Draft PCC 125 – Format, manner of completion and submission of the 2026 RCR

FIC

Financial Intelligence Centre

DRAFT PUBLIC COMPLIANCE COMMUNICATION

DRAFT PUBLIC COMPLIANCE COMMUNICATION 125 OF 2026 (Draft PCC125)

On the format and manner of completion and submission of the 2026 Risk and Compliance Returns as contemplated by Directive 11 of 2026 by specified accountable institutions

31 March 2026

FOR CONSULTATION PURPOSES ONLY

PCC SUMMARY

This Draft Public Compliance Communication 125 of 2026 (Draft PCC 125) provides guidance to the specified accountable institutions, referred to in the Schedule to this Draft PCC 125, being in particular, items 1, 2, 3, 9, 11 (excluding banks, mutual banks, and cooperative bank credit providers), 14, 20, 21 and 22 of Schedule 1 of the Financial Intelligence Centre Act, 2001 (Act 38 of 2001) (FIC Act) on the format and manner of completion and submission of the 2026 Risk and Compliance Returns (2026 RCRs) to the Centre by these specified accountable institutions in order to implement Directive 11 of 2026 (Directive 11), as issued by the Financial Intelligence Centre (Centre).

THE AUTHORITATIVE NATURE OF GUIDANCE

The Financial Intelligence Centre (the Centre) provides the guidance contained in this PCC in terms of its statutory function in terms of section 4 (c) of the FIC Act read together with Regulation 28 of the Money Laundering and Terrorist Financing Control Regulations (the Regulations) issued in terms of the FIC Act.

Section 4(c) of the FIC Act empowers the Centre to provide guidance in relation to a number of matters concerning compliance with the obligations in terms of the FIC Act. Guidance provided by the Centre is the only form of guidance formally recognised in terms of the FIC Act and the Regulations issued in terms of the FIC Act. Accordingly, guidance provided by the Centre is authoritative in nature and must be taken into account when interpreting the provisions of the FIC Act or assessing compliance of an accountable or reporting institution with its obligations imposed on it by the FIC Act.

It is important to note that enforcement action may emanate as a result of non-compliance with the FIC Act in areas where there has been non-compliance with the guidance provided by the Centre. Where it is found that an accountable institution has not followed guidance which the Centre has issued, the institution must be able to demonstrate that it has

Draft Public Compliance Communication 125 On the format and manner of completion and submission of the 2026 Risk and Compliance Returns as contemplated by Directive 11 of 2026 by specified accountable institutions

FOR CONSULTATION PURPOSES ONLY

complied with the relevant obligation under the FIC Act in an equivalent manner, nonetheless.

DISCLAIMER

The publication of a PCC concerning any particular issue, as with other forms of guidance which the Centre provides, does not relieve the user of the guidance from the responsibility to exercise their own skill and care in relation to the users' legal position. The Centre accepts no liability for any loss suffered as a result of reliance on this publication.

COPYRIGHT NOTICE

This draft PCC is copyright. The material in a PCC may be used and reproduced in an unaltered form only for personal and non-commercial use within your institution. Apart from any use permitted under the Copyright Act, 1978 (Act 98 of 1978) all other rights are reserved.

OBJECTIVE

The objective of this Draft PCC 125 is to provide practical guidance to the specified accountable institutions on how to submit in a timely manner the 2026 RCRs to the Centre, in accordance with Draft Directive 11, which is envisaged to be gazetted as Directive 11 of 2026 (Directive 11) on Tuesday, 31 March 2026.

Draft Public Compliance Communication 125 On the format and manner of completion and submission of the 2026 Risk and Compliance Returns as contemplated by Directive 11 of 2026 by specified accountable institutions

FOR CONSULTATION PURPOSES ONLY

1. INTRODUCTION

1.1. Draft PCC 125 provides guidance on the format and manner of completion and the manner and process of submission of the 2026 RCRs to the Centre by the specified accountable institutions in order to implement Directive 11.

1.2. Directive 11 mandates the specified accountable institutions as designated in Schedule 1 of the Financial Intelligence Centre Act, 2001 (Act 38 of 2001) (FIC Act), to complete the 2026 RCR questionnaire relevant to their operations, based on their understanding of money laundering, terrorist financing, and proliferation financing (ML, TF and PF) risks, as well as their implementation of current risk-based controls, in accordance with the requirements of the FIC Act.

2. GENERAL TERMS AND APPLICATION

2.1. Directive 11 applies to all specified accountable institutions referred to in items 1, 2, 3, 9, 11 (excluding banks, mutual banks, and co-operative bank credit providers), 14, 20, 21, and 22 of Schedule 1 of the FIC Act.

2.2. A separate 2026 RCR must be submitted to the Centre by each specified accountable institution, and each 2026 RCR submission should reflect the specified accountable institution's unique organisation identity number (Org ID).

2.3. The requirement to submit a 2026 RCR to the Centre applies to all specified accountable institutions, whether they have branch office networks or no branches. The branches of such accountable institutions do not have to submit a separate RCR.

2.4. The specified accountable institutions must take into account the activities of all its branches and consolidate the information into the single RCR 2026 response,

Draft Public Compliance Communication 125 On the format and manner of completion and submission of the 2026 Risk and Compliance Returns as contemplated by Directive 11 of 2026 by specified accountable institutions

FOR CONSULTATION PURPOSES ONLY

it submits to the Centre. This means that the activities of the head office and all other branch offices of a specified accountable institution, will be included in the single 2026 RCR that must be submitted by the specified accountable institution for each designated FIC Act Schedule item category it falls within.

2.5. Accordingly, the specified accountable institution is only required to submit a single consolidated 2026 RCR, covering the business activity of its head office and all branch offices, as a consolidated as commercial entity on an enterprise-wide basis.

The exception – A branch office is structured as a separate legal entity

2.6. The guidance in paragraph does 2.5 above does not apply, in circumstances where a branch office or certain branch offices of an accountable institution, are structured as a separate partnership or incorporated legal person or juristic person, in their own right separate from, even though associated to, the specified accountable institution. Such separate partnership, incorporated legal person or juristic partnership, constitutes a unique accountable institution, which should be registered separately with the Centre, and have its own unique Org ID, as an accountable institution.

2.7. The consequence is that such partnership, legal person or juristic person, as a separate accountable institution, should have registered separately as an accountable institution in its own right, due to its legal structure, under a particular business activity as designated in an item under Schedule 1. Such specified accountable institution will also be required to submit a single 2026 RCR to the Centre in respect of all the branch offices falling within its legal structure, as a specified accountable institution for each designated FIC Act Schedule item category it falls within.

Draft Public Compliance Communication 125 On the format and manner of completion and submission of the 2026 Risk and Compliance Returns as contemplated by Directive 11 of 2026 by specified accountable institutions

Page 6 of 16

FOR CONSULTATION PURPOSES ONLY

2.8. In summation, where several branch offices are structured is a separate juristic entity, from its associate accountable institution, that structure constitutes is a separate accountable institution in its own right, which must register as an accountable institution and submit a 2026 RCR to the Centre.

A Franchise network with of accountable institutions

2.9. A Franchise network with of accountable institutions, which are separate legal entities from each other, is not a branch office network, and are all required to register separately as accountable institutions with the Centre on the goAML platform and must each submit separate 2026 RCRs under their designated item in Schedule 1 to the Centre.

Example – Accountable Institutions operating under common name and brand where one institution is an accountable institution in its own right

Estate Agent A permits Estate Agent B to operate under a franchise arrangement as a business entity under Estate Agent A's name and brand.

Estate Agent B is a separate juristic entity and therefore operates as an accountable institution in its own right for its own account.

In this scenario both Estate Agent A and Estate Agent B must register separately as accountable institutions with the Centre on the goAML platform and must submit separate 2026 RCRs under their designated item in Schedule 1 to the Centre.

More than one 2026 RCR may be due by a specified accountable institution

2.10. Importantly the Centre reminds all specified accountable institutions that where they conduct business activities across more than one FIC Act Schedule 1 item, they must submit a separate 2026 RCR to the Centre, for each business activity

Draft Public Compliance Communication 125 On the format and manner of completion and submission of the 2026 Risk and Compliance Returns as contemplated by Directive 11 of 2026 by specified accountable institutions

FOR CONSULTATION PURPOSES ONLY

that specified accountable institution conducts as separate designated items of FIC Act Schedule 1.

Example – The Legal practitioner that conducts business across more than one FIC Act Schedule 1 Item

The legal practitioner which provides general legal services, which must then register with the Centre as an item 1 designated entity as a legal practitioner under Schedule 1 of the FIC Act (Schedule 1). This is normally its primary registration with the Centre.

The designation of items in Schedule 1 is based on business activity vulnerable to money laundering abuse, and therefore a functional activity approach is enshrined in Schedule 1. An accountable institution that conducts the functional business activity within a designated item must register with the Centre in respect of that business activity.

Accordingly, where the legal practitioner performs legal services in relation to such designated business activity under Schedule 1, that legal practitioner must in addition then register separately with the Centre under that designated item, such as when the legal practitioner provides trust services and company services to their clients. In that scenario, the legal practitioners must register with the Centre as under:

- Item 2 of Schedule 1, as the provider of trust services, as contemplated in Schedule 1 (the second registration); and

- Item 2 of Schedule 1, as the provider of company services as contemplated in Schedule 1 (the third registration); and

This means that potentially, a legal practitioner should have three separate and unique registration profiles on the goAML registration and reporting platform of the Centre, which will result in the legal practitioner possessing three distinct and unique goAML Org IDs, with the Centre.

The consequence is that such legal practitioner for each of the three separate accountable institution registrations it holds, must three separate 2026 RCRs, one for each of the three designated item profiles under Schedule 1, to the Centre.

Draft Public Compliance Communication 125 On the format and manner of completion and submission of the 2026 Risk and Compliance Returns as contemplated by Directive 11 of 2026 by specified accountable institutions

FOR CONSULTATION PURPOSES ONLY

2.11. Directive 11 does not apply to a bank, mutual bank, and a co-operative bank that carries on business of a credit provider as contemplated in item 11 of Schedule 1 of the FIC Act.

Manner of preparation

2.12. Specified accountable institutions falling under Items 1, 2, 3, and 9 of Schedule 1 to the FIC Act, must submit the completed questionnaire in the 2026 RCR in a manner that complies with the RCR data information period which covers three separate years from 1 April 2023 to 31 March 2026, both dates inclusive.

2.13. The specified accountable institution is required to gather, collate and complete the requested RCR data information as stated in paragraph 2.6, in order to submit in the same 2026 RCR form under three separate and distinct periods, as follows:

2.13.1. 1 April 2023 to 31 March 2024 (year 1);

2.13.2. 1 April 2024 to 31 March 2025 (year 2); and

2.13.3. 1 April 2025 to 31 March 2026 (year 3).

Importantly it is only after the accountable institution has completed the 2026 RCR with the required RCR data information separately for each of these three years, may the accountable institution, submit the 2026 RCR to the Centre.

2.14. Specified accountable institutions falling under Items 11 (excluding banks, mutual banks, and co-operative bank credit providers), 14, 20, 21 and 22 of Schedule 1 to the FIC Act, must submit the completed questionnaire in the 2026 RCR in a manner that complies with the RCR data information period which covers three separate years from 1 July 2023 to 31 March 2026, both dates inclusive.

Draft Public Compliance Communication 125 On the format and manner of completion and submission of the 2026 Risk and Compliance Returns as contemplated by Directive 11 of 2026 by specified accountable institutions

Draft Public Compliance Communication 125 On the format and manner of completion and submission of the 2026 Risk and Compliance Returns as contemplated by Directive 11 of 2026 by specified accountable institutions

FOR CONSULTATION PURPOSES ONLY

2.15. The specified accountable institution is required to gather, collate and complete the requested RCR data information as stated in paragraph 2.8, in order to submit in the same 2026 RCR form under three separate and distinct periods, as follows:

2.15.1. 1 July 2023 to 31 March 2024 (period 1);

2.15.2. 1 April 2024 to 31 March 2025 (period 2); and

2.15.3. 1 April 2025 to 31 March 2026 (period 3).

Importantly it is only after the accountable institution has completed the 2026 RCR with the required RCR data information separately for each of these three periods, may the accountable institution, submit the 2026 RCR to the Centre.

3. ADHERENCE TO THE SCHEDULE GOVERNING THE 2026 RCR SUBMISSION

3.1. The Centre envisages the commencement date of Directive 11 will be on Wednesday, 1 April 2026.

3.2. This Directive 11 commencement date allows the Centre to provide access to the 2026 RCR submission platform, goAML, for the purposes of downloading a sample template of the questionnaire contained in the 2026 RCR, from Wednesday, 1 April 2026.

3.3. Accordingly, specified accountable institutions may access the website of the Centre using this link to download a sample template of the questionnaire contained in the 2026 RCR.

Page 9 of 16

Draft Public Compliance Communication 125 On the format and manner of completion and submission of the 2026 Risk and Compliance Returns as contemplated by Directive 11 of 2026 by specified accountable institutions

FOR CONSULTATION PURPOSES ONLY

3.4. It is important to note that the Centre will only make the goAML platform available for the submission of the 2026 RCR to the Centre, from the commencement date for the submission of the 2026 RCR, being on Monday, 4 May 2026.

3.5. It is critical to enable an adequate, correct and timely adherence to the requirements of Directive 11 and the adequate, timely and correct completion and submission of the 2026 RCRs that the specified accountable institutions strictly adhere to the Schedule annexed to this Draft PCC125.

3.6. The annexed Schedule below conveys the specified Schedule 1 designated items required to the submit the 2026 RCR, the applicable RCR Data Information periods, and the RCR submission Commencement and Due Dates.

4. METHOD FOR SUBMITTING RISK AND COMPLIANCE RETURNS

4.4. The Centre's website hosts an access link to the online 2026 RCR submission platform, which is contained in the goAML registration and reporting platform of the Centre.

4.5. Only those specified accountable institutions that have successfully registered with the Centre on the FIC registration and reporting platform, and who have received an organisation identity number (Org ID), may submit an online 2026 RCR to the Centre.

4.6. The Org ID is a prerequisite for the submission of the 2026 RCR and must be first obtained from the Centre by registering with the Centre on goAML or updating the existing registration information of that entity and its users, on goAML.

Page 10 of 16

FOR CONSULTATION PURPOSES ONLY

4.7. Specified accountable institutions will not be able to submit the online 2026 RCR if they are not registered with the Centre and do not have an Org ID. The Centre strongly urges all **unregistered specified accountable institutions** that are not yet registered with the Centre to immediately register without delay to obtain an Org ID on the goAML platform, which Org ID is a pre-requisite requirement for the online submission of the 2026 RCR to the Centre.

4.8. Specified accountable institutions are urged to immediately access the website of the Centre using *this link* to download a sample template of the questionnaire contained in the 2026 RCR. The downloaded sample template should be studied to understand the questions posed, and the type of RCR data information the specified accountable institution should gather and collate for each specified RCR data information year or period, as applicable to it.

4.9. The downloaded sample template should enable an orderly preparation of the requested RCR data information sets upfront. It is recommended that the entity complete in draft the RCR data information at hand, against each question for each RCR information year or period, to ease the time taken for the completion of the 2026 RCR form.

4.10. The Centre recommends that only once the specified accountable institution has all the required RCR data information written down on the downloaded sample template or at hand, should the specified accountable institution proceed to transposing and completing the 2026 RCR form moving from the first year or period, to the third year or period.

4.11. Once the specified accountable institution has collated and has readily available or at hand the required RCR data information, that accountable institutions must

Draft Public Compliance Communication 125 On the format and manner of completion and submission of the 2026 Risk and Compliance Returns as contemplated by Directive 11 of 2026 by specified accountable institutions

Draft Public Compliance Communication 125 On the format and manner of completion and submission of the 2026 Risk and Compliance Returns as contemplated by Directive 11 of 2026 by specified accountable institutions

FOR CONSULTATION PURPOSES ONLY

access the online 2026 RCR form, through the Centre's online RCR submission platform, goAML, from Monday, 4 May 2026.

4.12. The specified accountable institution should then proceed to complete in the online 2026 RCR all the questions for each year or period contained in the questionnaire of the 2026 RCRs, and only once each year or period is completed in the 2026 RCR, should the completed 2026 RCR be submitted to the Centre.

4.13. The compliance officer assisted by the compliance function of an accountable institution must submit of the 2026 RCR. However, the board of directors, senior manager or person with the highest authority in the accountable institutions remain responsible for ensuring compliance with the obligation to complete and submit the 2026 RCR.

4.14. Upon logging onto the 2026 RCR platform, users will be prompted to enter their same registration and reporting platform credentials to access the system. Importantly, the sharing of user credentials is prohibited in terms of Directive 2 of 2014.

4.15. The specified accountable institutions must submit a separate 2026 RCR for each Org ID held by that accountable institution, in respect of each designated item that accountable institution falls under (which should give rise to a unique Org ID for each designated item category) in Schedule 1 of the FIC Act.

4.16. Only one RCR submission is permitted by the specified accountable institution for each Org ID held, irrespective of the number of branches or subsidiaries that specified accountable institution may register with or intend to register with the Centre.

Page 12 of 16

Draft Public Compliance Communication 125 On the format and manner of completion and submission of the 2026 Risk and Compliance Returns as contemplated by Directive 11 of 2026 by specified accountable institutions

FOR CONSULTATION PURPOSES ONLY

4.17. Accountable Institutions must accurately capture and state their Org ID number in the RCR. In the Org ID field, only the FIC-generated Org ID is to be captured, and not a personal ID number nor the company registration number.

4.18. It is important to note that, while completing online the questionnaire of the 2026 RCR, the completed data may be saved several times and at any stage prior to the final submission of the 2026 RCR. This is a crucial step which the Centre urges the specified accountable institutions to apply, as enable users to log in and complete the questionnaire of the 2026 RCR, in several online sessions if they are not able to complete the questionnaire of the 2026 RCR, in one session.

4.19. Upon successful submission of the completed 2026 RCR to the Centre, the goAML system will display the completed questionnaire of the 2026 RCR as submitted.

4.20. It remains the specified accountable institution's obligation to ensure the 2026 RCR data information submission is adequate, accurate and complete, before submission on the goAML system, as changes to the submitted 2026 RCR cannot be made after submission.

4.21. The specified accountable institution will be able to download a copy of their completed 2026 RCR after submission, for record keeping purposes.

4.22. It is important to note that once submitted, the 2026 RCRs may not be retracted, or withdrawn on goAML. Where an accountable institution finds that its 2026 RCR submission is inaccurate, it must submit a written compliance query to the Centre, advising that it has submitted an incorrect 2026 RCR.

Page 13 of 16

Draft Public Compliance Communication 125 On the format and manner of completion and submission of the 2026 Risk and Compliance Returns as contemplated by Directive 11 of 2026 by specified accountable institutions

FOR CONSULTATION PURPOSES ONLY

4.23. Specified accountable institutions must ensure that they review all answers provided to the questions for adequateness, accuracy or correctness, and correct the errors, before they finally submit the 2026 RCR to the Centre.

4.24. Non-compliance with Directive 11 in all respects may result in administrative sanctions being applied by the Centre on the specified accountable institution.

5. CONSULTATION

5.4. Before issuing guidance to accountable institutions, supervisory bodies and other persons regarding their performance, duties, and obligations in terms of the FIC Act or any directive made in terms of the FIC Act, the Centre must in accordance with section 42B of the FIC Act:

5.4.1. Publish a draft of the guidance by appropriate means of publication and invite submissions.

5.4.2. Consider submissions received.

5.5. Commentators are invited to Comment on the Draft PCC 125 by submitting written comments through this online submission link only.

5.6. Any questions or requests relating to this draft PCC 125 may be sent to the Centre only at consult@fic.gov.za.

5.7. Submissions on Draft PCC 125 must reach the Centre by close of business on Friday, 24 April 2026.

Page 14 of 16

FOR CONSULTATION PURPOSES ONLY

6. COMMUNICATION WITH THE CENTRE

6.4. The Centre has a dedicated compliance contact centre geared to assist accountable institutions to understand their registration obligations in terms of the FIC Act. Please call the compliance contact centre number on (012) 641 6000 and select option 1.

6.5. Compliance Queries may also be submitted online by visiting the Centre’s website and clicking on: https://www.fic.gov.za/compliance-queries/.

Issued By:

The Acting Director

Financial Intelligence Centre

31 March 2026

Draft Public Compliance Communication 125 On the format and manner of completion and submission of the 2026 Risk and Compliance Returns as contemplated by Directive 11 of 2026 by specified accountable institutions

FOR CONSULTATION PURPOSES ONLY

SCHEDULE

(IN RESPECT OF DIRECTIVE 11 OF 2026)

[tbl-0.html](tbl-0.html)

Draft Public Compliance Communication 125 On the format and manner of completion and submission of the 2026 Risk and Compliance Returns as contemplated by Directive 11 of 2026 by specified accountable institutions