Risk-based inspections of accountable institutions identified recurring deficiencies involving Risk Management and Compliance Programmes (RMCPs), customer due diligence, registration information, and targeted financial sanctions screening.
The Financial Intelligence Centre (FIC) said in its 2025/26 annual report, released on 30 September 2026, that these were the main deficiencies identified in 549 inspection reports issued to designated non-financial businesses and professions (DNFBPs), credit providers, and crypto asset service providers (CASPs).
Because the inspections were primarily targeted at institutions assessed as presenting higher risks, the findings should not be treated as representative of the regulated population as a whole.
The FIC selected institutions for inspection mainly through its analysis of risk and compliance returns. Of the institutions inspected, 101 were rated high risk, 89 medium-high risk, and 92 medium risk. A further 171 were deemed high risk by the FIC solely because they had not submitted returns; the Centre treats non-submission of a risk and compliance return as a high-risk indicator for inspection purposes. The remaining inspections involved 81 low-risk and 15 low-medium-risk institutions.
High-risk and medium-high-risk institutions, together with those deemed high risk because they had not submitted returns, accounted for 361 inspections, or about 66% of the total.
The FIC found that some institutions had failed to develop or implement an RMCP, had programmes that did not meet the requirements of the Financial Intelligence Centre Act (FICA), or had not submitted their RMCPs when requested.
The scale of the RMCP challenge is illustrated by the volume of programmes the FIC received during the year: 11 147 RMCPs were submitted, with the largest numbers coming from legal practitioners, estate agents, high-value goods dealers, and credit providers. Despite this volume of submissions, inspections continued to uncover institutions that either had no RMCP at all, had programmes that failed to meet FICA requirements, or simply did not provide their RMCPs when asked.
The inspections also identified failures to comply with customer due diligence requirements, particularly when dealing with legal entities and politically exposed persons.
Other findings included late registration, failures to update registration information, and insufficient documented evidence that clients had been screened against the targeted financial sanctions list.
FICA requires accountable institutions to scrutinise client information against the list and, where a client is designated, comply with the applicable prohibitions and asset-freezing requirements.
Legal practitioners accounted for most inspections
Legal practitioners, the largest registered accountable-institution sector, accounted for 169 of the 549 inspection reports. They were followed by estate agents with 111 and credit providers with 76.
The other reports involved:
- 40 trust service providers;
- 37 motor-vehicle dealers;
- 32 dealers in precious stones;
- 26 company service providers;
- 17 dealers in precious metals;
- 12 dealers in precious metals and stones;
- 10 combined trust and company service providers;
- 10 CASPs;
- seven casinos;
- the South African Postbank; and
- the South African Mint.
The FIC issued 549 reports against an annual target of 550. It attributed the shortfall to operational capacity constraints that delayed the finalisation of inspections late in the financial year.
Reviews serve a different purpose
The annual report distinguishes inspections under section 45B of FICA from compliance reviews, which the FIC uses to engage institutions, increase awareness, and improve understanding of their obligations.
The FIC conducted 161 reviews during 2025/26 and issued 160 final reports, meeting its performance target. It uses institutions’ risk profiles to determine whether interventions should take the form of inspections, reviews, ongoing monitoring, guidance, or awareness activities.
Reviews can cover customer identification, registration, regulatory reporting, and the development and maintenance of an RMCP. During the year, the review team focused on areas institutions often find difficult, including drafting and implementing RMCPs and identifying suspicious and unusual transactions.
The reviews covered 43 legal practitioners, 32 estate agents, 24 credit providers, 23 high-value goods dealers, 22 trust and company service providers, nine gambling institutions, and eight CASPs.
Hundreds sanctioned for registration and return failures
The FIC issued 361 admission-of-non-compliance notices during the year: 209 for failing to submit risk and compliance returns and 152 for failing to register.
Under this process, outstanding returns must be submitted within seven working days, with the financial penalty payable within a further seven working days. Failure to submit a return attracted a R10 000 fine.
By year-end, 149 matters had been finalised after the institutions remedied their non-compliance and paid penalties totalling R1.49 million.
The other 212 institutions had not completed the required remediation by submitting the outstanding return, registering with the FIC, or paying the penalty. These matters were referred to the FIC’s Adjudication Panel and remained unresolved at 31 March 2026.
In a separate enforcement process, the FIC imposed 28 sanctions on institutions in non-financial sectors. Nineteen were finalised, with a combined value of R635 000, while appeals were lodged against nine.
Together with the R1.49m paid through the admission-of-non-compliance process, this brought the FIC’s financial sanctions for the year to R2.125m. Funds derived from financial penalties are paid into the National Revenue Fund.
Enforcement measures can also include a caution, reprimand, remedial directive, or restriction or suspension of specified business activities. Some of the financial penalties imposed during the year were wholly or partly suspended.
Financial-sector supervisors report R55m in FICA sanctions
Financial-sector supervisory authorities separately reported nominal sanctions totalling about R55m.
The Prudential Authority (PA) imposed R37m in sanctions against Discovery Bank, Capitec Bank, and Ninety One Assurance. After conditionally suspended portions were excluded, R28m was payable.
The South African Reserve Bank’s Financial Surveillance Department (FinSurv) imposed sanctions totalling about R1.484m.
The Financial Sector Conduct Authority imposed sanctions in 10 matters, although two were appealed. Sanctions in the eight matters not under appeal totalled R16.56m.
These figures include conditionally suspended portions and do not necessarily represent the amounts payable or collected.
The cases reported by the FIC and the three financial-sector supervisors involved several areas highlighted by the inspections, including RMCPs, customer due diligence, and targeted financial sanctions screening. Other sanctions concerned staff training, compliance governance, and regulatory reporting.
Registered population grows by 8.8%
The number of institutions and other reporters registered with the FIC increased by 8.8%, from 55 262 to 60 115. The FIC supervises more than 80% of the accountable institutions registered with it, with the SARB and the FSCA supervising the balance.
Its responsibilities widened after amendments to the schedules to FICA took effect in December 2022, bringing additional categories of businesses and professions into the regulatory framework.
At 31 March 2026, 26 137 institutions covered by Directives 6 and 7 had submitted risk and compliance returns, representing 73% of the 35 876 institutions in the report’s measurement base.
All company service providers, trust service providers, and casinos in the Directive 6 measurement group had submitted returns. The submission rate among legal practitioners and estate agents was 76%.
Rates among the Directive 7 sectors ranged from 49% for CASPs and dealers in other high-value goods to 87% for dealers in precious stones.
The percentages for the two directives are not directly comparable because they use different registration benchmarks and reporting periods.
Directive 11, issued on 31 March 2026, provides for updated return questions tailored to each DNFBP sector. The questionnaires will be completed during 2026/27 and are intended to produce more sector-specific information and risk ratings.
