiaries, and other operations of the accountable institution _______.

1.10. (If there are no branches to record) XYZ does not have any branches and therefore section 42(2)(q) is not applicable.

1.11. (Where applicable) The requirements as set out in the FIC Act is implementable in a foreign branch or subsidiary

1.12. The following requirements in terms of section 42 of the FIC Act _______ are not applicable in the foreign branch due to the following reasons _______ (insert reasons).

Training

1.13. The following anti-money laundering, counter terrorist financing and counter proliferation financing (AML/CTF/CPF) training will be provided to all employees of XYZ:

1.13.1. (Insert various levels of training, e.g. starter training, intermediate, advanced)

1.13.2. At the following intervals (state the intervals, e.g. on induction of new employees, annually or every six months etc. for all employees) on an ongoing basis.

1.13.3. Training will be facilitated by (insert employee role) and employees will be subject to an assessment after the training.

1.13.4. Evidence of training will be retained in the following manner _______. (training registers must be held, as well as presentations, and confirmation of attendance at FIC events etc.)

Escalation of non-compliance with RMCP or FIC Act

1.14. All instance of non-compliance with XYZ's RMCP or the FIC Act must be escalated to the _______ (insert person/s i.e. directors, senior management/other persons exercising the highest level of authority) immediately upon becoming aware thereof.

1.15. The following escalation of non-compliance process must be followed _______ (insert process e.g. completion of a breach form, submission to compliance officer via e-mail etc.)

Page 26

relationship with the XYZ regardless of the amount of the transaction. XYZ must conduct customer due diligence on the client (refer to Guidance Note 7).

2.7. The following activities are considered to be single transactions less than R5 000.:

(accountable institution must state the types of transactions less than R5 000 for the purposes of section 20A of the FIC Act). XYZ must obtain and record information for the client (refer to Guidance Note 7).

2.8. The following activities are considered to be single transactions above the R5 000:

(accountable institution must state what is considered to be a single transaction of more than R5 000). XYZ must conduct customer due diligence on the client (refer to Guidance Note 7).

2.9. XYZ determines the overall ML/TF/PF risk weightings/ratings a business relationship poses in the following manner

(indicate method used e.g. manually or through an automated tool etc. indicate tool used if applicable e.g. excel risk matrix etc.)

2.10. The outcome of the risk assessment impacts the level of the customer due diligence conducted, including what information and documentation is required for verification. Where the ML/TF/PF risk is:

2.10.1. Low – simplified due diligence must be conducted

2.10.2. Medium – standard customer due diligence must be conducted

2.10.3. High – enhanced due diligence must be conducted.

2.11. XYZ will not establish a business relationship with or conduct a single transaction in instances where

(insert various instances e.g. insert where the client is linked to a listed terrorist, the client has numerous money laundering convictions/charges pending etc.) as XYZ has determined the ML/TF/PF risk is not acceptable in such instances. XYZ has taken this decision due to the following considerations at minimum

(insert rationale)

2.12. The following instances require approval to be obtained from senior management in conjunction with the compliance officer before accepting a client and establishing a business relationship or concluding a single transaction where

Public compliance communication 53 guidance on the risk management and compliance programme in terms of Section 42 of the FIC Act

Page 26 of 44

Page 28

3.2. The following process must be followed to ensure that no anonymous clients, or clients acting under an apparent false or fictitious name may be on-boarded. (insert process e.g. check whether CDD is completed, where CDD is not required this would only apply for once-off transactions less than R5 000. Check that required information is obtained and recorded).

3.3. When dealing with a client who is conducting a single transaction for an amount less than R5 000 the following information must be obtained and recorded at a minimum: including (insert information required) (refer to Guidance Note 7).

3.4. XYZ establishes business relationships or conducts single transactions with the following types of clients (list different client types e.g. South African natural person, non-resident foreign national natural person, foreign national residing temporarily in South Africa, public and private companies, national government departments, partnerships, trusts etc.).

3.5. XYZ will not perform a business relationship, or enter into a single transaction with the following types of persons (list different client types, or specify that there are no such exclusions)

3.6. When establishing a business relationship, the following information must be obtained: (list information e.g. nature of business relationship, intended purposes of the business relationship and the source of funds for which the prospective client expects to use in concluding transactions).

3.7. Simplified due diligence (SDD) may be conducted for all low-risk single transactions or business relationships.

3.7.1. When conducting a business relationship (insert list of SDD information and documents/electronic records) must be obtained from the client.

3.7.2. When conducting a single transaction (insert list of SDD information and documents/electronic records) must be obtained from the client.

3.8. Standard customer due diligence may be conducted for all medium-risk single transactions or business relationships.

Public compliance communication 53 guidance on the risk management and compliance programme in terms of Section 42 of the FIC Act

Page 28 of 44

Page 30

3.12. When establishing a business relationship, information on the source of funds, the nature of the client's business, and the intended purposes of the business relationship must be obtained in the following manner: (insert process e.g. application form must request the information). This information is required regardless of the risk rating. This information must be used by XYZ to determine whether future transactions that will be performed during the business relationship are consistent with the institution's knowledge of the client.

3.13. When establishing a business relationship or conducting a single transaction for clients that are legal persons, trusts and/or partnerships additional due diligence (ADD) must be conducted. Additional due diligence includes establishing the nature of the client's business, establishing the ownership and control structure and identifying the beneficial owner of the client. The additional due diligence process for:

3.13.1. Legal persons include (state all steps, including name and number of legal person and identifying and verifying the beneficial owner/s) (refer to the process of elimination in FIC Guidance Note 7).

3.13.2. Trusts include (state all steps, including name and number of legal person and establishing the identity of the trustees, founder, beneficiaries, determining the Master's Office, and obtaining the trust number)

3.13.3. Partnerships include (state all steps, including obtaining name and number of partnership and establishing the identity of each partner).

3.14. Ongoing due diligence is conducted in respect of business relationships at the following intervals (insert intervals e.g. annually for high-risk client, every two years for medium risk client and every three years on low-risk clients etc.). The intervals at which ODD is conducted is dependent on the risk profile of the client.

3.15. In addition, ODD must be conducted when the following scenarios occur

Public compliance communication 53 guidance on the risk management and compliance programme in terms of Section 42 of the FIC Act

Page 30 of 44

Page 31

Public compliance communication 53 guidance on the risk management and compliance programme in terms of Section 42 of the FIC Act

Page 31 of 44

(insert scenarios e.g. during account monitoring a change in client transaction pattern was detected, the accountable institution filed numerous section 29 reports in relation to the client etc.).

3.16. As part of ODD, the accountable institution must request the following information and documentation/electronic records from the client (insert all information and documentation, this may be the exact same as referred to in paragraph 3.10 above).

3.17. The following process must be followed when conducting ODD (insert the process e.g. XYZ staff request latest information and document via e-mail and a courier is sent to collect the required information and documentation etc.)

3.18. (This is a recommendation and not mandatory) Approval must be sought from the senior management before establishing high-risk business relationships in the following manner (insert the process e.g. e-mail all information and documents to senior manager, who then must either approve/decline. Proof of decision to be maintained on client file).

3.19. (This is a recommendation and not mandatory) The source of wealth information (insert list of different types of sources of wealth) must be obtained from a client where it is determined the business relationship is high-risk from an ML/TF/PF perspective.

3.20. XYZ must terminate a business relationship and must not conduct a single transaction where it is unable to conduct CDD, EDD, ADD or ODD. XYZ must consider filing a section 29 report. This must be noted through (insert applicable process e.g. reporting of non-compliance with all supporting material to be sent to the compliance officer within 2 days)

3.20.1. The process to terminate a business relationship is as follows (insert process e.g. escalation of information to senior management, letter sent to client informing client the business relationship will be terminated if the client does not provide document etc.). The reason for terminating a business relationship must be recorded.

Page 32

3.21. Where there are doubts regarding the veracity of previously obtained information, the process of CDD, EDD, ADD and ODD where relevant must be repeated. Where something suspicion or unusual becomes apparent while conducting CDD, EDD, ADD and ODD, the employee must file a report to the compliance officer.

3.22. Where the XYZ is unable to conduct CDD, it will not establish a business relationship with and or conduct a single transaction for a client. The following process will be followed in these instances (insert investigation process, termination process).

Prominent influential persons

(This part applies to business relationships)

4.1. The process of determining whether a person is a DPIP, FPPO, immediate family member or known close associate will be done in the following manner (insert manner e.g. declaration sought, manually search for information online or automated where the client details is captured in a system of the relevant FPPO and DPIP source lists).

4.2. Upon establishing a business relationship the following client information (insert client information e.g. client name, surname, beneficial owner name, person acting on behalf of client's name etc.) must be scrutinised against the following FPPO and domestic prominent influential persons (DPIP) source lists (insert source lists relied upon) in order to determine whether the individual is either a DPIP, FPPO, immediate family member or known close associate.

4.3. The client information must be scrutinised against the FPPO and DPIP source lists at client on-boarding and thereafter at intervals. These intervals are (insert interval, daily, monthly, every six months etc.) (The interval must be proportionate to the ML/TF risk.)

4.4. Alternatively, XYZ must obtain a declaration from the client indicating whether the client, person acting on behalf of the client or beneficial owner, is a DPIP, FPPO, immediate family member or known close associate. XYZ must record this information on the client file (e.g. the application form should list the various types

Public compliance communication 53 guidance on the risk management and compliance programme in terms of Section 42 of the FIC Act

Page 32 of 44

Page 33

of DPIPs and FPPOs and require the client to declare their position. Where the client does hold a position of either a DPIP, FPPO, immediate family member or known close associate then senior management approval must be obtained for on boarding etc.)

4.5. XYZ must take reasonable measures to obtain the source of wealth information of an FPPO, high-risk DPIP, their immediate family member or known close associate in the following manner

(insert the reasonable measures e.g. request information through the application form, and request verification documents for the information provided etc.)

4.6. XYZ must conduct enhanced ongoing monitoring of the business relationship with the FPPO, high-risk DPIP, their immediate family member or known close associate in the following manner

(insert manner e.g. conduct client reviews of account activity on a quarterly basis or at the end of every month etc.)

4.7. Senior management approval must be obtained before establishing a business relationship with an FPPO, high-risk DPIP, immediate family member or known close associate in the following manner

(set out the process e.g. escalation of all CDD, section 21F, 21G and 21H of the FIC Act information via e-mail to senior management with request to approve/decline the establishment of the business relationship, recording of the e-mail response from the senior management etc.)

Targeted financial sanctions aimed at terrorist financing

5.1. The following client information (insert client information, including client name, surname, identity number, registration number, beneficial owner name, person acting on behalf of client name, payment information etc.) must be scrutinised (screened) against the UN 1267 sanctions list (as published on the UNSC website) in order to identify sanctioned persons (refer to public compliance communication 44).

5.2. The scrutinising will be done in the following manner (insert method e.g. either using an automated screening system or manually capturing client information in the search tools of the UN 1267 sanctions list).

Public compliance communication 53 guidance on the risk management and compliance programme in terms of Section 42 of the FIC Act

Page 33 of 44

Page 34

5.3. The client information must be scrutinised against the TFS lists and the UN 1267 sanctions list before conducting a single transaction or entering a business relationship, and thereafter at intervals as and when lists are updated or according to the accountable institution's risk-based approach. Intervals include __________ (insert interval e.g. daily, monthly, every six months etc.). The interval must be proportionate to the ML/TF/PF risk.

5.4. The client information must also be scrutinised where updates are made to the TFS lists and UN 1267 sanctions list.

5.5. Where a possible match is found, the client information must be further analysed and compared to determine whether there is a true match (i.e. client is a sanctioned persons) or a false positive (i.e. client has the same name as a sanctioned person but is not the same person). The process for analysing and comparing is __________ (insert process e.g. XYZ employee will compare the client information against all the sanctioned persons information and determine whether it matches. Where required XYZ will conduct further searches via search engines to source information to determine whether there is a match or not etc.)

5.6. In an instance where it is a false positive, the reason therefore must be documented, and the on-boarding may continue. This finding, and all information regarding the investigation and decision made that this is a false positive must be kept in the following manner: __________ (insert process e.g. all material to be saved on the client file and signed off by compliance officer)

5.7. In an instance where a true positive is found, the reason therefore must be documented and XYZ may not establish a business relationship or conduct a single once-off transaction. This finding, and all information regarding the investigation and decision made that this is a positive match must be kept in the following manner: __________ (insert process e.g. all material to be saved on the client file and signed off by compliance officer)

5.8. XYZ must record evidence that client information has been scrutinised against both lists in the following manner __________

Public compliance communication 53 guidance on the risk management and compliance programme in terms of Section 42 of the FIC Act

Page 34 of 44

Page 35

(insert manner e.g. after screening a client's name against the TFS search tool on the Centre's website, the employee will take a screen shot of the results and save the same on the client file etc.)

Targeted financial sanctions aimed at proliferation financing

6.1. The following client information (insert client information, including client name, surname, identity number, registration number, beneficial owner name, person acting on behalf of client name, payment information etc.) must be scrutinised (screened) against the UN 1267 sanctions list (as published on the UNSC website) and the targeted financial sanctions lists (TFS list as published on the Centre's website) in order to identify sanctioned persons (refer to public compliance communication 44). XYZ must screen against both lists, as the lists are different.

6.2. The scrutinising will be done in the following manner (insert method e.g. either using an automated screening system or manually capturing client information in the search tools of the TFS list and UN 1267 sanctions list).

6.3. The client information must be scrutinised against the TFS lists and the UN 1267 sanctions list before conducting a single transaction or entering a business relationship, and thereafter at intervals as and when lists are updated or according to the accountable institution's risk-based approach. Intervals include (insert interval e.g. daily, monthly, every six months etc.). The interval must be proportionate to the ML/TF/PF risk.

6.4. The client information must also be scrutinised where updates are made to the TFS lists and UN 1267 sanctions list.

6.5. Where a possible match is found, the client information must be further analysed and compared to determine whether there is a true match (i.e. client is a sanctioned person) or a false positive (i.e. client has the same name as a sanctioned person but is not the same person). The process for analysing and comparing is (insert process e.g. XYZ employee will compare the client information against all the sanctioned persons information and determine whether it matches. Where

Public compliance communication 53 guidance on the risk management and compliance programme in terms of Section 42 of the FIC Act

Page 35 of 44

Page 36

required XYZ will conduct further searches via search engines to source information to determine whether there is a match or not etc.)

6.6. In an instance where it is a false positive, the reason therefore must be documented, and the on-boarding may continue. This finding, and all information regarding the investigation and decision made that this is a false positive must be kept in the following manner:

(insert process e.g. all material to be saved on the client file and signed off by compliance officer)

6.7. In an instance where a true positive is found, the reason therefore must be documented and XYZ may not establish a business relationship or conduct a single once-off transaction. This finding, and all information regarding the investigation and decision made that this is a positive match must be kept in the following manner:

(insert process e.g. all material to be saved on the client file and signed off by compliance officer)

6.8. XYZ must record evidence that client information has been scrutinised against both lists in the following manner

(insert manner e.g. after screening a client's name against the TFS search tool on the Centre's website, the employee will take a screen shot of the results and save the same on the client file etc.)

Account monitoring

7.1. All clients and prospective clients must be profiled according to the following factors

(insert factors according to client type e.g. client income, sector, occupation, products, types, payment methods including cash and EFTs, transaction history where applicable etc.). Client profiling is required to determine/analyse whether future transactions are consistent with XYZs knowledge of a client. Client profiling aids in the identification of potentially suspicious and unusual transactions or activity.

7.2. XYZ will monitor all account activity and transactions for all business relationships in the following manner

Public compliance communication 53 guidance on the risk management and compliance programme in terms of Section 42 of the FIC Act

Page 36 of 44

Page 37

(either manually by reviewing statements daily/as and when transactions occur or automatically through an automated transaction monitoring system) to identify possible reportable transactions (refer to Directive 5 and PCC 45).

Reporting

8.1. The following process must be followed to identify reportable transactions (insert process e.g. check statement every day to determine, whether cash transactions above the threshold have been paid or received and whether any suspicious and unusual transactions have taken place etc.)

8.2. Where reportable transactions are identified, the following process must be applied (insert process e.g. communicate all the relevant information immediately to the compliance officer and money laundering reporting officers in the prescribed manner, who will then analyse and determine whether it is reportable. State the end-to-end internal process to analyse and report transactions to the Centre, in terms of sections 28, section 28A, and section 29) (The process must adhere to the reporting periods, refer to Guidance Notes 5B, 4B and 6A).

8.3. Reports made in terms of the FIC Act are confidential.

8.4. The following client and transaction profile scenarios are examples of potential suspicious and unusual transactions in terms of section 29 of the FIC Act (list all potential red-flag examples e.g. payment of large purchase price in cash, numerous round cash deposits which do not match the client's stated source of income, numerous large electronic transfers made by a third party which does not match the clients stated source of income). Where these scenarios occur XYZ must conduct further analyses in order to determine whether the transactions/activity is suspicious or unusual or other reportable transactions/activity.

8.5. A terrorist property report in terms of section 28A, must be filed where the accountable institution is in possession or control of property of:

8.5.1. Any entity which has committed or attempted to commit an offence as defined in POCDATARA Act

Public compliance communication 53 guidance on the risk management and compliance programme in terms of Section 42 of the FIC Act

Page 37 of 44

Page 38

8.5.2. A specific entity identified in a UN 1267 sanctions list

8.5.3. A person or entity identified in a TFS list as published on the Centre's website

8.6. XYZ will examine complex and unusually large transactions and unusual patterns of transactions which have no apparent business or lawful purpose, in the following manner (insert manner e.g. review applications, statements, credit reports, annual financial statements etc.) by the following persons (e.g. the compliance officer) at which interval (e.g. before concluding a transaction as and when the transaction occurs) in order to identify as possible reportable transactions.

8.7. XYZ must keep written findings of decisions taken on whether to report or not to report.

8.8. Section 27 requests for information in terms of the FIC Act, will be handled as follows

(insert process, section 42A compliance officer should check the goAML inbox on a daily basis and respond to requests for information on time.)

8.9. Section 32 requests for additional information in terms of the FIC Act, will be handled as follows

(insert process e.g. section 42A compliance officer should check the goAML inbox on a daily basis and respond to requests for information on time.) In all instance the CO must be made aware of section 32 requests for additional information immediately upon receipt thereof.

8.10. Section 34 requests for intervention in terms of the FIC Act, will be handled as follows

(insert process e.g. section 42A compliance officer should check the goAML inbox on a daily basis and where a section 34 written directive is received, the CO must ensure all impacted transactions are identified and frozen for the period as stated in the direction.)

8.11. All reporting information is confidential, XYZ must under no circumstances disclose the contents of a report or the fact that a report has been considered or filed to any other persons. Disclosure of this information is regarded as tipping off, which is an offence.

Public compliance communication 53 guidance on the risk management and compliance programme in terms of Section 42 of the FIC Act

Page 38 of 44

Page 41

- Is the usage of the product subject to additional scrutiny from a market abuse or a consumer protection perspective?

- What is the time frame for the conversion of funds, property etc. through the usage of the product?

- Is the product an industry-regulated product?

- Does the product allow for the flow of physical cash?

- Are there specific conditions that must be met or events that must take place for clients to have access to funds, property etc.?

- Does the usage of the product entail structured transactions such as periodic payments at fixed intervals or does it facilitate an unstructured flow of funds?

- What is the transaction volume facilitated by the product?

- Does the product have a "cooling off" period which allows for a contract to be cancelled without much formality and a refund of moneys paid?

- Are the products offered over short- or longer-term contractual relationships?

- Do products require a payment from a same-name account or facility to facilitate the opening of a product?

Indicators relating to delivery channels

- Is the product offered to prospective clients directly or through intermediaries?

- Are prospective clients on boarded through direct interaction or through intermediaries?

- Do clients transact by engaging with the institution directly or through intermediaries?

- Where clients interact through intermediaries, are the intermediaries subject to licencing and/or other regulatory requirements?

- Are products and services acquired or transactions performed via an exchange?

- Are products and services traded in secondary markets?

- To what extent does the usage of the product require the participation of the institution or the application of the institution's systems and transaction platforms?

- What are the payment systems or other technological platforms that support the functioning of the product?

- Are prospective clients on-boarded through non-face-to-face processes and/or do they use the institution's products and services through non-face-to-face transactions?

Public compliance communication 53 guidance on the risk management and compliance programme in terms of Section 42 of the FIC Act

Page 41 of 44

Page 42

Public compliance communication 53 guidance on the risk management and compliance programme in terms of Section 42 of the FIC Act

Page 42 of 44

Indicators relating to geographic locations

- Is the client domiciled in South Africa or in another country or does the client operate in another country?

- Do clients who are domiciled or operate outside South Africa engage with the institution in South Africa or through branches, subsidiaries or intermediaries outside South Africa?

- Have credible sources identified geographic locations from where clients engage with an institution as high-risk jurisdictions?

- Are the geographic locations from where clients engage with an institution subject to sanctions regimes?

- If the client is a corporate vehicle, has it been incorporated in a country which has been identified by credible sources as a high-risk jurisdiction or in a country which is the subject of a sanctions regime, or does it operate in such a country?

- Has an international body, a domestic regulator, supervisory body or other credible source expressed concern about weak regulatory measures against money laundering and terrorist financing, weak transparency requirements for beneficial ownership of corporate structures or weak institutional frameworks such as supervisory, law enforcement and prosecuting agencies in relation to a geographic location from where clients engage with an institution?

- Are the geographic locations from where clients engage with an institution known to applying excessive client confidentiality?

Indicators relating to clients

- Is the client a natural person or corporate vehicle?

- If the client is a corporate vehicle, is it part of a complex or multi-layered structure of ownership or control?

- What information does the client provide concerning their source(s) of income?

- What is the nature of the client's business activity e.g. does the activity involve transacting in large amounts of cash, cross-border movements of funds, trading in sensitive, controlled or sanctioned commodities, etc?

- What is the nature of the type of the products and services offered by the client?

PCC 53 - Guidance on RMCPs

Relationships in

Relationships out

Used in the current RMCP catalogue

Document