The Financial Intelligence Centre (FIC) has issued Directive 12, requiring specified accountable institutions to submit the documentation describing their Risk Management and Compliance Programmes (RMCPs) annually.
The FIC published Directive 12 in Government Gazette No. 55337 on 4 September 2026, and it takes effect on 7 September. The first submissions are due in October.
The FIC published the draft Directive 12 for comment on 31 July 2026, with submissions closing on 21 August. It received comments from affected institutions, industry associations, consultants, and other stakeholders, and said these were considered in finalising the directive.
Read: FIC proposes annual RMCP submissions for selected institutions
Directive 12 sets out which institutions must submit their RMCPs and the applicable deadlines.
The FIC’s accompanying Consultation Feedback Note provides important guidance on how the requirement will apply in practice. It addresses, among other things, branch networks, institutions registered under more than one item in Schedule 1 to the Financial Intelligence Centre Act (FICA), non-bank institutions that are part of banking groups, and the relationship between RMCP submissions and Risk and Compliance Returns (RCRs).
The feedback note also indicates that the annual submission requirement could eventually be extended to accountable institutions not currently covered by Directive 12.
The FIC said it is discussing with regulatory bodies an efficient and practical approach to the ongoing submission of RMCPs by other types of accountable institutions.
“There is a possibility that further directives will be issued, which will require all other accountable institutions, including authorised dealers and financial institutions, to submit RMCPs in a similar manner,” it said in response to a comment.
First submissions due in October
Directive 12 applies to the following accountable institutions listed in Schedule 1 to FICA:
- Item 1: Legal practitioners
- Item 2: Certain trust and company service providers
- Item 3: Estate agents
- Item 9: Gambling institutions
- Item 11: Credit providers, excluding banks, mutual banks, and co-operative bank credit providers
- Item 14: The South African Postbank Limited
- Item 20: High-value goods dealers
- Item 21: The South African Mint Company (RF) (Pty) Ltd
- Item 22: Crypto asset service providers (CASPs)
The submission deadlines are as follows:
The final deadlines differ significantly from those proposed in the draft directive.
The draft would have required institutions listed under items 1, 2, 3, 9, and 11 to submit their RMCPs by 30 September annually. The final directive moves the deadline for items 1, 2, 9, and 11 to 9 October, while estate agents under item 3 have been moved into the group whose submissions are due on 31 October.
The draft also contained an inconsistency concerning items 14, 20, 21, and 22. It specified a first deadline of 31 October 2026 but referred to 30 October as the annual deadline thereafter. The draft Consultation Note and Web Notice referred instead to 31 October annually. The final directive resolves the inconsistency by setting 31 October as both the first deadline and the recurring annual deadline for these institutions.
Commentators requested a transition period of between three and six months before the first submissions became due. The FIC did not accept the request. It said the obligation to develop and approve an RMCP is not new, and Directive 12 does not create an “extensive new obligation”. It therefore considered it reasonable to require institutions to submit their RMCPs by the deadlines set out in the directive.
Directive 12 requires an affected institution to make available to the FIC a copy of the documentation describing its RMCP. The submission must be made through the FIC’s registration and reporting platform, goAML.
The FIC said the institution should submit the RMCP documentation approved by its board of directors, senior management, or the person with the highest authority. It will publish a user guide setting out the practical steps for uploading RMCPs, including the required naming convention and file format.
Annual submission is not the only obligation
The annual submission should not be regarded as a once-a-year exercise after which an institution has no further obligations to provide its RMCP to the FIC.
An accountable institution subject to Directive 12 must submit its RMCP within 90 days of commencing business.
An institution may also have to make a further submission if it amends its RMCP after the applicable annual submission period.
Where an affected institution updates and approves its RMCP after that period, the final directive requires it to submit the updated and approved RMCP within 10 days of approval.
Commentators proposed that this interim submission requirement should apply only to material amendments. They argued that technical, administrative, operational, and other non-material changes could be incorporated into the next annual submission. The FIC did not accept this proposed limitation.
It said that where amendments are approved by the board, senior management, or the person with the highest authority, the amended RMCP must be submitted. The FIC declined to advise institutions on what constitutes a material, technical, or non-material amendment.
Commentators also requested that the period for submitting an amended RMCP be extended to 90 business days. The FIC rejected the request, saying 10 days is reasonable because the amended RMCP will already have been approved.
However, there is a wording discrepancy between the draft and the final directive. The draft allowed 10 business days, whereas the final directive specifies 10 days. The feedback note says the wording in the draft remains, but it also refers to a period of 10 days. Moonstone has asked the FIC to clarify the discrepancy. In the meantime, institutions should note that the final, legally operative directive specifies 10 days.
The requirement applies per accountable institution and registration
The consultation process clarified how submissions should work where an accountable institution operates through a branch network.
Where an institution has numerous branches that are not accountable institutions in their own right, one RMCP submission is required for the accountable institution. Separate submissions are not required for its head office and each branch.
The position differs where branches are standalone accountable institutions. Each branch that is an accountable institution in its own right must submit its own RMCP under Directive 12.
A separate principle applies where an institution is registered under more than one Schedule 1 item: an RMCP must be submitted for each separate item registration. Therefore, although an institution may make one submission covering a branch network that consists of a single accountable institution, it may have to make more than one submission if it has multiple item registrations.
Non-bank institutions within banking groups
Directive 12 expressly excludes banks, mutual banks, and co-operative bank credit providers from its application under item 11. The feedback note says the current exception applies to item 11 accountable institutions that form part of a bank, mutual bank, or co-operative bank group.
However, being part of a banking group does not, in itself, exempt other types of accountable institutions from Directive 12. The FIC identified high-value goods dealers, CASPs, and trust and company service providers within banking groups as examples of institutions that remain required to submit their RMCPs.
The FIC declined to extend the exclusion to all item 11 institutions supervised by the Prudential Authority. In response to a submission concerning a life insurer that was also registered as a credit provider, the FIC confirmed that item 11 accountable institutions must submit their RMCPs unless they fall within the specified banking-group exception.
Where an institution operates under a group-wide RMCP framework, it must submit extracts from the relevant group-wide RMCP as annexures to its RMCP submission.
RMCP submissions are separate from RCRs
The FIC has emphasised that institutions must not confuse the RMCP submission required by Directive 12 with their RCR obligations.
The feedback note distinguishes between:
- RCRs submitted under Directives 6 and 7;
- RCRs submitted under Directive 11; and
- RMCPs submitted under Directive 12.
These are separate obligations and use different submission systems. RCRs under Directives 6 and 7 are submitted through a Microsoft Forms link, while Directive 11 uses the RCR system. RMCPs under Directive 12 must be submitted through goAML.
Submitting an RMCP under Directive 12 therefore does not replace any applicable obligation to submit an RCR. The FIC warns that accountable institutions that submit their RCRs or RMCPs incorrectly may face administrative penalties.
Uploading an RMCP does not mean the FIC has approved it
A successful goAML submission should not be interpreted as confirmation that the FIC has assessed or approved the adequacy of the institution’s RMCP.
According to the feedback note, a successful submission indicates only that the RMCP attachments were uploaded in the correct format and using the correct naming convention. It does not relieve the institution of its obligations under FICA, including its obligations under section 42.
The FIC and other supervisory bodies may access submitted RMCPs from time to time as part of their supervisory functions. The feedback note says these functions may include guidance, monitoring, inspections, and enforcement.
Non-compliance may result in sanctions
Directive 12 provides that an accountable institution that fails to comply with any of its provisions is non-compliant and subject to an administrative sanction under the relevant provisions of FICA.
Institutions covered by Directive 12 will need to identify the deadline applicable to each of their Schedule 1 registrations, determine whether separate submissions are required for standalone accountable institutions or separate item registrations, and submit their approved RMCP documentation through goAML in accordance with the forthcoming user guide.
The final directive also requires institutions to accommodate the submission of an amended and approved RMCP within the specified 10-day period.
