A Practical FICA Guide for Newly Designated Accountable Institutions

The amendments to Schedule 1 of the Financial Intelligence Centre Act that took effect in December 2022 brought a wide group of businesses into the accountable institution net: legal practitioners holding trust accounts, property practitioners, motor vehicle dealers, dealers in high-value goods, crypto asset service providers, trust and company service providers and others. Many were previously reporting institutions with a single cash-threshold duty, or had no FIC obligations at all. This guide sets out what the Act now requires of them, in the order a business should tackle it.

Step 1: Confirm that you are an accountable institution

Schedule 1 lists the activities, not the industries. A motor dealer is caught when it deals in motor vehicles; a dealer in high-value goods is caught when it receives payment of R100 000 or more for a transaction in such goods. An attorney is caught as a legal practitioner as defined in the Legal Practice Act. Confirm the item that applies to you and keep a short note of the reasoning. It is the first thing an inspector asks.

Step 2: Register with the Financial Intelligence Centre

Section 43B requires every accountable institution to register with the Centre, which is done on the goAML portal. Registration gives you the organisation ID under which every report is filed, and it must be kept current when the compliance officer or the business details change. Registration is free; failing to register is an offence.

Step 3: Appoint the person responsible

Section 42A requires the board or senior management to appoint a person with sufficient seniority and authority to ensure compliance, usually called the compliance officer. In a small firm that is often a director or partner. The appointment should be minuted, and the person's duties written down.

Step 4: Write a Risk Management and Compliance Programme that describes your business

Section 42 is the heart of the Act. The RMCP must set out how the institution identifies, assesses, monitors, mitigates and manages its money laundering, terrorist financing and proliferation financing risk. It is not a template to be bought. An RMCP must describe:

• the business risk assessment (clients, products, delivery channels and geography) and the resulting client risk categories;
• the customer due diligence that will be applied at each risk level, including simplified and enhanced due diligence;
• how beneficial owners of legal persons, trusts and partnerships are identified and verified;
• screening against the targeted financial sanctions lists and the treatment of domestic and foreign prominent influential persons;
• ongoing due diligence and transaction monitoring;
• the reporting obligations and who files reports;
• record-keeping, training and the review cycle of the RMCP itself.

The FIC's Guidance Note 7 on customer due diligence is the reference text. RCC's FICA implementation service drafts the RMCP from a risk assessment of your actual business rather than a generic model.

Step 5: Put customer due diligence into practice

Section 21 requires you to establish and verify the identity of every client before a business relationship is established or a single transaction concluded, and to understand the nature and purpose of the relationship. Section 21B extends this to beneficial owners. The practical questions are: what documents do you collect, who checks them, where is the evidence filed, and what happens when a client will not comply (the Act says you may not proceed, and must consider whether to report).

Step 6: Screen and classify

Every client is screened against the United Nations Security Council sanctions lists published by the Centre. A match is prohibited and reportable. Every client is also assessed for prominent influential person status and assigned a risk rating under your RMCP. Enhanced due diligence applies to high-risk clients: senior management approval, source of funds and wealth, and closer monitoring.

Step 7: Report

Four reports matter to most newly designated institutions:

• Cash threshold reports for cash received or paid of R49 999.99 or more, within the prescribed period.
• Suspicious and unusual transaction reports under section 29, within fifteen business days of forming the suspicion, whether or not the transaction went ahead.
• Terrorist property reports under section 28A where property is linked to a listed person.
• Responses to Centre directives and requests for information within the time stated.

All reports go through goAML. Keep a record of every report and its reference number.

Step 8: Keep records for five years

Sections 22 to 24 require client identification records and transaction records to be kept for at least five years from the end of the relationship or the date of the transaction. The records may be electronic, but they must be retrievable within a reasonable time.

Step 9: Train the people who do the work

Section 43 requires ongoing training of employees on the Act and on the institution's RMCP. Attendance registers and the material used are evidence; a once-off induction is not. RCC runs FICA and RMCP awareness training with the records an inspector expects.

Step 10: Expect an inspection

The Centre and the supervisory bodies inspect under section 45B, and administrative sanctions under section 45C run to R10 million for a natural person and R50 million for a legal person. The sanctions published in recent years share a pattern: no RMCP, an RMCP that was never implemented, no screening, no training records. Each of the nine steps above closes one of those findings.