Recent enforcement action by both the FSCA and the Prudential Authority confirms that FICA
compliance remains firmly on the regulatory agenda. There is no indication that supervisory
authorities are easing their scrutiny and institutional size appears to make little difference.
On 9 September 2026, the FSCA announced penalties against three smaller financial services
providers:
- Sithembile Holdings: R100,000;
- Mbuli Finance: R220,000; and
- Mmela Financial Services: R450,000, of which R225,000 was suspended.
Only days later, the Prudential Authority announced penalties of R28 million against Capitec Bank
and R6 million against Ninety One Assurance Limited. Portions of these penalties were also
suspended, subject to the institutions meeting the applicable conditions.
The message is clear: FICA enforcement is not limited to either smaller FSPs or large financial
institutions. Smaller businesses are not excused because they have fewer employees, clients or
resources. Similarly, larger institutions are not protected by extensive compliance teams,
sophisticated systems or detailed policies.
The same problem areas continue to appear in enforcement cases: - Incomplete or inadequate Risk Management and Compliance Programmes;
- Insufficient customer- and enhanced due diligence;
- Inadequate beneficial-ownership control measures;
- Weaknesses in ongoing due diligence and transaction monitoring;
- Inadequate targeted financial sanctions and prominent-person screening;
- Insufficient employee screening and FICA training;
- Deficiencies in recordkeeping and FIC registration; and
- Failure to respond fully and timeously to regulatory requests.
Importantly, having an RMCP on file is not enough. The regulator will test whether the controls
described in the document are actually being implemented.
In order to make sure FSPs have an audit-ready FIC RMCP, ensure the following;
FSPs should review their RMCPs and supporting evidence to ensure that: - The RMCP reflects the actual business. It must address the FSP’s clients, products, services,
delivery channels, geographical exposure, payment methods and outsourcing
arrangements. A generic template that does not reflect how the business operates will not
be sufficient. - Business and client risks are properly assessed. The methodology must explain how moneylaundering, terrorist-financing and proliferation-financing risks are identified and how clients
are classified as low, medium or high risk. - Customer due diligence is practical and complete. The RMCP must explain how natural
persons, legal entities, trusts, partnerships, representatives and beneficial owners are
identified and verified. - Higher-risk clients receive enhanced due diligence. The procedures should address source of
funds, source of wealth, the purpose of the relationship, senior-management approval and
enhanced monitoring where applicable. - Screening controls are clearly documented. Clients, beneficial owners, authorised persons
and relevant employees must be screened against targeted financial sanctions lists. The
RMCP should also explain how possible matches are investigated, escalated, reported and
recorded. - Suspicious activity is properly escalated. Employees must know how to raise concerns, who
makes the reporting decision and how suspicious transaction reports and related
investigations are recorded without tipping off the client. - Employees are screened and trained. Screening should include directors, key individuals,
compliance personnel and staff occupying higher-risk roles. Training must be relevant,
regular and supported by attendance and assessment records. - Implementation can be proved. The FSP should be able to produce client-risk assessments,
screening results, beneficial-ownership records, monitoring evidence, training records,
management approvals and reporting registers. - The RMCP should be signed off by the Board of Directors.
The key question is therefore not simply, “Do we have an RMCP?” It is: “Can we prove that we
consistently do what our RMCP says we do?”
The latest penalties show that regulators will continue asking that question, regardless of the
institution’s size
Written by Wayne Naude
Compliance Officer (under supervision)
ComplyEeze
