The Prudential Authority (PA) announced on 11 September 2026 that it had imposed financial penalties totalling R35.6 million on Capitec Bank, Ninety One Assurance, and Albaraka Bank for non-compliance with the Financial Intelligence Centre Act (FICA) identified during inspections conducted between 2021 and 2023.
Although the inspections took place several years ago, the 36-month suspension periods attached to portions of the penalties commenced on different dates between June 2024 and October 2025.
Of the combined R35.6m in financial penalties, R8.44m was conditionally suspended. The PA also imposed 10 cautions not to repeat the conduct that led to the non-compliance and two reprimands.
The PA said Albaraka had co-operated with it and remediated the identified deficiencies and control weaknesses. Capitec had co-operated with the PA to remediate its deficiencies and weaknesses, while Ninety One had co-operated and indicated that it had undertaken the required remedial action.
Capitec penalised for five areas of non-compliance
Capitec Bank received five cautions and financial penalties totalling R28m, of which R5.5m was conditionally suspended for 36 months from 13 October 2025. The sanctions followed an inspection conducted in 2023.
The largest component was a R10m penalty for inadequate customer due diligence (CDD) on sampled client files, of which R3m was suspended. The PA found that Capitec had contravened section 21 of FICA, read with sections 42(1) and 42(2)(d). Section 21 requires an accountable institution, in accordance with its Risk Management and Compliance Programme (RMCP), to establish and verify the identity of a client and, where applicable, people acting for or on behalf of the client.
Capitec was penalised a further R5m for inadequate enhanced due diligence on sampled client files, of which R1m was suspended. This contravened section 21A, read with sections 42(1) and 42(2)(e). Section 21A requires an accountable institution, in accordance with its RMCP, to obtain information that enables it to determine whether future transactions will be consistent with its knowledge of the client, including information about the nature and intended purpose of the business relationship and the expected source of funds.
A third R5m penalty, also with R1m suspended, arose from inadequate ongoing due diligence on sampled client files. Section 21C, read with sections 42(1) and 42(2)(g), requires ongoing due diligence in respect of a business relationship. This includes scrutinising transactions for consistency with the institution’s knowledge of the client, its business and risk profile, and the source of funds where necessary, as well as keeping CDD information up to date.
The PA also imposed an unsuspended R3m penalty because Capitec failed to provide ongoing training to sampled employees. This contravened section 43, which requires an accountable institution to provide ongoing training on compliance with FICA and its RMCP.
The remaining R5m penalty concerned section 42, which requires an accountable institution to develop, document, maintain, and implement an RMCP. Of this penalty, R500 000 was suspended.
The PA found that Capitec had failed to obtain management approval for its business bank’s anti-money-laundering name-screening and payment-screening investigation manuals before implementing them. It also failed to provide evidence that it had documented and approved end-to-end processes for terrorist-property reporting before receiving the PA’s inspection notification letter. In addition, its RMCP did not adequately provide for the policies, procedures, standards, and controls relating to terrorist-property reporting and financial sanctions.
Earlier sanction arose from inspections in 2021 and 2022
The sanctions announced in September 2026 follow an earlier R56.25m sanction against Capitec, announced in December 2024 after inspections of its retail banking segment in 2021 and its business banking segment in 2022. Of the earlier financial penalty, R10.5m was conditionally suspended for 36 months from 30 July 2024. The PA also imposed seven cautions and one reprimand.
There is substantive overlap between the two enforcement matters. The earlier sanctions also included findings of inadequate customer, enhanced, and ongoing due diligence on sampled client files, as well as deficiencies involving the bank’s RMCP. The specific shortcomings were not identical, however.
The earlier matter additionally included late cash-threshold and suspicious-transaction reporting, and failure to attend to automated transaction-monitoring alerts within the required 48-hour period. The September 2026 sanctions included separate findings concerning ongoing employee training, terrorist-property reporting, financial-sanctions controls, and the approval of specified investigation manuals.
The inspection underlying the September 2026 sanctions was conducted in 2023, before the earlier sanctions took effect in July 2024 and were publicly announced in December 2024.
Ninety One sanctioned for due diligence and RMCP deficiencies
Ninety One Assurance received two cautions, two reprimands, and financial penalties totalling R6m, of which R2.5m was conditionally suspended for 36 months from 19 June 2025. The sanctions followed an inspection conducted in 2023.
The PA imposed a R2.5m penalty for inadequate enhanced due diligence on some of the sampled client files, of which R1.5m was suspended. It found that Ninety One had contravened section 21A of FICA, read with its RMCP. The contravention also attracted a caution and a reprimand.
A further R3.5m penalty, of which R1m was suspended, concerned section 42. The PA found that Ninety One had failed to adequately develop, document, maintain, or implement an RMCP that would enable it to identify, assess, monitor, mitigate, or manage risks associated with sanctions screening, prominent influential person screening, its business, and its clients.
Ninety One also failed to provide evidence of adequately documented and implemented policies, procedures, and controls setting out how it would comply with the relevant obligations. The PA imposed a second caution and reprimand for these deficiencies.
Ninety One said in a statement there had been no suggestion or accusation of money laundering, client misconduct, or financial harm. It said it had accepted the PA’s findings, paid the penalty in full, and did not appeal.
The company said it had addressed the identified issues, strengthened its controls, and remained committed to working constructively with regulators.
Albaraka penalised for late reports and RMCP deficiencies
Albaraka Bank received three cautions and financial penalties totalling R1.6m, of which R440 000 was conditionally suspended for 36 months from 10 June 2024. The sanctions followed an inspection conducted in 2021.
The PA imposed a R100 000 penalty because Albaraka failed to submit 232 cash threshold reports or aggregated cash threshold reports on time. Of this penalty, R40 000 was suspended. The PA found that the bank had contravened section 28 of FICA, read with regulation 24(4) of the FICA Regulations. Section 28 requires an accountable institution to report cash transactions above the prescribed threshold to the Financial Intelligence Centre (FIC) within the prescribed period.
Albaraka received a further R500 000 penalty for failing to submit 144 suspicious transaction reports or suspicious activity reports on time. The PA found that this contravened section 29 of FICA, read with regulation 24(3). Section 29 requires certain suspicious or unusual transactions and activities to be reported to the FIC when the statutory knowledge or suspicion threshold is met, within the prescribed period.
The remaining R1m penalty related to section 42, of which R400 000 was suspended. The PA found deficiencies in the documentation, approval, and implementation of Albaraka’s RMCP.
The shortcomings concerned the documentation of risk factors and their assigned weightings, events that could trigger a review or change in a customer’s risk rating, and prohibited industries, activities, and business relationships. Albaraka also failed to provide evidence that its risk assessment took account of the local geographical areas in which it operated and where its customers were based.
The bank also failed to review and approve its RMCP, related risk assessment, and other policy documents, and to implement its RMCP in relation to CDD, cash threshold reporting, and suspicious transaction reporting.
Separate R2m sanction set aside on appeal
The PA had also imposed a separate R2m financial penalty on Albaraka, of which R600 000 was conditionally suspended, as well as a caution for inadequate CDD on 12 sampled trade-finance client files. The finding concerned the bank’s failure to obtain source-of-funds information for the ultimate beneficial owners of its clients and people authorised to act on their behalf. Albaraka appealed against the finding and sanctions.
The PA initially found that the bank had contravened sections 21 or 21A, 21C, and 21G of FICA. During the appeal hearing, however, the PA confined its case to section 21C. It was common cause that FICA did not itself require Albaraka to obtain the source-of-funds information in question. The issue was whether this obligation arose from the bank’s RMCP.
The FICA Appeal Board found that the RMCP required Albaraka to establish the source of its clients’ funds, not separate sources of funds for the ultimate beneficial owners and signatories of its clients. The relevant clients were legal persons, and the funds used in the trade-finance transactions belonged to those clients rather than their beneficial owners or signatories.
The Board said provisions that could lead to sanctions must be interpreted strictly and in context. It found that the purpose of an RMCP was to comply with FICA, rather than to create a risk of self-imposed administrative sanctions. It concluded that the PA’s finding of non-compliance was ill-founded.
The Board did not decide the broader legal question of whether procedures contained in an RMCP could extend the statutory requirements and create more onerous obligations for which non-compliance could attract an administrative sanction. It said it was unnecessary to determine the point because the PA had erred in its interpretation of Albaraka’s RMCP.
The PA also argued that Albaraka had lost its right to challenge the finding because it had not objected to the interim finding during the inspection process and had subsequently amended its RMCP. The Board rejected this argument, finding that the amendment was consistent with an intention to avoid future disputes and was not necessarily a waiver of the right to challenge the PA’s interpretation.
The appeal was upheld on 1 July 2025, and the finding of non-compliance and associated sanctions were set aside. The Board also ordered that Albaraka’s appeal registration fee be repaid. Its decision related only to the separate R2m sanction and did not set aside the R1.6m in sanctions subsequently announced by the PA.
what happens to all the fines, penalties etc paid to institutions
Fines imposed by the PA and FIC are paid into the government’s National Revenue Fund.
I fully agree with compliance, however, it would be great! if our Politian’s and Municipal managers were held to the same standard as the Financial Service industry.
Ref Marc’s response: Governments National Revenue /entertainment fund.