FICA Compliance by the Numbers: The R57-Million Cost of Regulatory Blind Spots
The Financial Intelligence Centre (FIC) has laid bare the state of South Africa’s anti-money laundering compliance in its 2025/26 annual report, revealing widespread regulatory failures that cost businesses tens of millions of rands. Through hundreds of risk-based inspections, the FIC uncovered recurring deficiencies in fundamental obligations: Risk Management and Compliance Programmes (RMCPs), customer due diligence (CDD), and targeted financial sanctions screening.
With the registered population of accountable institutions expanding and regulatory scrutiny intensifying, the data from the FIC’s latest reporting period serves as a critical warning for designated non-financial businesses and professions (DNFBPs), credit providers, and crypto asset service providers (CASPs).
The Financial Toll of Non-Compliance
Financial penalties levied across the sector during the 2025/26 financial year approached R57 million, split between the FIC’s direct enforcement and parallel actions by financial-sector supervisors.
Financial-Sector Supervisors (R55 million): The Prudential Authority (PA) led with R37 million in sanctions (R28 million payable) against major entities including Discovery Bank, Capitec Bank, and Ninety One Assurance. The Financial Sector Conduct Authority (FSCA) imposed R16.56 million across eight unappealed matters, while the Reserve Bank’s Financial Surveillance Department levied approximately R1.48 million.
FIC Administrative Sanctions (R2.125 million): The FIC issued 361 admission-of-non-compliance notices, predominantly for failing to submit risk and compliance returns (209) or failing to register (152). Missing a return attracted a standard R10,000 fine. By year-end, 149 institutions had settled penalties totalling R1.49 million, while 212 unresolved matters were referred to the Adjudication Panel. Separate enforcement actions in non-financial sectors added R635,000 from 19 finalized sanctions.
Who Was Inspected?
The FIC issued 549 inspection reports against an annual target of 550, missing the mark by just one due to late-year capacity constraints. These inspections were not random; they were highly targeted based on risk profiles derived from compliance returns.
A significant 66% of all inspections (361 institutions) focused on entities rated high-risk, medium-high-risk, or those deemed high-risk strictly because they failed to submit their risk and compliance returns. The sectoral breakdown highlights where regulatory attention is concentrated:
Legal practitioners: 169 inspections
Estate agents: 111 inspections
Credit providers: 76 inspections
Trust service providers: 40 inspections
Motor-vehicle dealers: 37 inspections
Dealers in precious stones/metals: 49 inspections combined
Company service providers: 26 inspections
To complement enforcement, the FIC also conducted 161 compliance reviews (yielding 160 reports) designed to improve awareness. These targeted areas institutions traditionally struggle with, primarily drafting RMCPs and identifying suspicious transactions.
The RMCP and Due Diligence Deficit
Despite receiving a staggering 11,147 RMCPs during the year – mostly from legal practitioners, estate agents, high-value goods dealers, and credit providers – inspectors continually found severe programmatic failures. Many institutions operated without any RMCP, utilized programmes that fundamentally failed to meet FICA requirements, or simply ignored regulatory requests to submit their documentation.
Beyond written policies, operational execution remains a vulnerability. The FIC noted widespread failures in customer due diligence, particularly regarding the verification of legal entities and politically exposed persons (PEPs). Furthermore, institutions repeatedly failed to document evidence that they were actively screening clients against the targeted financial sanctions list – a mandatory asset-freezing safeguard under FICA.
An Expanding Regulatory Net
The number of registered institutions under the FIC’s purview grew by 8.8%, rising from 55,262 to 60,115 following the December 2022 schedule amendments that brought new business categories into the regulatory framework. The FIC now directly supervises more than 80% of these entities.
Compliance reporting rates show a stark divide across these sectors. While 73% of institutions covered by Directives 6 and 7 submitted their risk and compliance returns (26,137 out of 35,876), specific industry compliance varied heavily:
100% compliance: Company service providers, trust service providers, and casinos.
- 87% compliance: Dealers in precious stones.
- 76% compliance: Legal practitioners and estate agents.
- 49% compliance: Crypto asset service providers (CASPs) and dealers in other high-value goods.
With the release of Directive 11 at the end of the financial year, the FIC is moving toward highly tailored, sector-specific return questionnaires for 2026/27. This data-driven approach will refine the FIC’s risk ratings, meaning institutions that neglect their FICA obligations, fail to submit returns, or rely on inadequate RMCPs will find it increasingly difficult to fly under the regulatory radar.
Get Your Compliance Sorted
The recent sanctions are not isolated incidents – they represent an enforcement programme that is rapidly expanding. Being FICA compliant requires an operational, fully documented programme that your staff understands and applies daily.
If your agency’s Risk Management and Compliance Programme isn’t up to standard, don’t wait for the FIC to find the gaps.