South Africa

The implementation of the Risk Management and Compliance Programme (RMCP) in the field of Anti-Money Laundering (AML) in South Africa is completely controlled by the Financial Intelligence Centre Act (FICA), according to which any designatable Accountable Institution is obliged to create its own tailor-made RMCP. Instead of using strict and rigid checklists, the RMCP requires companies to take a risk-based approach to identify risks in their operations, perform the obligatory Customer Due Diligence, establish Beneficial Ownership, and perform mandatory electronic reporting through the goAML portal on suspicious activities. The whole process must be managed by senior management of the institution and is statutorily required to be headed by a Compliance Officer who has full personal responsibility for making sure that the company is performing obligatory employee training, live sanctions screening, and is the main contact person for the Financial Intelligence Centre (FIC) and sectoral supervisors such as PA/FSCA.

Accountable Institutions operating in South Africa are required by Sections 22 to 26 of the Financial Intelligence Centre Act (FICA) to retain AML documentation for at least five years, a regulation that covers CDD documentation and other transaction history records, with the five years starting when the business relationship ends. The records can be stored both electronically and manually, provided that they are kept safe, accessible, and able to be presented during audits performed by the Financial Intelligence Centre (FIC) or industry supervisory agencies. Failure to keep these records safe or to use external third-party offsite storage for these records without prior approval is considered a violation of regulation and can result in administrative penalties against the firm in form of up to R50 million, while the individuals can receive jail sentences of up to 15 years.

Accountable Institutions operating in South Africa are required by Sections 22 to 26 of the Financial Intelligence Centre Act (FICA) to retain AML documentation for at least five years, a regulation that covers CDD documentation and other transaction history records, with the five years starting when the business relationship ends. The records can be stored both electronically and manually, provided that they are kept safe, accessible, and able to be presented during audits performed by the Financial Intelligence Centre (FIC) or industry supervisory agencies. Failure to keep these records safe or to use external third-party offsite storage for these records without prior approval is considered a violation of regulation and can result in administrative penalties against the firm in the form of up to R50 million, while the individuals can receive jail sentences of up to 15 years.

In South Africa, the statutory obligation for Suspicious Transaction Reporting (STR) is rigidly outlined in Section 29 of the Financial Intelligence Centre Act (FICA), where all business entities, employees, and the Accountable Institutions are obligated to file STR on any suspicious activity or transaction that does not have any legal or obvious reason [FICA 2001 Consolidated Act]. Contrary to other FICA filings, the STR requirement is universal for all entities and individuals in South Africa, and it applies to any type of business. The reports should be submitted electronically to the Financial Intelligence Centre (FIC) through the goAML website within 15 working days after a suspicion arises [FIC Official Website]. More importantly, the legislation rigidly requires a non-disclosure provision, imposing criminal responsibility for tipping off and providing absolute statutory immunity to any reporter who acted in good faith. Deliberate non-filing of an STR and non-implementation of the STR mechanism are highly penalized by imposing administrative corporate penalties of R50 million and up to 15 years of imprisonment, respectively.