Guidance Notes 8: Draft Guidance Note 7B - Implementation of various aspects of the FIC Act

Linked legislation

Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 20A
"The manner in which the accountable institutions comply with section 20A of the FIC Act in respect of business relationships and single transactions, both below and above the threshold, must be recorded in the institution's RMCP."
Financial Intelligence Centre Act 38 of 2001page 33recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 21
"Section 21 of the FIC Act (the requirement to establish and verify a client's identity) also applies to clients who are not natural persons acting in their personal capacity."
Financial Intelligence Centre Act 38 of 2001page 38recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 21B
"Accountable institutions are required to take reasonable steps to verify the names of the natural persons covered by section 21B(4) of the FIC Act."
Financial Intelligence Centre Act 38 of 2001page 45recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 21A
"Accountable institutions are not required to verify the veracity of the information obtained under section 21A of the FIC Act."
Financial Intelligence Centre Act 38 of 2001page 48recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 21C
"Section 21C of the FIC Act provides for ongoing due diligence measures."
Financial Intelligence Centre Act 38 of 2001page 48recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 21E
"Section 21E of the FIC Act prohibits accountable institutions from entering into or maintaining business relationships or concluding single transactions if they cannot perform the required CDD in accordance with the provisions of the Act."
Financial Intelligence Centre Act 38 of 2001page 49recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 21H
"Section 21H of the FIC Act provides that the measures for politically exposed persons and prominent influential persons also apply to their immediate family members and known close associates."
Financial Intelligence Centre Act 38 of 2001page 54recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001
"This means that accountable institutions must keep record of all information pertaining to a client obtained in the course of its processes to comply with sections 21 to 21H of the FIC Act."
Financial Intelligence Centre Act 38 of 2001page 58recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 22A
"Accountable institutions must keep transaction records of single transactions and transactions concluded in the course of the business relationship with the client in terms of section 22A of the FIC Act."
Financial Intelligence Centre Act 38 of 2001page 58recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 22
"Records in relation to establishment of a business relationship referred to in section 22 of the FIC Act must be kept for at least five years from the date on which the business relationship is terminated."
Financial Intelligence Centre Act 38 of 2001page 60recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 29
"Records of a transaction or activity which gave rise to a report contemplated in section 29 of the FIC Act must be kept for at least five years from the date on which the report was submitted to the Centre."
Financial Intelligence Centre Act 38 of 2001page 60recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 42A
"A board of directors, senior management or person(s) with the highest authority who demonstrates an underdeveloped understanding of the accountable institution's RMCP will be unable to discharge their obligation in terms of section 42A(1) of the FIC Act."
Financial Intelligence Centre Act 38 of 2001page 64recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 61
"The board of directors, senior management or other person or group of person(s) with the highest authority may be sanctioned in terms of section 61 of the FIC Act."
Financial Intelligence Centre Act 38 of 2001page 65recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 42
"When conducting an inspection, the supervisory body may inspect whether the board of directors, senior management or person(s) with the highest authority approved the RMCP, in terms of section 42(2B) of the FIC Act."
Financial Intelligence Centre Act 38 of 2001page 72recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 49A
"Accountable institutions should be mindful of the fact that failure to comply with TFS obligations is a criminal offence under section 49A of the FIC Act."
Financial Intelligence Centre Act 38 of 2001page 75recorded 10 August 2026
Cross-references
Low confidence
Money Laundering and Terrorist Financing Control Regulations, 2002
"As indicated in Chapter 1 above, large parts of the MLTFC Regulations, (in particular Chapter 1 of the Regulations which described the methods which accountable institutions had to use to establish and verify their clients' identities) have been repealed."
Money Laundering and Terrorist Financing Control Regulations, 2002page 34recorded 10 August 2026

PREFACE

i) The Financial Intelligence Centre (Centre) in collaboration with the National Treasury, South African Reserve Bank and the Financial Sector Conduct Authority (formerly known as Financial Services Board) has published guidance that will be required to support the implementation of the Financial Intelligence Centre Act, 2001 (Act 38 of 2001) (FIC Act).

ii) The FIC Act established the Centre which is the national point for the gathering, analysis and dissemination of financial intelligence. The Centre was established to identify proceeds of crime and assist in combating money laundering, the financing of terrorism and proliferation financing and in so doing has a primary role to protect the integrity of South Africa's financial system. The Centre develops and provides financial intelligence to a range of agencies supporting the investigation and prosecution of criminal activity by helping to identify the proceeds of crime, combat money laundering and the financing of terrorism. The FIC Act is a key component of the regulatory architecture that protects the integrity of the South African financial system and (together with legislation such as the Prevention of Organised Crime Act, 1998 (Act 121 of 1998) and the Prevention of Constitutional Democracy against Terrorism and Related Activities Act, 2004 (Act 32 of 2004) of the legal framework that supports the administration of the criminal justice system.

iii) This guidance is issued in terms of section 4(c) of the FIC Act read with regulation 28 of the Money Laundering and Terrorist Financing Control (MLTFC) Regulations which empowers the Centre to provide guidance in relation to a number of matters concerning compliance with the obligations of the Act. Guidance provided by the Centre is the only form of guidance formally recognised in terms of the FIC Act and the MLTFC Regulations issued under the FIC Act. Guidance issued by the Centre is authoritative in nature which means that accountable institutions must take the guidance issued by the Centre into account in respect of their compliance

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 2 of 78

Page 8

What is proliferation financing?

7A. Proliferation financing includes any activity which has or is likely to have the effect of providing property, a financial or other service or economic support to a non-state actor, that may be used to finance the manufacture, acquisition, possession, development, transport, transfer or use of nuclear, chemical or biological weapons and their means of delivery. Also, this may include any activity which constitutes an offence in terms of section 49A of the FIC Act.

What is risk?

8. According to international best practice risk rating methodology, risk refers to the likelihood and impact of uncertain events on set objectives. The impact can be either a positive or negative deviation from what is expected. This uncertainty is a function of three factors: Threat, vulnerability and consequence.

9. The context of the above is important. For example, "threat" or "consequence" to whom or what. On the other hand, vulnerability could arise from external and internal factors and may be either controllable or uncontrollable.

10. A threat is a person or group of people, object or activity with the potential to cause harm. In the context of money laundering, terrorist financing and proliferation financing this includes criminals, terrorist groups and their facilitators, their funds, as well as the past, present and future money laundering, terrorist financing or proliferation financing activities.

11. The concept of vulnerabilities comprises those things that can be exploited by the threat or that may support or facilitate its activities. Identifying vulnerabilities, as distinct from threats, means focusing on, for example, the factors that represent weaknesses or features that may be exploited in a given system, institution, product, service etc. The areas in which these vulnerabilities may arise are discussed in more detail later in this guidance.

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 8 of 78

Page 10

administration of criminal justice which affects the safety and security of South Africans as well as that of people outside of South Africa.

19. In relation to accountable institutions, ML, TF and PF risks are threats and vulnerabilities which put the accountable institution at risk of being abused in order to facilitate ML, TF and PF activities. These relate to the potential that clients, by using the accountable institution's products and services, can exploit the accountable institution to promote money laundering, terrorist financing or proliferation financing activities. The nature of these risks relate to a number of aspects, including the features of the intended target market of clients who are likely to use an accountable institution's range of products and services, the geographic locations of an accountable institution's operations and of its clients, the delivery channels through which persons become clients of an accountable institution or through which clients access its products and services, the features of a particular product or service, etc. These aspects are discussed in more detail in section II below.

20. In order to have a robust ML, TF and PF risk management system accountable institutions must be able to demonstrate how they contextualise the concepts of "ML and TF risk" within their particular businesses as having an impact on their operational, line management and strategic objectives.

21. Controls should be purposefully built and/or adapted to address ML, TF and PF risks. Accountable institutions may make use of the controls which are already in place.

What is ML, TF and PF risk management?

22. ML and TF risk management is a process that includes the identification of ML, TF and PF risks, the assessment of these risks, and the development of methods to manage and mitigate the risks that have been identified.

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 10 of 78

Page 13

Accountable institutions should also ensure that their ML, TF and PF risk management systems and controls are adhered to within that institution.

29. This means that accountable institutions should reassess ML/TF risks, in particular residual risks after the application of ML, TF and PF risk management systems and controls, at regular intervals. The institutions should then review the continued adequacy of its ML, TF and PF risk management systems and controls on the basis of these regular assessments.

The effect of a risk-based approach

30. By applying a risk-based approach accountable institutions are able to ensure that measures to prevent or mitigate money laundering, terrorist financing and proliferation financing are commensurate with the risks identified. This will ensure that resources are directed in accordance with priorities, so that the greatest risks receive the highest attention. The risk-based approach also affords accountable institutions the flexibility to use a range of mechanisms to establish and verify the identities of their clients, creating opportunities for accountable institutions to explore more innovative ways of offering financial services to a broader range of clients and bringing previously excluded sectors of society into the formal economy. If applied correctly, it will improve the efficacy of measures to combat money laundering, terrorist financing and proliferation financing while promoting financial inclusion without undermining AML, CFT and CPF objectives. Accountable institutions should also ensure alignment between Treating Customer Fairly principles and its application of guidance on ML, TF and PF risk issues.

31. The risk-based approach further allows accountable institutions to simplify the due diligence measures applied where they assess ML, TF and PF risks to be lower. Instead of relying on rigid requirements in regulations and exemptions granted at the executive level, accountable institutions will have greater discretion to determine the appropriate compliance steps to be taken in given instances, in

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 13 of 78

Page 15

II RISK ASSESSMENT AND UNDERSTANDING OF RISK

33. Assessing ML, TF and PF risk requires accountable institutions to identify the ML, TF and PF risks they may face in the context of their businesses and to analyse these with a view to understand how the identified ML, TF and PF risks affects them. The likelihood of a risk transpiring as well as the impact of such a risk should also be considered by the accountable institution. This implies that accountable institutions must have adequate processes, proportionate to their size and complexity, to identify and assess ML, TF and PF risks.

34. The mechanisms used in a particular accountable institution to assess ML, TF and PF risk must be proportionate to the size and complexity of the institution. The risk assessment process therefore might be quite simple or very sophisticated depending on the size and structure of the accountable institution and the nature and range of products and services it offers.

35. The processes within accountable institutions to identify and assess ML, TF and PF risks must take account of a range of factors which may be indicative of greater or lesser threats and vulnerabilities to money laundering, terrorist financing and proliferation financing in a given scenario. Factors that are indicative of increased threats or vulnerabilities have been shown, based on previous experience, to lend themselves more readily to abuse by criminals.

36. Accountable institutions may have access to and may use various databases to assess the ML, TF and PF risks relating to their clients. The context within which accountable institutions assess ML, TF and PF risks is also influenced by ML, TF and PF risks that are identified at a national level in all the jurisdictions where they operate. Accountable institutions should therefore determine in their risk assessment processes what weight they give to risks identified at national level in the relevant jurisdictions where they operate. The sources of information on risk

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 15 of 78

Page 20

- • Have credible sources identified geographic locations from where clients engage with an institution as high-risk jurisdictions?

- • Are the geographic locations from where clients engage with an institution subject to sanctions regimes?

- • If the client is a corporate vehicle, has it been incorporated in a country which has been identified by credible sources as a high-risk jurisdictions or in a country which is the subject of a sanctions regime, or does it operate in such a country?

- • Has an international body, a domestic regulator or supervisory body or other credible source expressed concern with weak regulatory measures against money laundering, terrorist financing and proliferation financing, weak transparency requirements for beneficial ownership of corporate structures or weak institutional frameworks such as supervisory, law enforcement and prosecuting agencies in relation to a geographic location from where clients engage with an institution?

- • Are the geographic locations from where clients engage with an institution known to applying excessive client confidentiality?

Indicators relating to clients

39. It is trite that not all clients of an accountable institution pose the same ML, TF and PF risk. For an accountable institution to accurately identify all the factors that may be relevant to a particular client and to include all those factors in an assessment of ML, TF and PF risks, it is necessary that the institution has a holistic view of the information gathered about the client across all the points of engagement between the institution and the client. This implies that an accountable institution which offers a range of products and services should consider the different engagements with a particular client in relation to different products and services as component parts of one relationship with that client and assess the ML, TF and PF risks relating to that relationship in a holistic manner.

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 20 of 78

Page 24

44. A risk scale should be tailored according to the size of the accountable institution and consideration may be given to criteria set out in international best practice. The complexity of the risk scale should reflect the size and complexity of the accountable institution and the nature and the range of products and services it offers to its clients.

45. Accountable institutions offering a relatively homogenous range of products and services, using a limited range of delivery channels, operating in one or a few geographic location(s) or engaging with a homogenous range of clients require relatively simplistic risk scales distinguishing only between two or three risk categories. However, accountable institutions offering a more diverse range of products and services, using a wider range of delivery channels, operating in a larger number of geographic locations or engaging with a more diverse range of clients require more finely calibrated risk scales distinguishing between a larger number of risk categories.

46. The ML and TF risk associated with a particular client engagement is not static. The factors underlying any given risk-rating will inevitably change over time. It is therefore essential that accountable institutions re-evaluate the relevance of particular risk factors and the appropriateness of previous risk-ratings from time to time and determine the intervals at which this will be done.

47. Accountable institutions must document their risk-rating methodology and procedures which they apply as well as the conclusions reached through the processes in the accountable institution's RMCP. This includes the criteria and the intervals for the re-evaluation of risk-ratings.

The role of a risk matrix

48. The assessment of ML and TF risk should ultimately draw together all the factors that are relevant to an engagement with a client. A risk matrix could serve as a tool to provide an objective basis to the assessment of several risk indicators. A risk

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 24 of 78

Page 33

Single transaction threshold: Anonymous clients and clients acting under a false or fictitious names

79. The FIC Act defines a single transaction as a transaction other than a transaction concluded in the course of a business relationship and where the value of the transaction is not less than R5 000 (the amount is determined by the Minister of Finance in the Regulations). This can be described as occasional or once-off business where there is no expectation on the part of the accountable institution or the client that the engagements would recur over a period of time.

80. Institutions need to determine what constitutes a single transaction in the context of their particular business for purposes of complying with the obligations of the FIC Act in as far as it applies to single transactions.

81. Accountable institutions are not required to carry out the full scope of CDD measures in respect of clients conducting single transactions below the value to be set by the Minister of Finance in the MLTFC Regulations. However, the threshold for single transactions does not apply to the obligations set out in section 20A of the FIC Act. This means that, in spite of a single transaction being below the threshold, the accountable institution is still prohibited from dealing with an anonymous client or a client with an apparent false or fictitious name. As a result, in such cases, the accountable institution should obtain and record at least some information describing the identity of the client even if that information does not have to be verified. Examples of information to be obtained could include the full name and identity number of the client and other information such as a contact number. An added step of requesting to view an identification document of the client is advisable. The manner in which the accountable institutions comply with section 20A of the FIC Act in respect of business relationships and single transactions, both below and above the threshold, must be recorded in the institution's RMCP.

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 33 of 78

Page 34

Establishing and verifying clients' identities

82. CDD starts with an accountable institution knowing the identity of its client. In terms of section 21 of the FIC Act an accountable institution must, in the course of establishing a business relationship or entering into a single transaction, establish and verify the identity of the client and, if applicable, the person representing the client as well as any other person on whose behalf the client is acting. The objective of this provision is that an accountable institution, after applying its processes to establish and verify a client's identity, should have confidence that it knows who the client is with sufficient certainty given the accountable institution's risk assessment pertaining to that client engagement.

83. Establishing a client's identity entails that an accountable institution obtains a range of information about the client. In most cases this information is provided by the client in response to questions being asked by the accountable institution as part of its on-boarding process (in the case of a business relationship) or its client engagement process (in the case of a single transaction). Verification of the client's identity entails that the accountable institution corroborates the person's identity information by comparing this information with information contained in documents or electronic data issued or created by reliable and independent third-party sources.

84. As indicated in Chapter 1 above, large parts of the MLTFC Regulations, (in particular Chapter 1 of the Regulations which described the methods which accountable institutions had to use to establish and verify their clients' identities) have been repealed. Accountable institutions must now choose the type of information by means of which they will establish clients' identities and also the means of verification of clients' identities. The nature and extent of verification of clients' identities must be determined taking the assessed ML, TF and PF risks associated with the relevant business relationship or single transaction into account. These decisions as to how the accountable institution goes about the identification and verification of its clients, as well as how these measures are

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 34 of 78

Page 35

attenuated or intensified based on ML, TF and PF risk, must be described in the accountable institution's RMCP.

Establishing and verifying the identities of natural persons

85. A natural person's identity can be determined by reference to a number of attributes. At the very basic level these attributes are the person's full names, date of birth and, in most cases, a unique identifying number issued by a government source (e.g. in the case of a South African citizen or resident, his/her identity number or, in the case of other natural persons, a passport number or numbers contained in asylum seeker or refugee permits, work permits, visitors' visas etc.). It is expected that these basic attributes will always be used in accountable institutions' processes to establish a natural person's identity.

86. Information about a natural person's identity may be supplemented by applying other attributes of a natural person including his/her physical appearance or other biometric information, place of birth, family circumstances, place of employment or business, residential address, contact particulars (e.g. telephone numbers, e-mail addresses, social media), contacts with the authorities (e.g. tax numbers) or with other accountable institutions. This list of examples is not exhaustive and there may be other attributes of particular persons or categories of persons which accountable institutions may include in their identification processes. The nature and amount of other attributes which an accountable institution applies in a given case is dependent on the extent to which the institution relies on the verification of the client's identity as a means to mitigate ML, TF and PF risk in that case (see the discussion on risk mitigation in Chapter 1 above).

87. Verification methods vary and are mostly dictated by the type of information used to establish a person's identity in a given scenario. Regardless of the method applied, it is important that verification be done using information obtained from a reliable and independent third-party source and, as far as possible, the original source of the information. Accountable institutions should evaluate the adequacy

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 35 of 78

Page 36

of corroboration of a person's identity attributes. This implies that institutions must determine the level of confidence they have that any particular method of corroboration provides certainty as to the relevant identity attributes. A factor that accountable institutions should bear in mind in this context, is the controls which are applied to ensure that information reflected in a particular source is accurate. Information sources created or generated by the client him/herself are not considered to be reliable and independent third-party sources.

88. Government issued or controlled sources of information such as various forms of identity documents (e.g. South African identity documents including smart card identity documents, driver's licenses, foreign identity documents, passports, asylum seeker or refugee permits, work permits, visitors' visas) and the underlying electronic databases where information evidenced in identity documents are kept, are most often the original sources of information concerning the relevant attributes and therefore provide a high level of confidence as a means to corroborate a natural person's basic identity attributes. Hence, accountable institutions should, as far as practicable, use government issued or controlled sources as the means of verification when verifying basic identity attributes. Accountable institutions should only in exceptional cases use information obtained from sources other than the original source of the information (e.g. where the original source is not available) and this should only be done in cases where accountable institutions are confident that they can adequately manage ML, TF and PF risks.

89. Corroboration of a person's identity in relation to both basic and other identity attributes can be in documentary or electronic form. Moreover, many of a person's identity attributes accumulate over time and can be found in the person's so-called "electronic footprint". With this in mind the Centre encourages accountable institutions to make use of information in electronic form to corroborate a prospective client's information against multiple third-party data sources.

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 36 of 78

Page 37

90. Accountable institutions making use of electronic data sources to verify a prospective client's identity remain responsible and accountable in their own capacity for compliance with the requirements of the FIC Act. The use of electronic data sources in the verification process does not provide automatic indemnity from regulatory action relating to the institution's compliance with these requirements. It is important therefore that accountable institutions apply due diligence in choosing electronic solutions as a means to enable verification of a prospective client's identity.

91. If accountable institutions make use of electronic data sources they should apply the same test in principle as in the case of documentary sources, i.e. that the sources should be reliable and independent third-party sources and as, far as possible, the original source of the relevant information. Accountable institutions should likewise determine the level of confidence they place in particular electronic sources of corroboratory information. Solutions which allow prospective clients to manipulate source information in any manner should not be considered credible information sources to enable verification of clients particulars.

92. A factor that may contribute to an accountable institution's confidence in corroboration based on electronic sources is the size of a person's "electronic footprint" in relation to the depth, breadth and quality of electronic information. This implies that accountable institutions would have a greater level of confidence in corroboration from electronic sources if they use information from multiple sources, and across time.

93. The means of verification and the sources of corroboration an accountable institution uses in a given case are dependent on the extent to which the institution relies on the verification of the client's identity as a means to mitigate ML, TF and PF risk in that particular case (see the discussion on risk mitigation in Chapter 1 above).

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 37 of 78

Page 40

concerning the verification of identity also apply with regard to legal persons. Accountable institutions should therefore give preference to using sources of information that are created or controlled by public sector institutions, such as the information held by the Companies and Intellectual Property Commission be used to corroborate attributes associated with the incorporation of companies.

101. In addition to establishing and verifying a legal person's identity an accountable institution also must establish the nature of the legal person's business and its ownership and control structure. Furthermore, an accountable institution must also establish who the beneficial owner of the legal person is and take reasonable steps to verify the beneficial owner's identity.

102. (Refer to public compliance communication 59)

103. (Refer to public compliance communication 59)

104. Once the accountable institution has determined who the beneficial owner of a legal person is, the institution must take reasonable steps to verify that person's identity. The remarks made above about the verification of a natural person's identity also apply in this instance. The reference to "reasonable steps" confirm that accountable institutions must apply measures that are commensurate with the assessed ML, TF and PF risk in a given case to the verification of the beneficial owner's identity. This includes making use of information obtained by reasonably practical means while striking a balance between the accuracy of the verification required, on the one hand, and the level of effort invested in the means to obtain such verification on the other. The different measures which an accountable institution uses to verify the identities of beneficial owners of legal persons must be described in the institution's RMCP. The underlying element of this requirement is that the accountable institution must be satisfied that it knows who the beneficial owner is.

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 40 of 78

Page 41

105. (Refer to public compliance communication 59)

Partnerships

106. Refer to public compliance communication 59 for guidance on beneficial owners of partnerships. Partnerships are not incorporated entities and do not have legal personality. However, accountable institutions must establish the identities of partnerships who are their clients nonetheless. This means that the starting point to the identification of a partnership is to determine how the partnership is generally known. Accountable institutions must therefore establish whether a partnership is identified by a unique name or description. In addition to establishing this information, accountable institutions must take reasonable steps to verify it. This means that accountable institutions must apply measures that are commensurate with the assessed ML, TF and PF risk relating to a partnership in a given case. Examples of information that can be used for this purpose include the partnership agreement which establishes the partnership and governs its membership and functioning, business correspondence of the partnership and promotional material advertising the partnership's business. The measures which an accountable institution uses to verify the identities of partnerships must be described in the institution's RMCP.

107. The concept of a beneficial owner in the context of a partnership encompasses all the partners in the partnership. Hence, section 21B(3) of the FIC Act requires accountable institutions, over and above the requirements of sections 21 and 21A of the FIC Act, to establish the identity of every partner in a partnership. This includes every member of a partnership en commandite (a partnership where the liability of certain partners who contribute a fixed amount and who remain undisclosed as partners, is limited according to the partnership agreement establishing and governing the partnership), an anonymous partnership (a partnership where the partners' names are not disclosed to persons who are not partners in the partnership) or any similar partnership.

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 41 of 78

Page 42

108. The express references to partnerships en commandite and anonymous partnerships indicates clearly the intention that accountable institutions must establish the identity of every person who contributes to a partnership or may benefit from a partnership when they do business with a partnership. The most reliable source document indicating who the members of the partnership are, is the partnership agreement which establishes the partnership and governs its membership and functioning.

109. Section 21B(3) of the FIC Act also requires accountable institutions to establish the identity of the person who exercises executive control over the partnership, if there is such a person, indicating that accountable institutions should determine the notion of control over (in addition to benefit from) a partnership. Moreover, the provision requires accountable institutions to establish the identity of each natural person who is authorised to enter into a single transaction or establish a business relationship with the accountable institution on behalf of a partnership.

110. Accountable institutions are required to take reasonable steps to verify the names of the natural persons covered by section 21B(3) FIC Act. The remarks made above about the verification of a natural person's identity also apply in this instance. Again here the reference to "reasonable steps" confirm that accountable institutions must apply measures to verify the relevant persons' identities that are commensurate with the assessed ML, TF and PF risk in a given case. The different measures which an accountable institution uses to verify the identities of the relevant natural persons must be described in the institution's RMCP. The underlying element of this requirement is that the accountable institution must be satisfied that it knows the identities of the relevant natural persons.

Trusts

111. Refer to public compliance communication 59 for guidance on beneficial owners of trusts. As in the case of partnerships, trusts are not incorporated entities and do

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 42 of 78

Page 44

116. In addition to establishing this information, accountable institutions must take reasonable steps to verify it. This means that accountable institutions must apply measures that are commensurate with the assessed ML, TF and PF risk relating to a trust in a given case. The most reliable source of confirmation for this information is the trust deed (the agreement which establishes the trust and governs its functioning) and the information controlled (and documentation issued) by the relevant offices of the Masters of the High Court. The measures which an accountable institution uses to verify the identities of trusts must be described in the institution's RMCP.

117. The concept of a beneficial owner in the context of a trust encompasses all the natural persons who may benefit from a trust arrangement or may control decisions in relation to the management of trust property or are otherwise associated with the trust. Hence, section 21B(4) of the FIC Act requires accountable institutions, over and above the requirements of sections 21 and 21A of the FIC Act, to establish:

- The identity of each founder;

- If a founder of the trust is a legal person or a person acting on behalf of a partnership or in pursuance of the provisions of a trust agreement, the beneficial owner of that legal person, partnership or trust

- The identities of each trustee and each natural person who purports to be authorised to enter into a single transaction or establish a business relationship with the accountable institution on behalf of the trust, and

- If a trustee is a legal person or a person acting on behalf of a partnership, the beneficial owner of the legal person or partnership

- Each natural person who purports to be authorised to enter into a single transaction or establish a business relationship with the accountable institution on behalf of the trust, whether such a person is appointed as a trustee for the trust or not

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 44 of 78

Page 45

- The identities of each beneficiary referred to by name in the trust deed or other founding instrument in terms of which the trust is created; or

- If a beneficiary referred to by name in the trust instrument is a legal person or a person acting on behalf of a partnership or in pursuance of the provision of a trust agreement, the beneficial owner of the legal person, partnership or trust

- If beneficiaries are not referred to by name in the trust deed or other founding instrument in terms of which the trust is created, the particulars of how the beneficiaries of the trust are determined.

118. Accountable institutions are required to take reasonable steps to verify the names of the natural persons covered by section 21B(4) of the FIC Act. The remarks made above about the verification of a natural person's identity also apply in this instance. Again here the reference to "reasonable steps" confirm that accountable institutions must apply measures to verify the relevant persons' identities that are commensurate with the assessed ML, TF and PF risk in a given case. The different measures which an accountable institution uses to verify the identities of natural persons associated with trusts must be described in the institution's RMCP. The underlying element of this requirement is that the accountable institution must be satisfied that it knows the identities of the relevant natural persons. Paragraphs 82 and 85 should be applied in respect of establishing the identity of a client that is a trust that is excluded from the definition of a trust.

Impact of the Protection of Personal Information Act, 2013 on the identification and verification requirements of the FIC Act

119. The processing of personal information of clients for the purposes of the FIC Act compliance may only be done within the confines of the Protection of Personal Information Act, 2013 (the POPI Act). While the processing and further processing of personal information of a client for purposes of FIC Act requirements is allowed in terms of the (POPI Act), accountable institutions should be cautious of verifying

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 45 of 78

Page 46

clients' identities using third party data sources which may have obtained personal information about a client without the client's consent or knowledge.

Timing of verification

120. A client's identity and, where applicable, the identities of beneficial owners and other persons associated with a client, must be verified in the course of conducting a single transaction or entering into a business relationship. This means that an accountable institution may initiate the processes related to the conclusion of a single transaction or entering into a business relationship while it is verifying the relevant persons' identities, but the institution must complete the verification before the institution concludes a transaction in the course of the resultant business relationship or performs any act to give effect to the resultant single transaction.

121. This implies that accountable institutions may, for example, accept a mandate from a prospective client to establish a business relationship or to conclude a single transaction or take any similar preparatory steps with a view of establishing a business relationship or concluding a single transaction before completing verification of the identities of the prospective client and other relevant persons. However, in doing so accountable institutions must take care not to incur unmitigated ML, TF and PF risks by, for example, receiving funds from a client which may have to be returned to the client before completing the verification or making funds available to a client before completing the verification.

122. The manner and processes for the identification of clients and verification of their identities described in an accountable institution's RMCP must also provide for the timing of verification and the mitigation of ML, TF and PF risks where verification is not completed before a single transaction is conducted or a business relationship entered into.

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 46 of 78

Page 47

Understanding and obtaining information on the business relationship

123. Section 21A of the FIC Act requires accountable institutions to ascertain from a prospective client what the nature and intended purpose of the business relationship will be, as well as to obtain information on the source of funds that the prospective client expects to use in the course of the business relationship. The purpose of section 21A of the FIC Act is to understand the nature of the client and the envisaged business relationship between the client and the accountable institution. By complying with this provision an accountable institution should be able to form a view of the frequency and the nature of transactions that could be expected to be conducted in the normal course of the ensuing business relationship. This understanding also contributes to the accountable institution's understanding of the ML, TF and PF risk associated with the particular business relationship.

124. In most cases, the purpose and intended nature of the business relationship will be self-evident given the nature of the product or service that the client is requesting.

125. The manner and type of information obtained in terms of section 21A of the FIC Act must be recorded in the accountable institution's RMCP. Information that may be relevant include-

- The nature and details of the client's business/occupation/employment;

- The expected source and origin of the funds to be used in the business relationship; and

- The anticipated level and nature of the activity that is to be undertaken during the business relationship.

126. The information which an accountable institution obtains from a prospective client should be sufficient for the institution to form the intended understanding of the client and the business relationship. Accountable institutions may form this understanding by accepting the information obtained for this purpose at face value.

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 47 of 78

Page 48

Accountable institutions are not required to verify the veracity of the information obtained under section 21A of the FIC Act.

Ongoing due diligence

127. Section 21C of the FIC Act provides for ongoing due diligence measures. These measures follow on from the obligation to understand the purpose and intended nature of a business relationship. They include the scrutiny of transactions undertaken throughout the course of a relationship, to ensure that the transactions being conducted in the course of a business relationship are consistent with an accountable institution's knowledge of the client, and the client's business and risk profile, including, where necessary, the source of funds. It also requires accountable institutions to ensure that the information that an accountable institution has about a client is still accurate and relevant.

128. The objective of the ongoing measures is to identify activities of clients during the course of the business relationship which are not consistent with the accountable institution's knowledge of the client, or the purpose and intended nature of the business relationship, and which need to be assessed for the possibility that the institution may have grounds to report a suspicion of money laundering, terrorist financing or proliferation financing. Accountable institutions should pay particular attention to complex or unusually large transactions and all unusual patterns of transactions which have no apparent business or lawful purpose. If the accountable institution suspects that a transaction or activity is suspicious or unusual and the institution believes that performing the ongoing due diligence requirements will disclose to the client that a report will be made in terms of section 29 of the FIC Act, the accountable institution may discontinue the ongoing due diligence process and consider making a report in terms of section 29 of the FIC Act.

129. The intensity and frequency of ongoing due diligence in respect of a given business relationship must be determined on the basis of the accountable institution's

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 48 of 78

Page 49

understanding of ML, TF and PF risks associated with that relationship. An accountable institution must include, in its RMCP, the manner in which and the processes it will have in place to conduct ongoing due diligence and account monitoring of business relationships.

130. Additionally, the institution must include, in its RMCP, the manner in which it will examine complex or unusually large transactions and unusual patterns of transactions which have no apparent business or lawful purpose as well as how it will keep the written findings of such transactions.

#### **Doubts about veracity of previously obtained information**

131. Section 21D FIC Act provides for measures that accountable institutions are required to take if doubts about the veracity or adequacy of previously obtained customer due diligence information arise later on in the relationship, or where a suspicion of money laundering, terrorist financing or proliferation financing is formed at a later stage.

132. An accountable institution is required to repeat the steps set out in sections 21 and 21B of the FIC Act in accordance with its RMCP and to the extent that is necessary to confirm the information that is required to be verified.

133. An accountable institution must provide, in its RMCP, for the manner in which and the processes by which the institution will confirm information relating to a client when it has doubts about the veracity of previously obtained information.

#### **Inability to conduct due diligence**

134. Section 21E of the FIC Act prohibits accountable institutions from entering into or maintaining business relationships or concluding single transactions if they cannot perform the required CDD in accordance with the provisions of the Act. This provision must be applied against the background of the remarks made in paragraphs 120 to 121 above on the timing of verification.

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 49 of 78

Page 51

138. Sections 21F, 21G and 21H of the FIC Act deal with politically exposed persons and prominent influential persons. The starting point for the effective implementation of measures relating to persons who are entrusted in prominent public or private sector positions, is for accountable institutions to have effective measures in place to know who their clients are and to understand their clients' business.

139. Business relationships with domestic politically exposed persons or prominent influential persons are not inherently high-risk. Accountable institutions must consider each such relationship on its own merits in order to determine whether there is any reason to conclude that it brings higher risk of abuse for money laundering, terrorist financing and proliferation financing purposes. If so, the accountable institution must apply the same requirements as for foreign politically exposed persons.

140. Business relationships with foreign politically exposed persons must always be considered high-risk. If an accountable institution finds out that it is dealing with a foreign politically exposed persons, senior management approval must be obtained to establish the business relationship. Accountable institutions must also take reasonable measures to establish the source of wealth and source of funds of the client and conduct enhanced ongoing monitoring of the business relationship. Accountable institutions are not required to verify the information about the client's source of wealth and source of funds, but will have to include this information in its client profile which will be used as the basis for enhanced ongoing monitoring. These requirements also apply to immediate family members and known close associates of such politically exposed persons and prominent influential persons.

141. The notion of senior management in an accountable institution is determined by the size, structure, and nature of the institution. The appropriate level of seniority for approval should also be determined by the level of increased risk associated

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 51 of 78

Page 55

- Business partners or associates, especially those that share (beneficial) ownership of corporate vehicles with the politically exposed or prominent person, or who are otherwise connected (e.g., through joint membership of a company board).

- Any individual who has sole beneficial ownership of a corporate vehicle set up for the actual benefit of the politically exposed or prominent person.

156. Accountable institutions are required to determine if they are dealing with a family member or known close associate of a politically exposed person or prominent influential person regardless of whether the politically exposed person or prominent influential person is a client of the accountable institution or not.

157. It is recognised that there is generally less information available to accountable institutions about family members and known close associates of politically exposed persons or prominent influential persons, making the determination as to whether a client (or prospective client) falls in one of these categories more challenging. Accountable institutions should refer to what is known publically about a politically exposed person or prominent influential person's sphere of influence in order to determine if a client is a family member or known close associate of a prominent person in addition to having regard to the information about their clients which is in their possession already. To this end accountable institutions can make use of commercially available sources of information that outlines associations of politically exposed persons or prominent influential persons, monitoring of the media, credible third-party sources of information and information that may be available from other institutions within the same group which are doing business in other countries as well as applying existing processes already in place for purposes such as ongoing monitoring of business relationships.

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 55 of 78

Page 56

158. The remarks made in paragraphs 150 and 152 above on the sources of information about politically exposed persons or prominent influential persons also apply in respect of family members and known close associates.

159. Accountable institutions should bear in mind that although a client might not initially (at the commencement of the business relationship) meet the definition of a politically exposed person or prominent influential person (or immediate family member or known close associate), this position might change over time. Likewise an accountable institution may only become aware of the fact that a client is a family member or close associate of a politically exposed person or prominent influential person after he or she has become a client of the accountable institution, e.g. when the accountable institution conducts on-going due diligence of its existing clients. Therefore accountable institutions should, as far as practicable, be alert to public information relating to possible changes in the status of their clients.

160. Accountable institutions must provide, in their RMCPs, how they determine whether a prospective client is a foreign politically exposed person, domestic politically exposed person or prominent influential person (including the sources of information they use) and how they assess and mitigate the money laundering, terrorist financing and proliferation financing risks associated with business relationships with officials and persons. This includes the processes which accountable institutions implement in respect of existing clients where a client's status as a politically exposed person or prominent influential person has changed after the start of the relationship with the client or where accountable institutions were not aware of a client's status as family member or close associate of a politically exposed person or prominent influential person.

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 56 of 78

Page 60

173. Accountable institutions which operate in groups of companies may implement group-wide policies on record-keeping which may include centralised storage of records. Accountable institutions should bear in mind that the principles mentioned in paragraph 170 above also apply where record keeping is centralised within a group. This is particularly important if the location of the centralised storage of records is outside of South Africa. No secrecy provisions or data protection legislation should restrict the South African based accountable institution(s)' free and easy access to the relevant records, or result in the records not being readily available to the Centre or relevant South African supervisory bodies or law enforcement authorities. If restrictions exist in another jurisdiction, where records are kept which would impede such access to the records, the relevant records or copies thereof must be kept in South Africa.

174. It is advisable for accountable institutions which make use of commercial third party services, or intra-group centralised data storage to retain their records to conduct regular assessments of its service providers and to test the controls and business processes so as to provide assurance to the relevant supervisory body that the accountable institution can access and retrieve data and/or documents as envisaged under the FIC Act.

**Period for which records must be kept**

175. Records in relation to establishment of a business relationship referred to in section 22 of the FIC Act must be kept for at least five years from the date on which the business relationship is terminated.

176. Records of all transactions concluded referred to in section 22A must be kept for at least five years from the date on which that transaction is concluded.

177. Records of a transaction or activity which gave rise to a report contemplated in section 29 of the FIC Act must be kept for at least five years from the date on which the report was submitted to the Centre.

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 60 of 78

Page 63

181C. The obligation to approve the RMCP and accountability of the board of directors, senior management, persons or group of persons with the highest authority of an accountable institution that is a legal person, cannot be delegated to other persons, group of persons, employees, committees or structures within the accountable institution. The RMCP must be approved by the board of directors, where there is no board of directors the senior management itself, where there is no senior management the person with the highest level of authority and cannot be delegated to any other persons.

Example 1: Obligation and accountability of the board cannot be delegated

The board of directors of Bank K must approve the RMCP, the board cannot delegate its obligations in terms of the FIC Act. The board may have a committee that provides advice on the suitability of the RMCP, however, the committee cannot take the decision to approve the RMCP. The obligation to approve the RMCP remains with the board.

181D. Where an accountable institution that is a legal person does not have a board of directors, the obligation for approval of the RMCP and accountability of the senior management or person or group of person(s) with the highest authority, cannot be delegated to other persons, employees, committees or structures within the accountable institution.

181E. Where the accountable institution is a sole proprietor, the obligation for approval of the RMCP and accountability of the person(s) with the highest authority cannot be delegated to another person or group of persons.

Adequacy of RMCP approval

181F. The RMCP must adequately address the full scope of section 42 of the FIC Act. The board of directors, senior management or other person(s) with the highest authority should ensure that the RMCP is **adequate, suitable and effective** for the accountable institution.

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 63 of 78

Page 71

187. Accountable institutions which operate in groups of companies may implement group-wide RMCPs. In doing so, accountable institutions must ensure that the various elements of group-wide RMCPs, including internal processes, systems and controls are appropriate for the different entities or branches within the group and are adequately tailored to specific entities or branches within the group, commensurate with their individual risks, where necessary. The group-wide RMCP should indicate what elements are applicable to different entities and what is not applicable to different entities within the group and why this is so.

188. Accountable institutions situated in South Africa and operating in foreign jurisdictions should also be aware of the local AML, CFT and CFP obligations in all jurisdictions where they operate. This should be reflected in the accountable institution's RMCP document. Procedures should be in place to meet local AML, CFT and CFP obligations in each jurisdiction where an accountable institution operates. If there are variations or conflicts between the South African and the foreign jurisdiction's AML, CFT and CFP compliance requirements, and if the foreign jurisdictions requirements would result in a lower standard than in South Africa, the accountable institution must implement measures which meet the South African requirements. Unless there is a reason that prevents the accountable institution from doing so, then the accountable institution must inform the supervisory bodies, and take into consideration the level of risk in the foreign jurisdiction and apply appropriate additional measures to manage the risk.

189. It is important that the RMCP and the content of an accountable institution's documentation of their RMCP is communicated widely throughout the institution, as may be applicable, and the implementation thereof monitored consistently and audited periodically to increase the effectiveness of its implementation.

190. An accountable institution must review its RMCP at regular intervals to ensure that it remains relevant to the institution's operations and the identified risks. The

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 71 of 78

Page 73

CHAPTER 5 IMPLEMENTATION OF THE UNITED NATIONS SECURITY COUNCIL RESOLUTIONS RELATING TO THE FREEZING OF ASSETS

191. The FIC Act places the responsibility to administer the targeted financial sanctions (TFS) measures adopted by the United Nations Security Council (UNSC) in its Resolutions on the Centre.

192. This inclusion of TFS measures is, inter alia, as a result of Recommendation 6 and 7 of the FATF recommendations, which requires member countries to implement the targeted financial sanctions proposed by the UNSC in the context of among other aspects, the prevention and suppression of terrorism and terrorist financing, as well as the prevention, suppression and disruption of the proliferation of weapons of mass destruction and its financing and the relevant provisions of the FIC Act aim at enabling South Africa to meet these international obligations.

193. Sanctions impose restrictions on activities that relate to particular countries, goods and services, or persons and entities. TFS measures generally restrict sanctioned persons and entities from having access to funds and property under their control and from receiving financial services in relation to such funds and property. In order for these sanctions to be given effect, the FIC Act requires accountable institutions to freeze property and transactions pursuant to financial sanctions imposed in the UNSC Resolutions. Refer to the FIC public compliance communication 44A for further guidance on targeted financial sanctions.

Mechanisms for implementation

194. Mechanisms for the implementation of the UNSC Resolutions include the publication in the Government Gazette by the Minister of Finance of a Notice of the adoption of the UNSC Resolution, and the publication of a Notice by the Director of the Centre of persons who are subject to the sanction measures (the sanctions list). These Notices may be revoked if it is considered that they are no

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 73 of 78

Page 74

longer necessary to give effect to the applicable UNSC Resolutions. Otherwise, the sanctions announced in these Notices remain in effect indefinitely.

195. The Notices by the Minister of Finance and the Director are public statements and are meant to advise both sanctioned persons and entities and accountable institutions who may have them as clients or prospective clients of the relevant sanctions. If an accountable institution has a sanctioned person or entity as a client, it is allowed to draw the attention of the person or entity to the relevant sanctions notices.

196. The acquisition, collection or use of the property of persons or an entity whose names appear in the sanctions is prohibited. This includes the provision of financial services and products to those persons or entities. In short this means that accountable institutions are not allowed to transact with a sanctioned person or entity or to process transactions for such a person or entity. The status quo as at the time of the imposition of the sanction in relation property or funds of the sanctioned person or entity must be maintained and no financial services may be provided to the person or entity. The only exception to this general prohibition is in specific instances where the Minister of Finance has permitted certain financial services or dealings with property as discussed below.

197. Accountable institutions must report to the Centre, the property in the accountable institution's possession or under its control which is owned or controlled by or on behalf of a person or an entity identified in the sanctions list.

Screening

198. Accountable institutions must be able to determine whether they have a sanctioned person or entity as a client or whether a prospective client is a sanctioned person or entity in order to determine their exposure to TFS-related obligations. This implies that accountable institutions which are likely to come into contact with

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 74 of 78

Page 75

sanctioned persons or entities are able to screen clients and prospective clients against the relevant sanctions lists. This should be done during the client-take-on process as well as subsequently as and when the UNSC adopts new TFS measures or expand existing ones.

199. Accountable institutions must therefore determine the likelihood that their client base and intended target market may include sanctioned persons or entities. This should assist the accountable institution in determining the amount of effort and resources it requires in order to determine whether they have sanctioned persons or entities as a clients or whether prospective clients are sanctioned persons or entities. Accountable institutions that have business relationships with foreign persons and entities are more vulnerable to dealing with sanctioned persons and entities.

200. Accountable institutions should be mindful of the fact that failure to comply with TFS obligations is a criminal offence under section 49A of the FIC Act. The fact that an accountable institution had relied on a commercially available screening capability or that it had considered the risk of being exposed to TFS-related obligations to be low, would not be a defence against such a criminal charge.

Accessibility of sanctions list

201. The Centre will maintain an updated sanctions list which will be available on its website and which will reflect available identity particulars of persons and entities contained in notices published by the Director.

Basic living expenses

202. The FIC Act allows the Minister of Finance to permit a sanctioned person or entity to conduct financial services or deal with property affected by a sanction in order to allow such a person or entity access to certain basic living expenses. The permission of the Minister of Finance may contain the exact details of the types of

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 75 of 78

Draft Guidance Note 7B - Implementation of various aspects of the FIC Act

Consultation draft - not in force

Relationships in

Relationships out

Document

Linked legislation

**DRAFT GUIDANCE NOTE 7B**

PREFACE

DRAFT GUIDANCE NOTE 7B ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Contents

INTRODUCTION

**What is proliferation financing?**

**What is risk?**

**What are inherent and residual risks?**

**Requirement of a risk-based approach in the FIC Act**

**What are money laundering, terrorist financing and proliferation financing (ML, TF and PF) risks?**

What is ML, TF and PF risk management?

**The effect of a risk-based approach**

II RISK ASSESSMENT AND UNDERSTANDING OF RISK

Indicators relating to products and services

Indicators relating to delivery channels

Indicators relating to geographic locations

Indicators relating to clients

Other factors

Risk-rating

The role of a risk matrix

III RISK MITIGATION

**Implementation of systems and controls for management of ML, TF and PF risk**

**How does customer due diligence fit into risk mitigation?**

**Risk mitigation measures**

De-risking and avoiding risk

CHAPTER 2 CUSTOMER DUE DILIGENCE MEASURES

Introduction

**Business relationship**

**Single transaction threshold: Anonymous clients and clients acting under a false or fictitious names**

Establishing and verifying clients' identities

**Establishing and verifying the identities of natural persons**

Establishing the identity of legal persons, trusts and partnerships

Legal persons

**Partnerships**

**Trusts**

**Impact of the Protection of Personal Information Act, 2013 on the identification and verification requirements of the FIC Act**

**Timing of verification**

Understanding and obtaining information on the business relationship

**Ongoing due diligence**

CHAPTER 3 RECORDKEEPING

General

**Obligation to keep customer due diligence records**

**Obligation to keep transaction records**

**Manner in which records must be kept**

CHAPTER 4 RISK MANAGEMENT AND COMPLIANCE PROGRAMME

Responsibilities relating to approval and compliance

**Example 1: Obligation and accountability of the board cannot be delegated**

**Adequacy of RMCP approval**

Elements of an effective RMCP and the documentation of an RMCP

Risk identification

*Documentation considerations*

Supervisory approach

CHAPTER 5 IMPLEMENTATION OF THE UNITED NATIONS SECURITY COUNCIL RESOLUTIONS RELATING TO THE FREEZING OF ASSETS

Mechanisms for implementation

Screening

**Accessibility of sanctions list**

**Basic living expenses**

GLOSSARY

DRAFT GUIDANCE NOTE 7B

What is proliferation financing?

What is risk?

What are inherent and residual risks?

Requirement of a risk-based approach in the FIC Act

What are money laundering, terrorist financing and proliferation financing (ML, TF and PF) risks?

The effect of a risk-based approach

Implementation of systems and controls for management of ML, TF and PF risk

How does customer due diligence fit into risk mitigation?

Risk mitigation measures

Business relationship

Single transaction threshold: Anonymous clients and clients acting under a false or fictitious names

Establishing and verifying the identities of natural persons

Partnerships

Trusts

Impact of the Protection of Personal Information Act, 2013 on the identification and verification requirements of the FIC Act

Timing of verification

Ongoing due diligence

Obligation to keep customer due diligence records

Obligation to keep transaction records

Manner in which records must be kept

Example 1: Obligation and accountability of the board cannot be delegated

Adequacy of RMCP approval

Documentation considerations

Accessibility of sanctions list

Basic living expenses