Regulatory & compliance strategy · 03
AML / FICA Risk Management and Compliance Programme
The programme section 42 of the FIC Act requires: the risk-based approach and rating methodology; customer due diligence including beneficial ownership and ongoing due diligence; enhanced measures…
The programme section 42 of the FIC Act requires: the risk-based approach and rating methodology; customer due diligence including beneficial ownership and ongoing due diligence; enhanced measures for prominent influential persons; sanctions screening; record-keeping; the reporting workflow for cash threshold, suspicious and terrorist property reports; the compliance officer’s appointment; training material; and the independent review arrangement.
Accountable institutions under Schedule 1 to the FIC Act, including the categories added in recent amendments, which caught a great many businesses that had never thought of themselves as regulated. Credit providers, for example, have been accountable institutions since 19 December 2022.
A programme bought as a template and never operationalised is worse than none: it is documentary proof of what the institution said it would do and did not. The FIC’s inspections test the doing: the training register, the screening records, the reports actually filed, not the document.
The law it sits under
The framework this work answers to.
Section 42 of the Financial Intelligence Centre Act 38 of 2001 requires every accountable institution to develop, document, maintain and implement a Risk Management and Compliance Programme. It is not a policy; the Act requires it to reflect how this institution actually manages its own money laundering, terrorist financing and proliferation financing risk. Around it sit customer due diligence, the duty to report suspicious and unusual transactions to the Financial Intelligence Centre under section 29, record keeping, and training. Schedule 1 was materially widened by the General Laws Amendment Act 22 of 2022, which brought in institutions that had never considered themselves regulated.
How the engagement runs
What you are committing to.
The risk assessment comes first and drives everything else: business relationships, products, delivery channels, jurisdictions. The RMCP is then drafted to that assessment, with the due-diligence standards, the screening and reporting procedure, the record-keeping rule and the training plan. The deliverable includes the board resolution adopting it and the register that evidences implementation.
A supervisor does not ask whether you have an RMCP. It asks for the evidence that you applied it: the risk ratings, the screening records, the training attendance, the reports made and the reasons for those not made. An RMCP with no implementation record is treated as no RMCP.
Already have a programme?
A fixed-fee review of your RMCP.
For an accountable institution that already has a risk management and compliance programme and wants to know whether it would stand up to an inspection.
We read your programme against section 42 of the FIC Act and the directives that apply to your institution, check the board or senior management approval it needs under section 42(2B), and check whether Directive 12 requires it to be submitted to the Financial Intelligence Centre and whether that has been done. You receive a written gap report, ranked by exposure, with the wording to close each gap.
R7 500, fixed and agreed in writing before the work starts, and invoiced only after delivery. If the review shows that the programme has to be rebuilt, that work is quoted separately and you decide whether to go ahead. It is on the fee menu.
Where Directive 12 applies, an updated programme approved after the annual submission period has its own deadline: under paragraph 8 it must be submitted within ten days of that approval.
Start here
Tell us the decision your organisation needs to make.
The first conversation is thirty minutes, confidential and free. You will leave it knowing which of our services you need and which you do not.