Suspicious and Unusual Transaction Reports in South Africa: Section 29 of FICA and the 15-Day Rule (2026)
Short answer: Section 29 of the Financial Intelligence Centre Act, 2001 (FICA) requires anyone who carries on, manages or works for a business, and who knows or ought reasonably to have known or suspected that the business is being used for money laundering, terrorist financing or related crime, to report to the Financial Intelligence Centre (FIC). The report goes in as soon as possible and no later than 15 days, excluding Saturdays, Sundays and public holidays, after becoming aware of the facts that give rise to the suspicion, and the FIC says that clock usually starts before the suspicion is fully formed. Transactions are reported as STRs, activities and unconcluded transactions as SARs, and terrorist-financing cases as TFTRs or TFARs, all on the FIC's goAML portal. For software that drafts and validates FIC reports, see goAML reporting software for South Africa.
This guide is for compliance officers, money laundering reporting officers and investigators at South African banks, insurers, financial services providers, estate agencies, legal practices, gambling operators, dealers and other businesses. It draws on the Act and the FIC's Guidance Note 4B. It is a practical guide, not legal advice.
Who must report
Section 29 is not limited to accountable institutions. It applies to "a person who carries on a business or is in charge of or manages a business or who is employed by a business", and the FIC's guidance is plain: "All businesses must in terms of section 29 of the FIC Act, report suspicious or unusual activities or transactions". A business outside Schedule 1 still has to register on goAML to file (see our FIC registration guide).
What triggers a report
The duty arises when a person knows, or ought reasonably to have known or suspected, that:
- the business has received or is about to receive the proceeds of unlawful activities, or property connected to terrorist financing;
- a transaction or series of transactions to which the business is a party facilitated or is likely to facilitate the transfer of such proceeds, has no apparent business or lawful purpose, was conducted to avoid a reporting duty under the Act, may be relevant to the evasion of tax, duty or levy, relates to terrorist financing, or relates to a breach of the targeted financial sanctions prohibitions in section 26B; or
- the business has been used or is about to be used for money laundering or terrorist financing.
A report is also due where enquiries are made about a transaction that would have had any of these consequences had it been concluded (section 29(2)).
"Ought reasonably to have known" is an objective test. Guidance Note 4B explains it through section 1(3) of the Prevention of Organised Crime Act: the question is whether a reasonably diligent and vigilant person with the same knowledge, skill, training and experience, and with those that may reasonably be expected of someone in the same position, would have known or suspected the fact.
STR, SAR, TFTR or TFAR?
| Report | When |
|---|---|
| STR (suspicious or unusual transaction report) | A transaction or series of transactions between two or more parties, linked to the proceeds of crime, money laundering or a breach of the section 26B sanctions prohibitions |
| SAR (suspicious or unusual activity report) | An activity that does not involve a transaction between parties, enquiries about a transaction, or a transaction that was attempted, abandoned, interrupted or cancelled and not concluded |
| TFTR (terrorist financing transaction report) | A transaction or series of transactions between two or more parties linked to terrorist financing |
| TFAR (terrorist financing activity report) | Terrorist-financing activity, enquiries, or a transaction that was not concluded |
Matches to the targeted financial sanctions list or the UN Security Council 1267 list are reported separately, as terrorist property reports under section 28A.
The 15-day rule, and when it starts
Regulation 24(3) of the Money Laundering and Terrorist Financing Control Regulations requires a section 29 report to reach the FIC as soon as possible, and no later than 15 days, excluding Saturdays, Sundays and public holidays. Guidance Note 4B adds three points that decide how much time you really have:
- The clock starts early. The 15 days start "when a person becomes aware of the facts which will eventually give rise to a report", which "in the majority of cases will be, before a suspicion is formed".
- Internal processes do not stop it. An institution "may not add additional timeframes for its internal transactional monitoring alert system processes, and / or internal investigation and review processes to the prescribed reporting period".
- Late filing needs condonation. Only in exceptional cases will the FIC condone a late report, and the reporter has to apply for it.
In practice, the date an alert fired or a staff member noticed something is the date to record, and the investigation has to fit inside the 15 working days.
Filing on goAML
Section 29 reports are filed electronically on the FIC's goAML portal, goweb.fic.gov.za, by web form, by batch, or system-to-system for high volumes. The FIC asks reporters to save web reports as drafts, attach supporting documents with the first report, monitor each report's status and fix rejections, keep a copy, and pre-validate reports against the reporting system's schema and business rules. Other means are allowed only in exceptional circumstances where the reporter lacks the technical capability, by arrangement with the FIC, and "under no circumstances may a report made under section 29 of the FIC Act be posted to the Centre".
After the report: continuing, and the FIC's intervention
An institution may continue with a reported transaction unless the FIC directs otherwise (section 33). Where the FIC, after consulting the institution, has reasonable grounds to suspect that a transaction involves the proceeds of crime or terrorist property, or constitutes money laundering, it may direct the institution in writing not to proceed for up to 10 days, excluding weekends and public holidays, while it makes inquiries (section 34). The FIC may also ask for additional information about any report (section 32).
Tipping off
Nobody who made, or must make, a section 29 report may disclose that fact or the report's contents to anyone, including the person reported, except within the law's narrow exceptions (section 29(3)); the same applies to anyone who knows or suspects a report has been or will be made (section 29(4)). Unauthorised disclosure is an offence (section 53).
Penalties
Failing to report a suspicious or unusual transaction is an offence under section 52, punishable by up to 15 years' imprisonment or a fine of up to R100 million (section 68). The FIC or a supervisory body may also impose administrative sanctions, including financial penalties of up to R10 million for a natural person and R50 million for a legal person (section 45C). An employee charged under section 52 may rely on having followed the institution's Risk Management and Compliance Programme or having reported the matter internally (section 69).
Section 29 checklist
- Record the date each alert fired or each fact came to light: that is when the 15 days start.
- Fit triage, investigation and approval inside 15 working days; do not add internal time.
- Choose the right report type: STR, SAR, TFTR or TFAR.
- File on goAML, attach supporting documents, pre-validate, and keep a copy.
- Keep the subject unaware, and control who knows about the report.
- Record any FIC direction under section 34 on the case.
Frequently asked questions
What is the deadline for a suspicious transaction report in South Africa?
As soon as possible, and no later than 15 days, excluding Saturdays, Sundays and public holidays, after becoming aware of the facts that give rise to the suspicion (regulation 24(3)).
When does the 15-day period start?
When the person becomes aware of the facts that will give rise to the report, which the FIC says is usually before the suspicion is formed. Internal alert and investigation time cannot be added to it.
Who must file a suspicious transaction report in South Africa?
Anyone who carries on, manages or works for a business, not only accountable institutions (section 29 of the FIC Act).
What is the difference between an STR and a SAR?
An STR reports a transaction or series of transactions between two or more parties; a SAR reports activity that does not involve such a transaction, enquiries about a transaction, or a transaction that was attempted or cancelled and never concluded. Terrorist-financing cases use TFTRs and TFARs.
Can we continue with a reported transaction?
Yes, unless the FIC directs you not to proceed under section 34, for up to 10 days excluding weekends and public holidays.
Suspicious transaction reporting with Creodata
Creodata's goAML Reporting Platform compiles parties, accounts and narrative in one STR workspace, generates schema-valid goAML XML, validates every report against the schema and business rules before submission, and keeps an immutable record of every report, amendment and filing. See goAML reporting software for South Africa, our South Africa FIC goAML reporting guide, and FICA compliance and AML software in South Africa for the monitoring and case management that produce the alerts.
See it on your own report types — request a demo.