Fickle - The South African FIC corpus, mapped.

Linked legislation

Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 20A
"The manner in which the accountable institutions complies with section 20A of the FIC Act in respect of business relationships and single transactions, both below and above the threshold, must be recorded in the institution's RMCP."
Financial Intelligence Centre Act 38 of 2001page 31recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 21
"Section 21 of the FIC Act (the requirement to establish and verify a client's identity) also applies to clients who are not natural persons acting in their personal capacity."
Financial Intelligence Centre Act 38 of 2001page 36recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 21B
"Accountable institutions are required to take reasonable steps to verify the names of the natural persons covered by section 21B(4) of the FIC Act."
Financial Intelligence Centre Act 38 of 2001page 43recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 21A
"Accountable institutions are not required to verify the veracity of the information obtained under section 21A of the FIC Act."
Financial Intelligence Centre Act 38 of 2001page 45recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 21C
"Section 21C of the FIC Act provides for ongoing due diligence measures."
Financial Intelligence Centre Act 38 of 2001page 45recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 21E
"Section 21E of the FIC Act prohibits accountable institutions from entering into or maintaining business relationships or concluding single transactions if they cannot perform the required CDD in accordance with the provisions of the Act."
Financial Intelligence Centre Act 38 of 2001page 47recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 21H
"Section 21H of the FIC Act provides that the measures for politically exposed persons and prominent influential persons also apply to their immediate family members and known close associates."
Financial Intelligence Centre Act 38 of 2001page 52recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001
"This means that accountable institutions must keep record of all information pertaining to a client obtained in the course of its processes to comply with sections 21 to 21H of the FIC Act."
Financial Intelligence Centre Act 38 of 2001page 56recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 22A
"Accountable institutions must keep transaction records of single transactions and transactions concluded in the course of the business relationship with the client in terms of section 22A of the FIC Act."
Financial Intelligence Centre Act 38 of 2001page 56recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 22
"Records in relation to establishment of a business relationship referred to in section 22 of the FIC Act must be kept for at least five years from the date on which the business relationship is terminated."
Financial Intelligence Centre Act 38 of 2001page 58recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 29
"Records of a transaction or activity which gave rise to a report contemplated in section 29 of the FIC Act must be kept for at least five years from the date on which the report was submitted to the Centre."
Financial Intelligence Centre Act 38 of 2001page 58recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 42A
"A board of directors, senior management or person(s) with the highest authority who demonstrates an underdeveloped understanding of the accountable institution's RMCP will be unable to discharge their obligation in terms of section 42A(1) of the FIC Act."
Financial Intelligence Centre Act 38 of 2001page 62recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 61
"The board of directors, senior management or other person or group of person(s) with the highest authority may be sanctioned in terms of section 61 of the FIC Act."
Financial Intelligence Centre Act 38 of 2001page 63recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 42
"When conducting an inspection, the supervisory body may inspect whether the board of directors, senior management or person(s) with the highest authority approved the RMCP, in terms of section 42(2B) of the FIC Act."
Financial Intelligence Centre Act 38 of 2001page 70recorded 10 August 2026
Cross-references
Low confidence
Financial Intelligence Centre Act 38 of 2001 49A
"Accountable institutions should be mindful of the fact that failure to comply with TFS obligations is a criminal offence under section 49A of the FIC Act."
Financial Intelligence Centre Act 38 of 2001page 73recorded 10 August 2026
Cross-references
Low confidence
Money Laundering and Terrorist Financing Control Regulations, 2002
"As indicated in Chapter 1 above, large parts of the MLTFC Regulations, (in particular Chapter 1 of the Regulations which described the methods which accountable institutions had to use to establish and verify their clients' identities) have been repealed."
Money Laundering and Terrorist Financing Control Regulations, 2002page 32recorded 10 August 2026

PREFACE

i) The Financial Intelligence Centre (the Centre) in collaboration with the National Treasury, South African Reserve Bank and the Financial Sector Conduct Authority (formerly known as Financial Services Board) has published guidance that will be required to support the implementation of the Financial Intelligence Centre Act, 2001 (Act 38 of 2001) (the FIC Act).

ii) The FIC Act established the Centre which is the national point for the gathering, analysis and dissemination of financial intelligence. The Centre was established to identify proceeds of crime and assist in combating money laundering and the financing of terrorism and in so doing has a primary role to protect the integrity of South Africa's financial system. The Centre develops and provides financial intelligence to a range of agencies supporting the investigation and prosecution of criminal activity by helping to identify the proceeds of crime, combat money laundering and the financing of terrorism. The FIC Act is a key component of the regulatory architecture that protects the integrity of the South African financial system and (together with legislation such as the Prevention of Organised Crime Act, 1998 (Act 121 of 1998) and the Prevention of Constitutional Democracy against Terrorism and Related Activities Act, 2004 (Act No. 32 of 2004) of the legal frameworks that supports the administration of the criminal justice system.

iii) This guidance is issued in terms of section 4(c) of the FIC Act read with regulation 28 of the Money Laundering and Terrorist Financing Control Regulations (MLTFC Regulations) which empowers the Centre to provide guidance in relation to a number of matters concerning compliance with the obligations of the Act. Guidance provided by the Centre is the only form of guidance formally recognised in terms of the FIC Act and the MLTFC Regulations issued under the FIC Act. Guidance issued by the Centre is authoritative in nature which means that accountable institutions must take the guidance issued by the Centre into account

REVISED GUIDANCE NOTE 7A ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 11

24. These actions apply to ML/TF risk, as with other risks. An accountable institution's risk appetite is a key determining factor in relation to its risk management decisions, in particular the extent to which it will apply resources to treat (mitigate) risks, the extent to which it may tolerate certain risks and the instances when it will avoid or terminate risks. An accountable institution's risk appetite can also differ in relation to different types of risk (e.g. money laundering risk as opposed to terrorist financing risk) or risks arising in different contexts.

25. Management and mitigation of ML/TF risks most probably will entail the treatment of identified risks within an accountable institution. Treating ML/TF risk entails that the accountable institution develops systems and controls to manage the risks identified. These systems and controls should comprise of all the relevant risk mitigation measures at the accountable institution's disposal. The mechanisms which an accountable institution may include in its risk management systems and controls should relate to the nature of particular risks. These mechanisms include the application of customer due diligence measures, the monitoring of business relationships with clients, managing delivery channels for particular products and services, structuring the features of particular products and services, etc. The potential risk management mechanisms are discussed in more detail later in this guidance.

26. The concepts of "ML/TF risk" and "ML/TF risk management" must always be contextualised within the particular business of an accountable institution, and as having an impact on the operational, line management and strategic objectives of that accountable institution.

27. The application of risk management systems and controls must be commensurate with the extent of assessed risks. This means that the extent to which particular risk management mechanisms are applied in individual cases must bear relevance to consequences of ML/TF risk in particular scenarios in relation to the likelihood and impact of the risk.

REVISED GUIDANCE NOTE 7A ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 11 of 76

Page 14

REVISED GUIDANCE NOTE 7A ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

II RISK ASSESSMENT AND UNDERSTANDING OF RISK

33. Assessing ML/TF risk requires accountable institutions to identify the ML/TF risks they may face in the context of their businesses and to analyse these with a view to understand how the identified ML/TF risks affect them. The likelihood of a risk transpiring as well as the impact of such a risk should also be considered by the accountable institution. This implies that accountable institutions must have adequate processes, proportionate to their size and complexity, to identify and assess ML/TF risks.

34. The mechanisms used in a particular accountable institution to assess ML/TF risk must be proportionate to the size and complexity of the institution. The risk assessment process therefore might be quite simple or very sophisticated depending on the size and structure of the accountable institution and the nature and range of products and services it offers.

35. The processes within accountable institutions to identify and assess ML/TF risks must take account of a range of factors which may be indicative of greater or lesser threats and vulnerabilities to money laundering and terrorist financing in a given scenario. Factors that are indicative of increased threats or vulnerabilities have been shown, based on previous experience, to lend themselves more readily to abuse by criminals.

36. Accountable institutions may have access to and may use various databases to assess the ML/TF risks relating to their clients. The context within which accountable institutions assess ML/TF risks is also influenced by ML/TF risks that are identified at a national level in all the jurisdictions where they operate. Accountable institutions should therefore determine in their risk assessment processes what weight they give to risks identified at national level in the relevant jurisdictions where they operate. The sources of information on risk indicators and

Page 14 of 76

Page 22

institutions before the amendments to the FIC Act took effect. The changes brought about by these amendments necessitated the withdrawal of many exemptions in addition to substantial amendments to the MLTFC Regulations, made under the FIC Act. Despite the withdrawal of these exemptions, accountable institutions may be guided by their content as additional factors that may indicate lower ML/TF risks in a given scenario.

Risk-rating

43. Risk-rating implies assigning different categories to different levels of risk according to a risk scale and classifying the ML/TF risks pertaining to different relationships or client engagements in terms of the assigned categories. As no two accountable institutions are the same, the level of risk and therefore the risk ratings attributed to particular business relationships or other engagements with clients may vary between accountable institutions.

44. A risk scale should be tailored according to the size of the accountable institution and consideration may be given to criteria set out in international best practice. The complexity of the risk scale should reflect the size and complexity of the accountable institution and the nature and the range of products and services it offers to its clients.

45. Accountable institutions offering a relatively homogenous range of products and services, using a limited range of delivery channels, operating in one or a few geographic location(s) or engaging with a homogenous range of clients require relatively simplistic risk scales distinguishing only between two or three risk categories. However, accountable institutions offering a more diverse range of products and services, using a wider range of delivery channels, operating in a larger number of geographic locations or engaging with a more diverse range of clients require more finely calibrated risk scales distinguishing between a larger number of risk categories.

REVISED GUIDANCE NOTE 7A ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 31

Single transaction threshold: anonymous clients and clients acting under a false or fictitious names

79. The FIC Act defines a single transaction as a transaction other than a transaction concluded in the course of a business relationship and where the value of the transaction is not less than R5 000.00 (the amount is determined by the Minister of Finance in the Regulations). This can be described as occasional or once-off business where there is no expectation on the part of the accountable institution or the client that the engagements would recur over a period of time.

80. Institutions need to determine what constitutes a single transaction in the context of their particular business for purposes of complying with the obligations of the FIC Act in as far as it applies to single transactions.

81. Accountable institutions are not required to carry out the full scope of CDD measures in respect of clients conducting single transactions below the value to be set by the Minister of Finance in the MLTFC Regulations. However, the threshold for single transactions does not apply to the obligations set out in section 20A of the FIC Act. This means that, in spite of a single transaction being below the threshold, the accountable institution is still prohibited from dealing with an anonymous client or a client with an apparent false or fictitious name. As a result, in such cases, the accountable institution should obtain and record at least some information describing the identity of the client even if that information does not have to be verified. Examples of information to be obtained could include the full name and identity number of the client and other information such as a contact number. An added step of requesting to view an identification document of the client is advisable. The manner in which the accountable institutions complies with section 20A of the FIC Act in respect of business relationships and single transactions, both below and above the threshold, must be recorded in the institution's RMCP.

REVISED GUIDANCE NOTE 7A ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 32

Establishing and verifying clients' identities

82. CDD starts with an accountable institution knowing the identity of its client. In terms of section 21 of the FIC Act an accountable institution must, in the course of establishing a business relationship or entering into a single transaction, establish and verify the identity of the client and, if applicable, the person representing the client as well as any other person on whose behalf the client is acting. The objective of this provision is that an accountable institution, after applying its processes to establish and verify a client's identity, should have confidence that it knows who the client is with sufficient certainty given the accountable institution's risk assessment pertaining to that client engagement.

83. Establishing a client's identity entails that an accountable institution obtains a range of information about the client. In most cases this information is provided by the client in response to questions being asked by the accountable institution as part of its on-boarding process (in the case of a business relationship) or its client engagement process (in the case of a single transaction). Verification of the client's identity entails that the accountable institution corroborates the person's identity information by comparing this information with information contained in documents or electronic data issued or created by reliable and independent third-party sources.

84. As indicated in Chapter 1 above, large parts of the MLTFC Regulations, (in particular Chapter 1 of the Regulations which described the methods which accountable institutions had to use to establish and verify their clients' identities) have been repealed. Accountable institutions must now choose the type of information by means of which they will establish clients' identities and also the means of verification of clients' identities. The nature and extent of verification of clients' identities must be determined taking the assessed ML/TF risks associated with the relevant business relationship or single transaction into account. These decisions as to how the accountable institution goes about the identification and verification of its clients, as well as how these measures are attenuated or

REVISED GUIDANCE NOTE 7A ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 33

intensified based on ML/TF risk, must be described in the accountable institution's RMCP.

Establishing and verifying the identities of natural persons

85. A natural person's identity can be determined by reference to a number of attributes. At the very basic level these attributes are the person's full names, date of birth and, in most cases, a unique identifying number issued by a government source (e.g. in the case of a South African citizen or resident, his/her identity number or, in the case of other natural persons, a passport number or numbers contained in asylum seeker or refugee permits, work permits, visitors' visas etc.). It is expected that these basic attributes will always be used in accountable institutions' processes to establish a natural person's identity.

86. Information about a natural person's identity may be supplemented by applying other attributes of a natural person including his/her physical appearance or other biometric information, place of birth, family circumstances, place of employment or business, residential address, contact particulars (e.g. telephone numbers, e-mail addresses, social media), contacts with the authorities (e.g. tax numbers) or with other accountable institutions. This list of examples is not exhaustive and there may be other attributes of particular persons or categories of persons which accountable institutions may include in their identification processes. The nature and amount of other attributes which an accountable institution applies in a given case is dependent on the extent to which the institution relies on the verification of the client's identity as a means to mitigate ML/TF risk in that case (see the discussion on risk mitigation in Chapter 1 above).

87. Verification methods vary and are mostly dictated by the type of information used to establish a person's identity in a given scenario. Regardless of the method applied, it is important that verification be done using information obtained from a reliable and independent third-party source and, as far as possible, the original source of the information. Accountable institutions should evaluate the adequacy

REVISED GUIDANCE NOTE 7A ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 33 of 76

Page 34

of corroboration of a person's identity attributes. This implies that institutions must determine the level of confidence they have that any particular method of corroboration provides certainty as to the relevant identity attributes. A factor that accountable institutions should bear in mind in this context, is the controls which are applied to ensure that information reflected in a particular source is accurate. Information sources created or generated by the client him/herself are not considered to be reliable and independent third-party sources.

88. Government issued or controlled sources of information such as various forms of identity documents (e.g. South African identity documents including smart card identity documents, driver's licenses, foreign identity documents, passports, asylum seeker or refugee permits, work permits, visitors' visas) and the underlying electronic databases where information evidenced in identity documents are kept, are most often the original sources of information concerning the relevant attributes and therefore provide a high level of confidence as a means to corroborate a natural person's basic identity attributes. Hence, accountable institutions should, as far as practicable, use government issued or controlled sources as the means of verification when verifying basic identity attributes. Accountable institutions should only in exceptional cases use information obtained from sources other than the original source of the information (e.g. where the original source is not available) and this should only be done in cases where accountable institutions are confident that they can adequately manage ML/TF risks.

89. Corroboration of a person's identity in relation to both basic and other identity attributes can be in documentary or electronic form. Moreover, many of a person's identity attributes accumulate over time and can be found in the person's so-called "electronic footprint". With this in mind the Centre encourages accountable institutions to make use of information in electronic form to corroborate a prospective client's information against multiple third-party data sources.

REVISED GUIDANCE NOTE 7A ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 34 of 76

Page 35

90. Accountable institutions making use of electronic data sources to verify a prospective client's identity remain responsible and accountable in their own capacity for compliance with the requirements of the FIC Act. The use of electronic data sources in the verification process does not provide automatic indemnity from regulatory action relating to the institution's compliance with these requirements. It is important therefore that accountable institutions apply due diligence in choosing electronic solutions as a means to enable verification of a prospective client's identity.

91. If accountable institutions make use of electronic data sources they should apply the same test in principle as in the case of documentary sources, i.e. that the sources should be reliable and independent third-party sources and as, far as possible, the original source of the relevant information. Accountable institutions should likewise determine the level of confidence they place in particular electronic sources of corroboratory information. Solutions which allow prospective clients to manipulate source information in any manner should not be considered credible information sources to enable verification of clients particulars.

92. A factor that may contribute to an accountable institution's confidence in corroboration based on electronic sources is the size of a person's "electronic footprint" in relation to the depth, breadth and quality of electronic information. This implies that accountable institutions would have a greater level of confidence in corroboration from electronic sources if they use information from multiple sources, and across time.

93. The means of verification and the sources of corroboration an accountable institution uses in a given case are dependent on the extent to which the institution relies on the verification of the client's identity as a means to mitigate ML/TF risk in that particular case (see the discussion on risk mitigation in Chapter 1 above).

REVISED GUIDANCE NOTE 7A ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 35 of 76

Page 38

concerning the verification of identity also apply with regard to legal persons. Accountable institutions should therefore give preference to using sources of information that are created or controlled by public sector institutions, such as the information held by the Companies and Intellectual Property Commission be used to corroborate attributes associated with the incorporation of companies.

101. In addition to establishing and verifying a legal person's identity an accountable institution also must establish the nature of the legal person's business and its ownership and control structure. Furthermore, an accountable institution must also establish who the beneficial owner of the legal person is and take reasonable steps to verify the beneficial owner's identity.

102. (Refer to public compliance communication 59)

103. (Refer to public compliance communication 59)

104. Once the accountable institution has determined who the beneficial owner of a legal person is, the institution must take reasonable steps to verify that person's identity. The remarks made above about the verification of a natural person's identity also apply in this instance. The reference to "reasonable steps" confirm that accountable institutions must apply measures that are commensurate with the assessed ML/TF risk in a given case to the verification of the beneficial owner's identity. This includes making use of information obtained by reasonably practical means while striking a balance between the accuracy of the verification required, on the one hand, and the level of effort invested in the means to obtain such verification on the other. The different measures which an accountable institution uses to verify the identities of beneficial owners of legal persons must be described in the institution's RMCP. The underlying element of this requirement is that the accountable institution must be satisfied that it knows who the beneficial owner is.

105. (Refer to public compliance communication 59)

REVISED GUIDANCE NOTE 7A ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 39

Partnerships

106. Refer to public compliance communication 59 for guidance on beneficial owners of partnerships. Partnerships are not incorporated entities and do not have legal personality. However, accountable institutions must establish the identities of partnerships who are their clients nonetheless. This means that the starting point to the identification of a partnership is to determine how the partnership is generally known. Accountable institutions must therefore establish whether a partnership is identified by a unique name or description. In addition to establishing this information, accountable institutions must take reasonable steps to verify it. This means that accountable institutions must apply measures that are commensurate with the assessed ML/TF risk relating to a partnership in a given case. Examples of information that can be used for this purpose include the partnership agreement which establishes the partnership and governs its membership and functioning, business correspondence of the partnership and promotional material advertising the partnership's business. The measures which an accountable institution uses to verify the identities of partnerships must be described in the institution's RMCP.

107. The concept of a beneficial owner in the context of a partnership encompasses all the partners in the partnership. Hence, section 21B(3) of the FIC Act requires accountable institutions, over and above the requirements of sections 21 and 21A of the FIC Act, to establish the identity of every partner in a partnership. This includes every member of a partnership en commandite (a partnership where the liability of certain partners who contribute a fixed amount and who remain undisclosed as partners, is limited according to the partnership agreement establishing and governing the partnership), an anonymous partnership (a partnership where the partners' names are not disclosed to persons who are not partners in the partnership) or any similar partnership.

108. The express references to partnerships en commandite and anonymous partnerships indicates clearly the intention that accountable institutions must establish the identity of every person who contributes to a partnership or may

REVISED GUIDANCE NOTE 7A ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 40

benefit from a partnership when they do business with a partnership. The most reliable source document indicating who the members of the partnership are, is the partnership agreement which establishes the partnership and governs its membership and functioning.

109. Section 21B(3) of the FIC Act also requires accountable institutions to establish the identity of the person who exercises executive control over the partnership, if there is such a person, indicating that accountable institutions should determine the notion of control over (in addition to benefit from) a partnership. Moreover, the provision requires accountable institutions to establish the identity of each natural person who is authorised to enter into a single transaction or establish a business relationship with the accountable institution on behalf of a partnership.

110. Accountable institutions are required to take reasonable steps to verify the names of the natural persons covered by section 21B(3) FIC Act. The remarks made above about the verification of a natural person's identity also apply in this instance. Again, here the reference to "reasonable steps" confirm that accountable institutions must apply measures to verify the relevant persons' identities that are commensurate with the assessed ML/TF risk in a given case. The different measures which an accountable institution uses to verify the identities of the relevant natural persons must be described in the institution's RMCP. The underlying element of this requirement is that the accountable institution must be satisfied that it knows the identities of the relevant natural persons.

Trusts

111. Refer to public compliance communication 59 for guidance on beneficial owners of trusts. As in the case of partnerships, trusts are not incorporated entities and do not have legal personality. All trusts in South Africa are "express trusts" – either trusts inter vivos (trusts created during the lifetime of a person) or mortis causa trusts (trusts created in terms of the will of a person and comes into effect after

REVISED GUIDANCE NOTE 7A ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 42

trust deed (the agreement which establishes the trust and governs its functioning) and the information controlled (and documentation issued) by the relevant offices of the Masters of the High Court. The measures which an accountable institution uses to verify the identities of trusts must be described in the institution's RMCP.

117. The concept of a beneficial owner in the context of a trust encompasses all the natural persons who may benefit from a trust arrangement or may control decisions in relation to the management of trust property or are otherwise associated with the trust. Hence, section 21B(4) of the FIC Act requires accountable institutions, over and above the requirements of sections 21 and 21A of the FIC Act, to establish:

- The identity of each founder;

- If a founder of the trust is a legal person or a person acting on behalf of a partnership or in pursuance of the provisions of a trust agreement, the beneficial owner of that legal person, partnership or trust

- The identities of each trustee and each natural person who purports to be authorised to enter into a single transaction or establish a business relationship with the accountable institution on behalf of the trust, and

- If a trustee is a legal person or a person acting on behalf of a partnership, the beneficial owner of the legal person or partnership

- Each natural person who purports to be authorised to enter into a single transaction or establish a business relationship with the accountable institution on behalf of the trust, whether such a person is appointed as a trustee for the trust or not

- The identities of each beneficiary referred to by name in the trust deed or other founding instrument in terms of which the trust is created; or

- If a beneficiary referred to by name in the trust instrument is a legal person or a person acting on behalf of a partnership or in pursuance of the provision of a trust agreement, the beneficial owner of the legal person, partnership or trust

REVISED GUIDANCE NOTE 7A ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 42 of 76

Page 43

- If beneficiaries are not referred to by name in the trust deed or other founding instrument in terms of which the trust is created, the particulars of how the beneficiaries of the trust are determined.

118. Accountable institutions are required to take reasonable steps to verify the names of the natural persons covered by section 21B(4) of the FIC Act. The remarks made above about the verification of a natural person's identity also apply in this instance. Again, here the reference to "reasonable steps" confirm that accountable institutions must apply measures to verify the relevant persons' identities that are commensurate with the assessed ML/TF risk in a given case. The different measures which an accountable institution uses to verify the identities of natural persons associated with trusts must be described in the institution's RMCP. The underlying element of this requirement is that the accountable institution must be satisfied that it knows the identities of the relevant natural persons. Paragraphs 82 and 85 should be applied in respect of establishing the identity of a client that is a trust that is excluded from the definition of a trust.

Impact of the Protection of Personal Information Act, 2013 on the identification and verification requirements of the FIC Act

119. The processing of personal information of clients for the purposes of the FIC Act compliance may only be done within the confines of the Protection of Personal Information Act, 2013 (the POPI Act). While the processing and further processing of personal information of a client for purposes of FIC Act requirements is allowed in terms of the (POPI Act), accountable institutions should be cautious of verifying clients' identities using third party data sources which may have obtained personal information about a client without the client's consent or knowledge.

Timing of verification

120. A client's identity and, where applicable, the identities of beneficial owners and other persons associated with a client, must be verified in the course of conducting

REVISED GUIDANCE NOTE 7A ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 44

a single transaction or entering into a business relationship. This means that an accountable institution may initiate the processes related to the conclusion of a single transaction or entering into a business relationship while it is verifying the relevant persons' identities, but the institution must complete the verification before the institution concludes a transaction in the course of the resultant business relationship or performs any act to give effect to the resultant single transaction.

121. This implies that accountable institutions may, for example, accept a mandate from a prospective client to establish a business relationship or to conclude a single transaction or take any similar preparatory steps with a view of establishing a business relationship or concluding a single transaction before completing verification of the identities of the prospective client and other relevant persons. However, in doing so accountable institutions must take care not to incur unmitigated ML/TF risks by, for example, receiving funds from a client which may have to be returned to the client before completing the verification or making funds available to a client before completing the verification.

122. The manner and processes for the identification of clients and verification of their identities described in an accountable institution's RMCP must also provide for the timing of verification and the mitigation of ML/TF risks where verification is not completed before a single transaction is conducted or a business relationship entered into.

Understanding and obtaining information on the business relationship

123. Section 21A of the FIC Act requires accountable institutions to ascertain from a prospective client what the nature and intended purpose of the business relationship will be, as well as to obtain information on the source of funds that the prospective client expects to use in the course of the business relationship. The purpose of section 21A of the FIC Act is to understand the nature of the client and the envisaged business relationship between the client and the accountable institution. By complying with this provision an accountable institution should be

REVISED GUIDANCE NOTE 7A ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 46

undertaken throughout the course of a relationship, to ensure that the transactions being conducted in the course of a business relationship are consistent with an accountable institution's knowledge of the client, and the client's business and risk profile, including, where necessary, the source of funds. It also requires accountable institutions to ensure that the information that an accountable institution has about a client is still accurate and relevant.

128. The objective of the ongoing measures is to identify activities of clients during the course of the business relationship which are not consistent with the accountable institution's knowledge of the client, or the purpose and intended nature of the business relationship, and which need to be assessed for the possibility that the institution may have grounds to report a suspicion of money laundering or terrorist financing. Accountable institutions should pay particular attention to complex or unusually large transactions and all unusual patterns of transactions which have no apparent business or lawful purpose. If the accountable institution suspects that a transaction or activity is suspicious or unusual and the institution believes that performing the ongoing due diligence requirements will disclose to the client that a report will be made in terms of section 29 of the FIC Act, the accountable institution may discontinue the ongoing due diligence process and consider making a report in terms of section 29 of the FIC Act.

129. The intensity and frequency of ongoing due diligence in respect of a given business relationship must be determined on the basis of the accountable institution's understanding of ML/TF risks associated with that relationship. An accountable institution must include, in its RMCP, the manner in which and the processes it will have in place to conduct ongoing due diligence and account monitoring of business relationships.

130. Additionally, the institution must include, in its RMCP, the manner in which it will examine complex or unusually large transactions and unusual patterns of

REVISED GUIDANCE NOTE 7A ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 46 of 76

Page 47

transactions which have no apparent business or lawful purpose as well as how it will keep the written findings of such transactions.

Doubts about veracity of previously obtained information

131. Section 21D FIC Act provides for measures that accountable institutions are required to take if doubts about the veracity or adequacy of previously obtained customer due diligence information arise later on in the relationship, or where a suspicion of money laundering or terrorism financing is formed at a later stage.

132. An accountable institution is required to repeat the steps set out in sections 21 and 21B of the FIC Act in accordance with its RMCP and to the extent that is necessary to confirm the information that is required to be verified.

133. An accountable institution must provide, in its RMCP, for the manner in which and the processes by which the institution will confirm information relating to a client when it has doubts about the veracity of previously obtained information.

Inability to conduct due diligence

134. Section 21E of the FIC Act prohibits accountable institutions from entering into or maintaining business relationships or concluding single transactions if they cannot perform the required CDD in accordance with the provisions of the Act. This provision must be applied against the background of the remarks made in paragraphs 120 to 121 above on the timing of verification.

135. Accountable institutions should take an objective approach when considering what constitutes an inability to conduct CDD in any particular situation. There may be circumstances where it is reasonable to delay discontinuing a business relationship while the institution facilitates the client's efforts to rectify the failure. The reasonableness of such a delay will vary depending on the circumstances of each case. Where a client refuses to provide requested documentation or

REVISED GUIDANCE NOTE 7A ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 49

139. Business relationships with domestic politically exposed persons or prominent influential persons are not inherently high-risk. Accountable institutions must consider each such relationship on its own merits in order to determine whether there is any reason to conclude that it brings higher risk of abuse for money laundering and terrorist financing purposes. If so, the accountable institution must apply the same requirements as for foreign politically exposed persons.

140. Business relationships with foreign politically exposed persons must always be considered high-risk. If an accountable institution finds out that it is dealing with a foreign politically exposed persons, senior management approval must be obtained to establish the business relationship. Accountable institutions must also take reasonable measures to establish the source of wealth and source of funds of the client and conduct enhanced ongoing monitoring of the business relationship. Accountable institutions are not required to verify the information about the client's source of wealth and source of funds, but will have to include this information in its client profile which will be used as the basis for enhanced ongoing monitoring. These requirements also apply to immediate family members and known close associates of such politically exposed persons and prominent influential persons.

141. The notion of senior management in an accountable institution is determined by the size, structure, and nature of the institution. The appropriate level of seniority for approval should also be determined by the level of increased risk associated with the business relationship. The senior manager approving a business relationship with a politically exposed person or prominent influential person should have sufficient seniority and oversight to take informed decisions on issues that directly impact the institution's risk profile.

142. When considering whether to approve a business relationship with a politically exposed person or prominent influential person, senior management should base their decision on the level of ML/TF risk the institution would be exposed to if it

REVISED GUIDANCE NOTE 7A ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 53

156. Accountable institutions are required to determine if they are dealing with a family member or known close associate of a politically exposed person or prominent influential person regardless of whether the politically exposed person or prominent influential person is a client of the accountable institution or not.

157. It is recognised that there is generally less information available to accountable institutions about family members and known close associates of politically exposed persons or prominent influential persons, making the determination as to whether a client (or prospective client) falls in one of these categories more challenging. Accountable institutions should refer to what is known publicly about a politically exposed person or prominent influential person's sphere of influence in order to determine if a client is a family member or known close associate of a prominent person in addition to having regard to the information about their clients which is in their possession already. To this end accountable institutions can make use of commercially available sources of information that outlines associations of politically exposed persons or prominent influential persons, monitoring of the media, credible third-party sources of information and information that may be available from other institutions within the same group which are doing business in other countries as well as applying existing processes already in place for purposes such as ongoing monitoring of business relationships.

158. The remarks made in paragraphs 150 and 152 above on the sources of information about politically exposed persons or prominent influential persons also apply in respect of family members and known close associates.

159. Accountable institutions should bear in mind that although a client might not initially (at the commencement of the business relationship) meet the definition of a politically exposed person or prominent influential person (or immediate family member or known close associate), this position might change over time. Likewise, an accountable institution may only become aware of the fact that a client is a family member or close associate of a politically exposed person or prominent

REVISED GUIDANCE NOTE 7A ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 53 of 76

Page 58

173. Accountable institutions which operate in groups of companies may implement group-wide policies on record keeping which may include centralised storage of records. Accountable institutions should bear in mind that the principles mentioned in paragraph 170 above also apply where record keeping is centralised within a group. This is particularly important if the location of the centralised storage of records is outside of South Africa. No secrecy provisions or data protection legislation should restrict the South African based accountable institution(s)' free and easy access to the relevant records, or result in the records not being readily available to the Centre or relevant South African supervisory bodies or law enforcement authorities. If restrictions exist in another jurisdiction, where records are kept which would impede such access to the records, the relevant records or copies thereof must be kept in South Africa.

174. It is advisable for accountable institutions which make use of commercial third party services, or intra-group centralised data storage to retain their records to conduct regular assessments of its service providers and to test the controls and business processes so as to provide assurance to the relevant supervisory body that the accountable institution can access and retrieve data and/or documents as envisaged under the FIC Act.

Period for which records must be kept

175. Records in relation to establishment of a business relationship referred to in section 22 of the FIC Act must be kept for at least five years from the date on which the business relationship is terminated.

176. Records of all transactions concluded referred to in section 22A must be kept for at least five years from the date on which that transaction is concluded.

177. Records of a transaction or activity which gave rise to a report contemplated in section 29 of the FIC Act must be kept for at least five years from the date on which the report was submitted to the Centre.

REVISED GUIDANCE NOTE 7A ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 58 of 76

Page 61

181C. The obligation to approve the RMCP and accountability of the board of directors, senior management, persons or group of persons with the highest authority of an accountable institution that is a legal person, cannot be delegated to other persons, group of persons, employees, committees or structures within the accountable institution. The RMCP must be approved by the board of directors, where there is no board of directors the senior management itself, where there is no senior management the person with the highest level of authority and cannot be delegated to any other persons.

Example 1: Obligation and accountability of the board cannot be delegated

The board of directors of Bank K must approve the RMCP, the board cannot delegate its obligations in terms of the FIC Act. The board may have a committee that provides advice on the suitability of the RMCP, however, the committee cannot take the decision to approve the RMCP. The obligation to approve the RMCP remains with the board.

181D. Where an accountable institution that is a legal person does not have a board of directors, the obligation for approval of the RMCP and accountability of the senior management or person or group of person(s) with the highest authority, cannot be delegated to other persons, employees, committees or structures within the accountable institution.

181E. Where the accountable institution is a sole proprietor, the obligation for approval of the RMCP and accountability of the person(s) with the highest authority cannot be delegated to another person or group of persons.

Adequacy of RMCP approval

181F. The RMCP must adequately address the full scope of section 42 of the FIC Act. The board of directors, senior management or other person(s) with the highest authority should ensure that the RMCP is adequate, suitable and effective for the accountable institution.

REVISED GUIDANCE NOTE 7A ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 66

183C The accountable institution's entity wide AML/CFT/CFP risk assessment is an important first step in ensuring that an appropriate RMCP can be developed, as it should be comprehensive enough to enable an accountable institution to clearly identify, assess and appreciate the inherent and residual ML, TF and PF risks and threats it faces. This includes taking into account the nature, size, products, service offerings, industry, client base, geographic location(s), complexity of business, delivery mechanisms, third party service providers and any other relevant factors of the accountable institution.

183D. Where the accountable institution forms part of a group, separate entity risk assessments should be conducted by each accountable institution, which should feed into the group's entity wide AML/CFT/CFP risk assessment. An accountable institution should clearly indicate in the RMCP, whether all accountable institutions that form part of a group structure have been covered when conducting the group entity wide AML/CFT/CFP risk assessment. The entity wide AML/CFT/CFP risk assessment must adequately cover all of the accountable institution's businesses, products, service offerings, technologies, delivery mechanisms, enablement processes, business processes and client base etc.

183E. The risk assessments should also be informed by published national and sector risk assessments that must be reflected in the RMCP as applicable to the business of the accountable institution.

Documentation considerations

183F. The RMCP documentation constitutes the identifiable and readily accessible information that comprehensively records the RMCP. The accountable institution must make the RMCP available to employees and also use it for training. Importantly, it would be the documentation provided to the FIC or other supervisory body, on their request, for examination purposes in terms of section 42(4) of the FIC Act.

REVISED GUIDANCE NOTE 7A ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 69

187. Accountable institutions which operate in groups of companies may implement group-wide RMCPs. In doing so, accountable institutions must ensure that the various elements of group-wide RMCPs, including internal processes, systems and controls are appropriate for the different entities or branches within the group and are adequately tailored to specific entities or branches within the group, commensurate with their individual risks, where necessary. The group-wide RMCP should indicate what elements are applicable to different entities and what is not applicable to different entities within the group and why this is so..

188. Accountable institutions situated in South Africa and operating in foreign jurisdictions should also be aware of the local AML, CFT and CFP obligations in all jurisdictions where they operate. This should be reflected in the accountable institution's RMCP document. Procedures should be in place to meet local AML, CFT and CFP obligations in each jurisdiction where an accountable institution operates. If there are variations or conflicts between the South African and the foreign jurisdiction's AML, CFT and CFP compliance requirements, and if the foreign jurisdictions requirements would result in a lower standard than in South Africa, the accountable institution must implement measures which meet the South African requirements. Unless there is a reason that prevents the accountable institution from doing so, then the accountable institution must inform the supervisory bodies, and take into consideration the level of risk in the foreign jurisdiction and apply appropriate additional measures to manage the risk.

189. It is important that the RMCP and the content of an accountable institution's documentation of their RMCP is communicated widely throughout the institution, as may be applicable, and the implementation thereof monitored consistently and audited periodically to increase the effectiveness of its implementation.

190. An accountable institution must review its RMCP at regular intervals to ensure that it remains relevant to the institution's operations and the identified risks. The

REVISED GUIDANCE NOTE 7A ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 69 of 76

Page 71

CHAPTER 5 IMPLEMENTATION OF THE UNITED NATIONS SECURITY COUNCIL RESOLUTIONS RELATING TO THE FREEZING OF ASSETS

191. The FIC Act places the responsibility to administer the targeted financial sanctions (TFS) measures adopted by the United Nations Security Council (UNSC) in its Resolutions on the Centre.

192. This inclusion of TFS measures is, inter alia, as a result of Recommendation 6 and 7 of the FATF recommendations, which requires member countries to implement the targeted financial sanctions proposed by the UNSC in the context of among other aspects, the prevention and suppression of terrorism and terrorist financing, as well as the prevention, suppression and disruption of the proliferation of weapons of mass destruction and its financing and the relevant provisions of the FIC Act aim at enabling South Africa to meet these international obligations.

193. Sanctions impose restrictions on activities that relate to particular countries, goods and services, or persons and entities. TFS measures generally restrict sanctioned persons and entities from having access to funds and property under their control and from receiving financial services in relation to such funds and property. In order for these sanctions to be given effect, the FIC Act requires accountable institutions to freeze property and transactions pursuant to financial sanctions imposed in the UNSC Resolutions. Refer to the FIC public compliance communication 44A for further guidance on targeted financial sanctions.

Mechanisms for implementation

194. Mechanisms for the implementation of the UNSC Resolutions include the publication in the Government Gazette by the Minister of Finance of a Notice of the adoption of the UNSC Resolution, and the publication of a Notice by the Director of the Centre of persons who are subject to the sanction measures (the sanctions list). These Notices may be revoked if it is considered that they are no

REVISED GUIDANCE NOTE 7A ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 71 of 76

Page 72

longer necessary to give effect to the applicable UNSC Resolutions. Otherwise, the sanctions announced in these Notices remain in effect indefinitely.

195. The Notices by the Minister of Finance and the Director are public statements and are meant to advise both sanctioned persons and entities and accountable institutions who may have them as clients or prospective clients of the relevant sanctions. If an accountable institution has a sanctioned person or entity as a client, it is allowed to draw the attention of the person or entity to the relevant sanctions notices.

196. The acquisition, collection or use of the property of persons or an entity whose names appear in the sanctions is prohibited. This includes the provision of financial services and products to those persons or entities. In short this means that accountable institutions are not allowed to transact with a sanctioned person or entity or to process transactions for such a person or entity. The status quo as at the time of the imposition of the sanction in relation property or funds of the sanctioned person or entity must be maintained and no financial services may be provided to the person or entity. The only exception to this general prohibition is in specific instances where the Minister of Finance has permitted certain financial services or dealings with property as discussed below.

197. Accountable institutions must report to the Centre, the property in the accountable institution's possession or under its control which is owned or controlled by or on behalf of a person or an entity identified in the sanctions list.

Screening

198. Accountable institutions must be able to determine whether they have a sanctioned person or entity as a client or whether a prospective client is a sanctioned person or entity in order to determine their exposure to TFS-related obligations. This implies that accountable institutions which are likely to come into contact with

REVISED GUIDANCE NOTE 7A ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Page 72 of 76

Revised Guidance Note 7A - Implementation of various aspects of the FIC Act

Relationships in

Used in the current RMCP catalogue

Document

Relationships out

Linked legislation

GUIDANCE NOTE

Disclaimer

Copyright notice

Version

Contents

GENERAL PRINCIPLES

What is money laundering?

What is financing of terrorism?

What is ML/TF risk management?

The effect of a risk-based approach

RBA for different industries and sectors

II RISK ASSESSMENT AND UNDERSTANDING OF RISK

ML/TF risk indicators

Indicators relating to delivery channels

Indicators relating to geographic locations

Indicators relating to clients

Other factors

Risk-rating

The role of a risk matrix

III RISK MITIGATION

Implementation of systems and controls for management of ML/TF risk

Where does customer due diligence fit into risk mitigation?

Risk-mitigation measures

Measures that may be applied in cases of higher ML/TF risk

De-risking and avoiding risk

Introduction

Business relationship

Single transaction threshold: anonymous clients and clients acting under a false or fictitious names

Establishing and verifying clients' identities

Establishing and verifying the identities of natural persons

Establishing the identity of legal persons, trusts and partnerships

Legal persons

Partnerships

Trusts

Impact of the Protection of Personal Information Act, 2013 on the identification and verification requirements of the FIC Act

Timing of verification

Understanding and obtaining information on the business relationship

Ongoing due diligence

Doubts about veracity of previously obtained information

Inability to conduct due diligence

General

Obligation to keep customer due diligence records

Obligation to keep transaction records

Manner in which records must be kept

Period for which records must be kept

Responsibilities relating to approval and compliance

Adequacy of RMCP approval

Example 2: Inadequate RMCP

Culture of compliance

Example 3: Approval of an RMCP without adequate application of mind

Example 4: Inadequate RMCP documentation

Example 5: Version control

Elements of an effective RMCP and the documentation of an RMCP

Risk identification

Documentation considerations

Supervisory approach

Mechanisms for implementation

Screening

Accessibility of sanctions list

Basic living expenses