FIC Registration on goAML in South Africa: Who Must Register, the 90-Day Rule and How to Report (2026)
Short answer: Every accountable institution listed in Schedule 1 of the Financial Intelligence Centre Act, 2001 (FIC Act, or FICA) and every reporting institution in Schedule 3 must register with the Financial Intelligence Centre (FIC) under section 43B. Registration is free, is done only on the FIC's goAML portal at goweb.fic.gov.za, and for Schedule 1 institutions is due within 90 days of the business being established. Changes to the registered details are notified within 90 days, and failing to register is an offence. Registration gives you the credentials to file cash threshold, suspicious, terrorist property and international funds transfer reports. For software that generates and validates FIC goAML files, see goAML reporting software for South Africa.
This guide is for compliance officers and principals at South African banks, insurers, financial services providers, money transfer operators, estate agencies, legal practices, dealers in high-value goods, crypto asset service providers and other accountable institutions. It is a practical guide, not legal advice.
Who must register
Section 43B(1) of the FIC Act requires every accountable institution in Schedule 1 and every reporting institution in Schedule 3 to register with the FIC "within the prescribed period and in the prescribed manner". Schedule 1 covers, among others, legal practitioners, trust and company service providers, estate agents, gambling operators, foreign exchange dealers, credit providers, investment financial services providers, money or value transfer providers, dealers in high-value goods, crypto asset service providers and clearing system participants, as well as banks and life insurers.
The duty to report suspicious and unusual transactions reaches further than the schedules: section 29 applies to anyone who carries on, manages or works for a business. The FIC's portal is clear that "before any institution or person can submit a regulatory report, they must first register with the FIC", so a business outside the schedules that needs to file a suspicious transaction report registers too.
When: the 90-day rule
The FIC's goAML portal states that "persons or entities listed in Schedule 1 of the FIC Act must register within 90 days of their business being established", and that registration "is free of charge and can only be done on this goAML portal". A new agency, practice or dealer should therefore put FIC registration on its launch checklist alongside its licence and bank account.
After registering, the institution must notify the FIC in writing of any change to the particulars it registered within 90 days after the change (section 43B(4)): a new compliance officer, a change of address or a new product line that falls under another Schedule 1 item.
How: registering on goAML
- Go to the FIC's goAML portal, goweb.fic.gov.za, and choose Register.
- Register the organisation and the person who will report for it, with the particulars the FIC requires (section 43B(2)).
- Map your products and services to the Schedule 1 or Schedule 3 items that apply. The FIC's Public Compliance Communication 05C explains when one business must register as more than one accountable institution, one per schedule item, and when a head office and its branches register separately.
- Once registered, use the credentials the registration gives you to report electronically.
The FIC's user guides on the portal walk through the forms, and its compliance contact centre helps with registration and reporting on 012 641 6000, option 2.
After registration: three ways to report
The FIC's Guidance Note 4B describes three ways to file:
| Method | Suited to |
|---|---|
| Online web form (individual reporting) | Institutions that file few reports |
| Batch reporting | Regular, high volumes of reports |
| System-to-system reporting through web services | High to very high volumes |
Whatever the method, the FIC asks reporters to save web reports as drafts before submitting, upload attachments with the first report, monitor the status of every submitted report and fix failures and rejections, and keep a copy of each report. Its guidance notes also ask institutions to pre-validate reports and follow the reporting system's schema and business rules. Manual reporting is only for exceptional cases where a reporter lacks the technical capability, by arrangement with the FIC, and a suspicious transaction report may never be posted.
The four reporting streams on goAML are:
- Cash threshold reports (section 28): cash above R49,999.99, within 3 days. See our cash threshold report guide.
- Suspicious and unusual transaction reports (section 29): within 15 days. See our section 29 guide.
- Terrorist property reports (section 28A): matches to the targeted financial sanctions list or the UN 1267 list.
- International funds transfer reports (section 31): electronic transfers into or out of South Africa above the prescribed amount.
In both day counts, Saturdays, Sundays and public holidays are excluded.
Registration checklist
- Identify every Schedule 1 or Schedule 3 item your business falls under, and whether branches register separately.
- Register on goAML within 90 days of the business being established.
- Record the person responsible for reporting, and keep that person's registration current.
- Notify the FIC of changes within 90 days.
- Choose a reporting method that fits your volumes, and pre-validate every report.
- Monitor report status and keep copies.
Frequently asked questions
Who must register with the FIC?
Every accountable institution in Schedule 1 and every reporting institution in Schedule 3 of the FIC Act (section 43B). Any business that needs to file a suspicious transaction report must also register, because reports can only be filed by registered users.
How long do we have to register with the FIC?
Schedule 1 institutions must register within 90 days of the business being established, according to the FIC's goAML portal.
Does FIC registration cost anything?
No. Registration is free of charge and can only be done on the FIC's goAML portal.
What happens if we do not register?
Failing to register is an offence under section 61A of the FIC Act, and the FIC or a supervisory body can also impose administrative sanctions, including financial penalties, for non-compliance (section 45C).
Do we have to update our registration?
Yes. Changes to the registered particulars must be notified to the FIC in writing within 90 days after the change (section 43B(4)).
FIC reporting with Creodata
Creodata's goAML Reporting Platform generates schema-valid goAML XML, validates every report against the schema and business rules before submission, and keeps an immutable record of every report, amendment and filing. Registration is your institution's own step on the FIC's portal; the platform prepares and validates what you file there. See goAML reporting software for South Africa, our South Africa FIC goAML reporting guide, and FICA compliance and AML software in South Africa for screening, monitoring and case management.
See it on your own report types — request a demo.