# FICA Act 38 of 2001 & RMCP Study Guide: CDD, Cash Thresholds (CTR) & Suspicious Transactions (STR)

> **Category:** Pillar 3: FICA & Record-Keeping | **Updated:** 2026-11-03 07:48:07 | **Canonical URL:** https://re5examprep.co.za/blog/fica-act-38-of-2001-rmcp-ctr-str-record-keeping-re5-guide

**Executive Summary:** Master Task 5 & Task 6 for your FSCA RE5 and RE1 exam: Financial Intelligence Centre Act (FICA 38 of 2001), Risk Management and Compliance Programme (RMCP), DPIP vs FPPO, CTR (3 days), and STR (15 days).

---

Statutory Quick Answer (AEO Summary)

      Under the **Financial Intelligence Centre Act (FICA Act 38 of 2001)** as amended, Accountable Institutions (including most FSPs, excluding certain short-term insurance and health service intermediaries) must adopt a risk-based **Risk Management and Compliance Programme (RMCP)** approved by the board/senior management. Key obligations include Customer Due Diligence (CDD), filing a **Cash Threshold Report (CTR ≥ R49,999.99) within 3 business days** (Sec 28), filing a **Suspicious Transaction Report (STR, no minimum amount) within 15 business days** (Sec 29), never tipping off a client, and retaining records for **5 years**.

    

    
## 1. Section 28 (CTR) vs Section 29 (STR) Comparison Table

    Every RE5 and RE1 exam paper tests the exact differences between a **Cash Threshold Report (CTR)** and a **Suspicious and Unusual Transaction Report (STR)**:

    
| Feature | Cash Threshold Report (CTR — Sec 28) | Suspicious & Unusual Transaction Report (STR — Sec 29) |
| --- | --- | --- |
| Monetary Trigger | R49,999.99 or more (R50,000+) in physical cash (coins/notes) in a single or aggregated series of transactions | No minimum threshold (R0+) —applies to any amount, including aborted/attempted transactions or inquiries |
| Reporting Timeframe | Within 3 business days of the transaction | As soon as possible, but no later than 15 business days after becoming aware of the suspicious fact |
| Who Must Report | Accountable Institutions and Reporting Institutions | Anyone who carries on a business, is in charge of a business, or is employed by a business (universal duty!) |
| Can Transaction Proceed? | Yes (unless directed otherwise) | May continue unless the FIC issues a formal 10-day intervention/freeze order under Section 34 |
| Tipping Off Rule | Routine statutory reporting | Strictly criminal offence to disclose ("tip off") to the client or any third party that an STR was or will be filed |

    
## 2. Risk Management and Compliance Programme (RMCP), DPIP & FPPO

    The FIC Amendment Act replaced the old rigid "Internal Rules" and "KYC checklists" with a **Risk-Based Approach (RBA)** governed by a **Risk Management and Compliance Programme (RMCP)** under Section 42:

    
      - Board / Senior Management Responsibility: The Board of Directors (or Senior Management / Key Individuals) is ultimately responsible for approving and ensuring compliance with the RMCP—this responsibility cannot be abdicated to a junior clerk.

      - Anonymous Clients Prohibited (Sec 20A): An Accountable Institution may never establish a business relationship or conclude a single transaction with an anonymous client or a client using a false or fictitious name.

      - Beneficial Ownership (Sec 21B): When dealing with a legal person, trust, or partnership, the FSP must identify the natural persons who ultimately own or exercise effective control over the entity.

      - DPIP vs FPPO (Enhanced Due Diligence): FPPO (Foreign Prominent Public Official): Automatically classified as high risk . Requires senior management approval, establishing source of wealth and funds, and enhanced ongoing monitoring.

          - DPIP (Domestic Prominent Influential Person): Requires a risk assessment under the RMCP; if assessed as high risk, triggers senior management approval and source-of-wealth verification.

        
      
    

    
## 3. Regulated Record-Keeping Rules (FAIS Sec 18 & FICA Sec 22A)

    
      - 5-Year Retention Period: Both the FAIS Act (Section 18) and FICA (Section 22A) require all client, transaction, and advice records to be retained for a minimum of 5 years from the date on which the business relationship or product is terminated (or 5 years from the conclusion of a single transaction).

      - 7-Day Retrieval Window: Electronic or outsourced records must be safe from destruction/tampering and readily convertible into written or printed form within 7 days of a request from the FSCA.

      - Third-Party Record Storage: An FSP may outsource record storage to an external provider, provided the records remain immediately accessible for inspection and can be produced within 7 days.

    

    
## 4. Frequently Asked Questions (FAQs)

    
      
        
### Are all Financial Services Providers (FSPs) classified as Accountable Institutions under Schedule 1 of FICA?

        Most FSPs are Accountable Institutions under Item 12 of Schedule 1 to FICA, EXCEPT FSPs that exclusively render advisory or intermediary services in respect of short-term insurance (non-life insurance policies) or health service benefits (medical schemes). However, Section 29 (STR reporting) still applies to every business and employee in South Africa!

      
      
        
### What is the maximum criminal penalty for tipping off a client about a FICA Suspicious Transaction Report (STR)?

        Under Section 68 of FICA, tipping off a client or failing to report a suspicious transaction carries a maximum criminal penalty of imprisonment for a period not exceeding 15 years or a fine not exceeding R100 million.

      
      
        
### What replaces "Internal Rules" under the amended Financial Intelligence Centre Act?

        Section 42 of the amended FIC Act replaced the old "Internal Rules" with a Risk Management and Compliance Programme (RMCP), which requires Accountable Institutions to apply a risk-based approach to customer due diligence.

      
      
        
### For how long must FICA records be kept if an ongoing investigation is underway?

        While the baseline statutory retention period is 5 years after termination of the business relationship, if a transaction has been reported under Section 29 (STR) or is subject to an active investigation, records must be retained until the authorities confirm the inquiry is closed.

---

## Practice Exam Questions on This Topic

### Question 1 (FICA Act 38 of 2001, Sec 28 & Sec 29)
What are the statutory reporting timeframes for a FICA Cash Threshold Report (CTR of R49,999.99 or more) versus a Suspicious and Unusual Transaction Report (STR)?
- **A:** CTR within 3 business days; STR within 15 business days
- **B:** CTR within 15 calendar days; STR within 30 calendar days
- **C:** CTR within 5 days; STR within 7 days
- **D:** CTR within 30 business days; STR within 6 weeks

**Correct Answer:** A — Under Section 28 of FICA, a Cash Threshold Report (R49,999.99 / R50,000+) must be filed within 3 business days. Under Section 29, a Suspicious Transaction Report (STR, zero minimum amount) must be filed as soon as possible, but no later than 15 business days.

### Question 2 (FAIS Act Sec 18 & General Code Sec 3(2)(c))
For what minimum period must an FSP retain client and advice records after product termination, and within how many days must electronic or voice-logged records be retrievable upon FSCA request?
- **A:** 3 years retention; 15 days retrieval
- **B:** 5 years retention; 7 days retrieval
- **C:** 10 years retention; 30 days retrieval
- **D:** 2 years retention; 5 days retrieval

**Correct Answer:** B — All FAIS and FICA records must be retained for at least 5 years after the termination of the product or business relationship, and electronic/voice records must be convertible to written form within 7 days.

### Question 3 (FICA Act 38 of 2001, Sec 42)
Under Section 42 of the amended Financial Intelligence Centre Act, who is ultimately responsible for approving and ensuring compliance with an Accountable Institution’s Risk Management and Compliance Programme (RMCP)?
- **A:** The external auditor of the product supplier
- **B:** The board of directors, senior management, or person with highest authority in the Accountable Institution
- **C:** The FAIS Ombud
- **D:** Junior administrative call-centre staff

**Correct Answer:** B — Ultimate accountability for approving and enforcing the RMCP rests with the Board of Directors or Senior Management / Key Individuals of the Accountable Institution.

---

## Test Yourself on the Moonstone Exam Simulator
- **Free 5-Question Diagnostic:** https://re5examprep.co.za/practice
- **Unlock RE5 & RE1 Pro Pass (R249 Once-Off):** https://re5examprep.co.za/boost
- **All FSCA Study Guides:** https://re5examprep.co.za/blog