The Financial Intelligence Centre Act, and the amendments made to it, place real compliance obligations on many South African small businesses, not only banks and large financial institutions, requiring proper customer identification and record-keeping wherever a business is classified as an “accountable institution” under the Act. Misunderstanding whether these obligations apply is one of the more common and avoidable compliance gaps small businesses carry.
FICA exists to fight money laundering, tax evasion and terrorist financing, and its scope extends well beyond banks to include a range of businesses, estate agents, certain financial advisors and other accountable institutions among them, that may not immediately think of themselves as falling under its requirements.
Knowing whether a business is an accountable institution is the first step
A business’s FICA obligations depend on whether it falls within one of the categories the Act defines as an accountable institution, which is a specific legal classification rather than a general assumption based on business type. Confirming this status properly, rather than guessing, determines what compliance obligations, if any, actually apply.
Customer due diligence requirements have real practical implications
Businesses classified as accountable institutions are required to properly verify customer identity and maintain adequate records of these verification steps, obligations that carry real administrative weight and require dedicated processes rather than informal, ad hoc customer verification.
FICA compliance intersects with data protection obligations
Collecting and storing the personal information FICA compliance requires must also be done in line with the Protection of Personal Information Act, which governs how that customer information is processed, stored and shared. A business meeting its FICA obligations without also considering its POPI Act obligations around the same customer data has only addressed half the compliance picture.
Non-compliance carries genuine regulatory and reputational risk
The Act includes real inspection powers and enforcement mechanisms for regulatory compliance, and a business that has not properly assessed and met its obligations under FICA faces both regulatory risk and reputational exposure should a compliance gap come to light, particularly given how closely FICA compliance is tied to fighting serious financial crimes.
Frequently asked questions
Does FICA only apply to banks and large financial institutions?
No. Its obligations extend to a range of businesses classified as accountable institutions, potentially including estate agents, certain financial advisors and other categories that may not immediately consider themselves covered.
How does a business know if it is classified as an accountable institution under FICA?
By checking against the specific categories the Act defines, since this is a formal legal classification rather than a general assumption based on the type of business, and getting proper advice is worthwhile if there is any uncertainty.
What are the practical requirements for a business classified as an accountable institution?
Verifying customer identity properly and maintaining adequate records of that verification, obligations that require dedicated administrative processes rather than informal, ad hoc checks.
Does FICA compliance also involve data protection obligations?
Yes. Personal information collected to meet FICA requirements must also be handled in line with the Protection of Personal Information Act, meaning FICA compliance alone does not cover the full picture without POPI Act compliance as well.
What happens if a business fails to meet its FICA obligations?
It faces both regulatory risk, given the Act’s inspection and enforcement powers, and reputational exposure, particularly given how directly FICA compliance is tied to fighting money laundering and other serious financial crimes.
Further reading
Originally published in May 2017. Updated September 2026 to focus on which businesses the Act actually covers and its intersection with POPI Act obligations, since the Act itself has been in force for some time.
