South Africa FIC goAML Reporting: Registration, CTRs, STRs and TPRs
Short answer: Accountable institutions register with the Financial Intelligence Centre (FIC) on its goAML portal, goweb.fic.gov.za, which is also where every regulatory report is filed. Cash above R49,999.99 is reported as a cash threshold report (CTR) within 3 days, and suspicious and unusual transactions (STRs and SARs) within 15 days of becoming aware of the facts, both excluding weekends and public holidays. Reports go in as an online form, as a batch, or system to system, and the FIC expects them to be pre-validated. For software that generates and validates those files, see goAML reporting software for South Africa.
This guide is for compliance officers, money laundering reporting officers and operations teams at South African banks, insurers, financial services providers, money transfer providers, foreign exchange dealers, estate agents, gambling operators, crypto asset service providers and the other accountable institutions under the Financial Intelligence Centre Act, 2001 (FICA). It covers registration, the four reporting streams, the deadlines and the practical rules that decide whether a report is accepted.
It is a practical reference, not legal advice. The FIC's guidance notes and public compliance communications are the authoritative sources; confirm current requirements with the FIC.
The legal framework
The FIC is established by section 2 of the FIC Act, and the Money Laundering and Terrorist Financing Control Regulations (MLTFC Regulations) set the reporting periods and particulars. Duties fall on the accountable institutions listed in Schedule 1 of the Act, which runs from legal practitioners, estate agents and gambling operators to banks, life insurers, foreign exchange dealers, credit providers, money or value transfer providers, dealers in high-value goods and crypto asset service providers.
Supervision is split. Schedule 2 names the Prudential Authority of the South African Reserve Bank for banks, mutual and co-operative banks, life insurers, money or value transfer providers and clearing system participants; the Reserve Bank's Financial Surveillance Department for foreign exchange dealers and money transfer businesses; and the Financial Sector Conduct Authority for authorised users of an exchange, collective investment scheme managers and investment financial services providers. The FIC itself supervises accountable institutions with no supervisory body in Schedule 2, such as estate agents, gambling operators and crypto asset service providers.
Every accountable institution must also keep a Risk Management and Compliance Programme (RMCP) under section 42, which describes how it identifies, assesses and reports; the reporting processes below should match what the RMCP says.
Registering on goAML
Registration with the FIC is compulsory under section 43B, free of charge, and can only be done on the goAML portal. Schedule 1 institutions must register within 90 days of their business being established. Registration gives the institution the user credentials it needs to report.
Two points catch groups out:
- Several registrations may be needed. An institution that carries on activities under more than one Schedule 1 or Schedule 3 item may have to register each one as a separate accountable or reporting institution, and map its products and services to the right item.
- Branches may need their own registration. Some institutions must register their head office and their branch network as separate accountable institutions.
The FIC sets out the details in Public Compliance Communication 05C. Keep the registration current: users, compliance contacts and the mapping of products to schedule items all feed what you can report and who can report it.
The four reporting streams
The goAML portal names four primary reporting streams, and all of them are filed on goAML:
| Report | Section | What triggers it | Deadline |
|---|---|---|---|
| Cash threshold report (CTR) | 28 | Cash above R49,999.99 paid to or received from a client | As soon as possible, no later than 3 days |
| Suspicious and unusual transaction report (STR, or SAR for an incomplete transaction; TFTR/TFAR for terrorist financing) | 29 | Knowledge or suspicion of money laundering, terrorist financing or sanctions evasion | As soon as possible, no later than 15 days |
| Terrorist property report (TPR) | 28A | A party matches the targeted financial sanctions list or the UN Security Council Resolution 1267 list | Factual report, filed on goAML |
| International funds transfer report (IFTR) | 31 | Cross-border money movement | Filed on goAML |
Both deadlines exclude Saturdays, Sundays and public holidays (regulation 24).
Cash threshold reports: R49,999.99 and three days
A CTR is due when the institution pays cash to a client, or receives cash from one, above R49,999.99, whether in person or through a third party (section 28; Guidance Note 5C). The report is due as soon as possible and no later than three days, excluding weekends and public holidays, after the institution becomes aware of the cash transaction (regulation 24(4)). Where a transaction is only partly in cash, only the cash portion is reported.
"Cash" has a narrow meaning: coin and paper money and travellers' cheques. Bank cheques, bank drafts, EFTs and wire transfers are not cash and are not reportable as CTRs.
The threshold applies per transaction, and cash below it is not added up into a CTR. That does not end the matter: a series of transactions carried out to avoid a report must be considered for an STR under section 29(1)(b)(iii). The FIC's own examples include a gambler who buys in five times for R20,000 over eight hours, and a client who exchanges R20,000 at each of three branches of the same foreign exchange dealer on one day. Neither produces a CTR; both may warrant an STR.
Suspicious and unusual transaction reports: 15 days
A report under section 29 goes to the FIC as soon as possible after a person becomes aware of the facts that give rise to a suspicion, and no later than 15 days, excluding weekends and public holidays (regulation 24(3); Guidance Note 4B). The FIC stresses that the period starts when the facts come to light, which in most cases is before the suspicion is formed, so a process that starts the clock only once an investigator is sure will run late.
Completed transactions are reported as STRs and incomplete or attempted ones as SARs; terrorist-financing variants carry their own codes. Each report needs a descriptive narrative in both the "Reason for reporting" and the "Action taken" fields.
Terrorist property reports
A match between a party to a transaction and the targeted financial sanctions list or the UN 1267 list is reported as a TPR under section 28A. The FIC calls this factual reporting: the question is whether there is a match, not whether anything looks suspicious. Screening therefore has to run on current lists, and the institution has to be able to show which list version a decision relied on.
Filing methods and how to avoid rejections
The FIC offers three ways to file (Guidance Note 4B):
- Individual reporting through the online web form;
- Batch reporting for institutions that submit high volumes regularly;
- System-to-system reporting through web services, for high to very high volumes.
Whichever route you use, the FIC's guidance boils down to a few rules:
- Pre-validate. Guidance Note 5C asks institutions to pre-validate reports so that accurate information reaches the FIC on time, and reports must follow the reporting system's schema and business rules.
- Complete the client information. Provide valid identity or passport details and the other particulars the MLTFC Regulations prescribe, not just what is convenient.
- Map both sides correctly. Report debits and credits on the right side of the transaction; the same person must not appear on both the "From" and "To" side.
- Attach evidence. Upload available attachments, such as identity documents, proof of residence and receipts, with the first report.
- Track every report. Monitor the status of submitted reports, fix failures and rejections, and download a copy of each report for your records.
- Save as you go. Web reports can be saved as drafts, which protects work if the session times out.
Manual reporting is only for exceptional cases where the reporter lacks the technical capability, by arrangement with the FIC, and a section 29 report may never be posted.
Record keeping
Records of each business relationship must be kept for at least five years after it ends, records of single transactions for five years after the transaction, and records of anything reported under section 29 for five years after the report was submitted (section 23). Keep the submitted report, the acknowledgement and the case file that led to it together.
Compliance checklist
- Registered on goAML under section 43B, with every Schedule 1 or 3 item and, where required, branches registered separately
- RMCP describes the CTR, STR, TPR and IFTR processes as they actually run
- CTR rule: cash above R49,999.99, paid or received, cash portion only, 3-day timer excluding weekends and public holidays
- Monitoring for cash split below the threshold, with an STR decision recorded
- STR timer starting when the facts became known, 15 days excluding weekends and public holidays
- Narratives for "Reason for reporting" and "Action taken" on every STR and SAR
- Screening against the targeted financial sanctions list and the UN 1267 list, with TPRs filed on a match
- Pre-validation against the schema and business rules before submission
- Report status monitored, rejections remediated, copies kept
- Five-year retention for relationships, transactions and reports
Frequently asked questions
Where do South African institutions register for goAML?
On the FIC's goAML portal, goweb.fic.gov.za. Registration is compulsory under section 43B, free of charge and only possible on goAML, and Schedule 1 institutions must register within 90 days of starting business.
What is the cash threshold in South Africa?
Cash above R49,999.99 paid to or received from a client, reported as a CTR no later than 3 days, excluding weekends and public holidays, after the institution becomes aware of it. EFTs, wire transfers, bank cheques and drafts are not cash.
What is the STR deadline in South Africa?
As soon as possible, and no later than 15 days, excluding weekends and public holidays, after becoming aware of the facts that give rise to the suspicion (regulation 24(3) of the MLTFC Regulations).
Can we upload reports in bulk?
Yes. Besides the online web form, the FIC accepts batch reporting for institutions that report high volumes regularly, and system-to-system reporting through web services for high to very high volumes.
goAML reporting for South African institutions with Creodata
Creodata's goAML Reporting Platform generates schema-valid goAML XML, validates every report against the schema and business rules before submission, detects cash transactions above the threshold and assembles them for filing, compiles parties, accounts and narrative in one STR workspace, and keeps an immutable record of every report, amendment and filing.
For the screening, transaction monitoring, customer risk rating and case management around those filings, see FICA compliance and AML software in South Africa; for the goAML filing itself, see goAML reporting software for South Africa. Our FICA compliance software buyer's guide covers how to choose a system.
See it on your own report types — request a demo.