Public Compliance Communications 5

PCC 12A - Guidance on outsourcing to third parties

currentaccepted1 September 2023

This PCC applies to the interpretation and application of the FIC Act requirements and does not apply to the interpretation of other regulatory requirements as issued by other regulatory or supervisory bodies. (page 4)

This public compliance communication cross-references 7 linked laws.

Open PDF Open on FIC website

Relationships in

Cross-references
Low confidence
PCC 12A - Guidance on outsourcing to third parties
"Refer to PCC 12A for further information on the use of a third party."
PCC 12A - Guidance on outsourcing to third partiespage 7recorded 10 August 2026
Cross-references
Low confidence
PCC 12A - Guidance on outsourcing to third parties
"Refer to PCC 12A, which sets out guidance on third-party service providers."
PCC 12A - Guidance on outsourcing to third partiespage 8recorded 10 August 2026

Relationships out

Cross-references
Low confidence
Guidance Note 7

Document

Page 1

FIC

Financial Intelligence Centre

PUBLIC COMPLIANCE COMMUNICATION

No. 12A (PCC 12A)

GUIDANCE ON OUTSOURCING OF COMPLIANCE ACTIVITIES TO THIRD-PARTY SERVICE PROVIDERS

24 March 2021

Page 2

Public Compliance Communication 12A Guidance on outsourcing of compliance activities to third-party service providers

Page 2 of 14

PCC SUMMARY

Accountable institutions remain responsible for their compliance obligations in terms of the Financial Intelligence Centre Act, 2001 (Act 38 of 2001) (FIC Act) regardless of their internal arrangements relating to the manner in which those obligations are met.

Outsourcing refers to when an accountable institution seeks the advice or assistance of a third-party service provider in relation to the performance of their compliance obligations. The third-party service provider cannot discharge any FIC Act obligations on an accountable institution's behalf, and as such, an accountable institution remains liable for compliance failures associated with and/or caused by such an outsourcing arrangement.

Linked legislation

Cross-references

Low confidence

Financial Intelligence Centre Act 38 of 2001 42

"The FIC Act does not prohibit outsourcing, and section 42(1) of the Act provides that:"
Financial Intelligence Centre Act 38 of 2001page 7recorded 10 August 2026

Cross-references

Low confidence

Financial Intelligence Centre Act 38 of 2001 26A

"Where a client is identified against a sanctions list as published in terms of section 26A of the FIC Act and/or section 25 of the POCDATARA Act, the third-party service provider must provide this information to the accountable institution for reporting purposes."
Financial Intelligence Centre Act 38 of 2001page 9recorded 10 August 2026

Cross-references

Low confidence

Financial Intelligence Centre Act 38 of 2001 28A

"The scrutinising of client information as required in section 28A of the FIC Act may be determined by the accountable institution (see Guidance Note 6A), and the FIC Act does not prohibit this function from being outsourced to a third-party service provider."
Financial Intelligence Centre Act 38 of 2001page 9recorded 10 August 2026

Cross-references

Low confidence

Financial Intelligence Centre Act 38 of 2001 43B

"8.1 Registration with the Centre is set out in section 43B of the FIC Act and MLTFC regulation 27A."
Financial Intelligence Centre Act 38 of 2001page 11recorded 10 August 2026

Cross-references

Low confidence

Financial Intelligence Centre Act 38 of 2001 29

"9.6 As such, section 29 of the FIC Act implicitly prohibits the outsourcing of the activity to report such transactions to the Centre."
Financial Intelligence Centre Act 38 of 2001page 13recorded 10 August 2026

Cross-references

Low confidence

Financial Intelligence Centre Act 38 of 2001

"# Reporting in terms of sections 27 and 32 of the FIC Act"
Financial Intelligence Centre Act 38 of 2001page 14recorded 10 August 2026

Cross-references

Low confidence

Money Laundering and Terrorist Financing Control Regulations, 2002

"9.1 Regulation 22(1) of the MLTFC Regulations requires a reporter to report in accordance with the format and method as developed by the Centre, that is made available to a person who is required to make such a report."
Money Laundering and Terrorist Financing Control Regulations, 2002page 12recorded 10 August 2026

4. OUTSOURCING OF THE ACTIVITIES RELATING TO CUSTOMER DUE DILIGENCE

4.1. The requirements as set out in Chapter 3, Part 1 of the FIC Act prevent accountable institutions from establishing a business relationship or concluding a single transaction with a client unless they have conducted CDD measures, which include but are not limited to establishing and verifying the identity of the client.

4.2. The main purpose or core function of conducting CDD, is for the accountable institution to know and understand who its clients are. Therefore, the accountable institution cannot outsource its CDD obligation, and the accountable institution will always remain responsible for conducting CDD.

4.3. However, an accountable institution may seek the assistance of a third-party service provider to assist with the CDD operational functions such as the collection and processing of documentation and/or information for CDD purposes. Irrespective of what CDD operational functions are outsourced, which may vary from collection to processing etc., the accountable institution must still conduct CDD, and comply with its obligations in terms of Chapter 3, Part 1 of the FIC Act.

4.4. Accountable institutions may not assume that their obligations have been adequately fulfilled where the third-party service provider has completed its CDD operational function. The accountable institution must have sufficient controls in place to ensure that its CDD obligations have been met.

4.5. The accountable institution must determine whether the CDD documentation and/or information collected and/or processed are acceptable in terms of the FIC Act requirements and the accountable institution's RMCP.

Public Compliance Communication 12A Guidance on outsourcing of compliance activities to third-party service providers

Page 8 of 14

9 OUTSOURCING OF REPORTING OBLIGATIONS

9.1 Regulation 22(1) of the MLTFC Regulations requires a reporter to report in accordance with the format and method as developed by the Centre, that is made available to a person who is required to make such a report. In this regard Directives 1, 2 and 4 sets out the prescribed reporting format and methodology.

9.2 Further, in terms of Directive 2, the login credentials may only be used by the person who has registered with the Centre on goAML (see further the discussion in paragraph 8).

9.3 Therefore, reporting done in terms of the FIC Act cannot be outsourced to a third-party service provider.

Public Compliance Communication 12A Guidance on outsourcing of compliance activities to third-party service providers

Page 12 of 14

PCC 12A - Guidance on outsourcing to third parties

Relationships in

Relationships out

Document

PUBLIC COMPLIANCE COMMUNICATION

PCC SUMMARY

Linked legislation

DISCLAIMER

COPYRIGHT NOTICE

OBJECTIVE

1. INTRODUCTION

2. OUTSOURCING OF FIC ACT COMPLIANCE OBLIGATIONS

Outsourcing arrangements

Outsourcing vs placing reliance

Group structures

3. OUTSOURCING OF RISK MANAGEMENT

4. OUTSOURCING OF THE ACTIVITIES RELATING TO CUSTOMER DUE DILIGENCE

Foreign prominent public officials (FPPO) and domestic prominent influential persons (DPIP)

5. SCRUTINISING OF CLIENT INFORMATION

6. OUTSOURCING OF RECORD-KEEPING REQUIREMENTS

7. OUTSOURCING OF COMPLIANCE GOVERNANCE

Compliance function

Compliance officer

8 OUTSOURCING OF REGISTRATION OBLIGATIONS

9 OUTSOURCING OF REPORTING OBLIGATIONS

Reporting of suspicious and unusual transactions in terms of section 29 of the FIC Act

Reporting in terms of sections 28 and 28A of the FIC Act

Reporting in terms of sections 27 and 32 of the FIC Act

11. SUPERVISION

12. COMMUNICATION WITH THE CENTRE