South Africa

The implementation of the Risk Management and Compliance Programme (RMCP) in the field of Anti-Money Laundering (AML) in South Africa is completely controlled by the Financial Intelligence Centre Act (FICA), according to which any designatable Accountable Institution is obliged to create its own tailor-made RMCP. Instead of using strict and rigid checklists, the RMCP requires companies to take a risk-based approach to identify risks in their operations, perform the obligatory Customer Due Diligence, establish Beneficial Ownership, and perform mandatory electronic reporting through the goAML portal on suspicious activities. The whole process must be managed by senior management of the institution and is statutorily required to be headed by a Compliance Officer who has full personal responsibility for making sure that the company is performing obligatory employee training, live sanctions screening, and is the main contact person for the Financial Intelligence Centre (FIC) and sectoral supervisors such as PA/FSCA.

Accountable Institutions operating in South Africa are required by Sections 22 to 26 of the Financial Intelligence Centre Act (FICA) to retain AML documentation for at least five years, a regulation that covers CDD documentation and other transaction history records, with the five years starting when the business relationship ends. The records can be stored both electronically and manually, provided that they are kept safe, accessible, and able to be presented during audits performed by the Financial Intelligence Centre (FIC) or industry supervisory agencies. Failure to keep these records safe or to use external third-party offsite storage for these records without prior approval is considered a violation of regulation and can result in administrative penalties against the firm in form of up to R50 million, while the individuals can receive jail sentences of up to 15 years.

Accountable Institutions operating in South Africa are required by Sections 22 to 26 of the Financial Intelligence Centre Act (FICA) to retain AML documentation for at least five years, a regulation that covers CDD documentation and other transaction history records, with the five years starting when the business relationship ends. The records can be stored both electronically and manually, provided that they are kept safe, accessible, and able to be presented during audits performed by the Financial Intelligence Centre (FIC) or industry supervisory agencies. Failure to keep these records safe or to use external third-party offsite storage for these records without prior approval is considered a violation of regulation and can result in administrative penalties against the firm in the form of up to R50 million, while the individuals can receive jail sentences of up to 15 years.

In South Africa, the statutory obligation for Suspicious Transaction Reporting (STR) is rigidly outlined in Section 29 of the Financial Intelligence Centre Act (FICA), where all business entities, employees, and the Accountable Institutions are obligated to file STR on any suspicious activity or transaction that does not have any legal or obvious reason [FICA 2001 Consolidated Act]. Contrary to other FICA filings, the STR requirement is universal for all entities and individuals in South Africa, and it applies to any type of business. The reports should be submitted electronically to the Financial Intelligence Centre (FIC) through the goAML website within 15 working days after a suspicion arises [FIC Official Website]. More importantly, the legislation rigidly requires a non-disclosure provision, imposing criminal responsibility for tipping off and providing absolute statutory immunity to any reporter who acted in good faith. Deliberate non-filing of an STR and non-implementation of the STR mechanism are highly penalized by imposing administrative corporate penalties of R50 million and up to 15 years of imprisonment, respectively.

In South Africa, the legislative basis for data processing principles is defined by the Protection of Personal Information Act (POPIA), where all organizations are required to have a Legitimate Basis when processing any personal data, mostly using consent, contractual necessity, legal obligation, or legitimate interests. According to Section 18, organizations are required to present the Privacy Notice understandably at the time of collecting data by providing details on the type of data being processed, purposes of processing, and recipients of such data. In addition, POPIA grants the rights to individuals and juristic persons to request their rights regarding their data being processed as Data Subjects. Data Subjects have the right to access personal information, refuse direct marketing, as well as require that inaccurate, irrelevant, or unlawfully processed data be corrected or destroyed. The failure to comply with the transparency principles, unlawful processing, or disregarding the data subject rights is an offense that will be punished by the Information Regulator with a fine of up to R10 million or imprisonment of up to 10 years.

In South Africa, the legal requirement for handling security breaches is clearly spelt out in Section 22 of the Protection of Personal Information Act (POPIA), requiring organizations to promptly notify of unauthorized access to personal information whenever it is discovered [Protection of Personal Information Act Overview]. It means that the organization must notify both the independent Information Regulator and the Data Subjects of the potential risks, actions taken to mitigate such risks, and measures for consumer protection in clear and understandable language [Information Regulator Website]. The third parties involved (Operators) are required to promptly notify the organization of any security breach, thus placing the obligation on the primary organization to make the notification. Failure to notify the regulatory authority and consumers promptly, or even covering up the security breach, is a serious offense punishable with independent administrative fines of up to R10 million, or civil class-action lawsuits or imprisonment for a period of up to ten years.