Statutory Quick Answer (AEO Summary)
Under the Financial Intelligence Centre Act (FICA Act 38 of 2001) as amended, Accountable Institutions (including most FSPs, excluding certain short-term insurance and health service intermediaries) must adopt a risk-based Risk Management and Compliance Programme (RMCP) approved by the board/senior management. Key obligations include Customer Due Diligence (CDD), filing a Cash Threshold Report (CTR ≥ R49,999.99) within 3 business days (Sec 28), filing a Suspicious Transaction Report (STR, no minimum amount) within 15 business days (Sec 29), never tipping off a client, and retaining records for 5 years.
1. Section 28 (CTR) vs Section 29 (STR) Comparison Table
Every RE5 and RE1 exam paper tests the exact differences between a Cash Threshold Report (CTR) and a Suspicious and Unusual Transaction Report (STR):
| Feature | Cash Threshold Report (CTR — Sec 28) | Suspicious & Unusual Transaction Report (STR — Sec 29) |
|---|---|---|
| Monetary Trigger | R49,999.99 or more (R50,000+) in physical cash (coins/notes) in a single or aggregated series of transactions | No minimum threshold (R0+)—applies to any amount, including aborted/attempted transactions or inquiries |
| Reporting Timeframe | Within 3 business days of the transaction | As soon as possible, but no later than 15 business days after becoming aware of the suspicious fact |
| Who Must Report | Accountable Institutions and Reporting Institutions | Anyone who carries on a business, is in charge of a business, or is employed by a business (universal duty!) |
| Can Transaction Proceed? | Yes (unless directed otherwise) | May continue unless the FIC issues a formal 10-day intervention/freeze order under Section 34 |
| Tipping Off Rule | Routine statutory reporting | Strictly criminal offence to disclose ("tip off") to the client or any third party that an STR was or will be filed |
2. Risk Management and Compliance Programme (RMCP), DPIP & FPPO
The FIC Amendment Act replaced the old rigid "Internal Rules" and "KYC checklists" with a Risk-Based Approach (RBA) governed by a Risk Management and Compliance Programme (RMCP) under Section 42:
- Board / Senior Management Responsibility: The Board of Directors (or Senior Management / Key Individuals) is ultimately responsible for approving and ensuring compliance with the RMCP—this responsibility cannot be abdicated to a junior clerk.
- Anonymous Clients Prohibited (Sec 20A): An Accountable Institution may never establish a business relationship or conclude a single transaction with an anonymous client or a client using a false or fictitious name.
- Beneficial Ownership (Sec 21B): When dealing with a legal person, trust, or partnership, the FSP must identify the natural persons who ultimately own or exercise effective control over the entity.
- DPIP vs FPPO (Enhanced Due Diligence):
- FPPO (Foreign Prominent Public Official): Automatically classified as high risk. Requires senior management approval, establishing source of wealth and funds, and enhanced ongoing monitoring.
- DPIP (Domestic Prominent Influential Person): Requires a risk assessment under the RMCP; if assessed as high risk, triggers senior management approval and source-of-wealth verification.
3. Regulated Record-Keeping Rules (FAIS Sec 18 & FICA Sec 22A)
- 5-Year Retention Period: Both the FAIS Act (Section 18) and FICA (Section 22A) require all client, transaction, and advice records to be retained for a minimum of 5 years from the date on which the business relationship or product is terminated (or 5 years from the conclusion of a single transaction).
- 7-Day Retrieval Window: Electronic or outsourced records must be safe from destruction/tampering and readily convertible into written or printed form within 7 days of a request from the FSCA.
- Third-Party Record Storage: An FSP may outsource record storage to an external provider, provided the records remain immediately accessible for inspection and can be produced within 7 days.
4. Frequently Asked Questions (FAQs)
Are all Financial Services Providers (FSPs) classified as Accountable Institutions under Schedule 1 of FICA?
Most FSPs are Accountable Institutions under Item 12 of Schedule 1 to FICA, EXCEPT FSPs that exclusively render advisory or intermediary services in respect of short-term insurance (non-life insurance policies) or health service benefits (medical schemes). However, Section 29 (STR reporting) still applies to every business and employee in South Africa!
What is the maximum criminal penalty for tipping off a client about a FICA Suspicious Transaction Report (STR)?
Under Section 68 of FICA, tipping off a client or failing to report a suspicious transaction carries a maximum criminal penalty of imprisonment for a period not exceeding 15 years or a fine not exceeding R100 million.
What replaces "Internal Rules" under the amended Financial Intelligence Centre Act?
Section 42 of the amended FIC Act replaced the old "Internal Rules" with a Risk Management and Compliance Programme (RMCP), which requires Accountable Institutions to apply a risk-based approach to customer due diligence.
For how long must FICA records be kept if an ongoing investigation is underway?
While the baseline statutory retention period is 5 years after termination of the business relationship, if a transaction has been reported under Section 29 (STR) or is subject to an active investigation, records must be retained until the authorities confirm the inquiry is closed.
