Customer risk rating for South Africa, tuned to your board-approved RMCP and the published sector risk assessments.
Six weighted factors (country, industry or business type, product, delivery channel, customer behaviour, and PEP or sanctions exposure) that compliance sets to match the risk assessment in your RMCP, with a second reviewer on every manual override and reviews timed by risk band. The RMCP stays your institution's document: the module supplies the controls it describes and the audit trail behind each rating.
South Africa's rules in brief.
- Compliance programme
- Every accountable institution develops, documents, maintains and implements a Risk Management and Compliance Programme (FIC Act s.42)
- Approval
- Only the board, or senior management where there is no board; a committee may advise but cannot approve (FIC Guidance Note 7B, 3 August 2026)
- Governance
- The board or senior management answers for meeting the Act and the RMCP, and a legal person has a compliance function led by someone of sufficient competence and seniority (s.42A)
- Customer due diligence
- Identify the client (s.21), understand the business relationship (s.21A), identify beneficial owners and take reasonable steps to verify them (s.21B), keep due diligence ongoing (s.21C), and do not proceed where it cannot be done (s.21E)
- Life insurers at onboarding
- No premiums received or pay-outs made until the client's ML/TF risk is identified and its due diligence completed (FIC PCC 48, 2020)
- Banks
- Inherent money-laundering risk rated high for large, medium and small domestic banks, and residual risk medium-high (PA sector risk assessment, December 2025)
- Life insurers
- Inherent risk rated medium-high for money laundering, medium-low for terrorist financing and low for proliferation financing; main threats fraud, corruption and bribery, tax evasion and drug trafficking (PA, December 2025)
- Crypto asset service providers
- Inherent ML and TF risk rated high, and residual ML risk medium-high (FIC sector risk assessment, 1 April 2025)
Checked against primary sources on 1 October 2026.
What South Africa requires, and how the module handles it
FICA places the risk-based duties in the RMCP and the customer due diligence sections, and the Prudential Authority adds sector ratings and its own review topics. The duties below, their source, and the rating feature behind each:
| What South Africa requires | Where it sits | How the module handles it |
|---|---|---|
| Develop, document and implement the RMCP, approved by the board | FIC Act s.42; Guidance Note 7B | Overriding a rating takes approval from a second authorised reviewer, with the reason written down, so departures from the board-approved model are controlled and visible. |
| Understand each business relationship and keep customer due diligence ongoing | ss.21A and 21C | Each customer is scored on the six factors and placed in a risk band, and periodic reviews are then scheduled automatically for that band. |
| Identify the beneficial owners of legal persons, trusts and partnerships, and take reasonable steps to verify them | s.21B | Entity resolution and the beneficial-owner graph connect a corporate client to the people behind it, and their exposure carries into the client's score. |
| Strengthen business risk assessments, customer due diligence and beneficial-ownership verification, which the PA lists among banks' control areas needing enhancement | PA banking sector risk assessment, December 2025 | Compliance retunes factor weights and band cut-offs as configuration, without code, when a sector assessment or the business changes. |
| Calibrate the risk model in the RMCP, and carry out enhanced due diligence where the risk calls for it | PA sanction releases, December 2023 and September 2026 | A customer rated high-risk is routed to the enhanced due diligence workflow, which stops the file going stale between periodic reviews. |
| Show the PA that AML/CFT/CPF controls are effective, in a non-executive board member's presentation (banks give five years of evidence) | PA Prudential Communications 5 and 8 of 2026 | Where AI scoring is used, each score shows its top three reasons and a confidence level, and a person decides whether to accept, modify or reject it. |
Summaries of the primary texts as checked on 29 and 30 September and 1 October 2026: the FIC Act, FIC Guidance Note 7B and PCC 48, the Prudential Authority's December 2025 sector risk assessments, 2026 prudential communications and published sanctions, and the FIC's 2025 crypto asset sector risk assessment. Not legal advice.
Frequently asked questions.
Where does FICA set out customer risk duties?
In two places. Section 42 requires every accountable institution to develop, document, maintain and implement a Risk Management and Compliance Programme, and sections 21 to 21E set the customer due diligence duties: identify the client, understand the business relationship, identify beneficial owners and take reasonable steps to verify them, keep due diligence ongoing, and stop where it cannot be done.
Who has to approve the RMCP?
The board of directors, or senior management where there is no board. FIC Guidance Note 7B (3 August 2026) says the board cannot delegate the approval: a committee may advise on the RMCP, but the decision stays with the board. The Prudential Authority does not formally approve the RMCPs of the institutions it supervises.
How does the Prudential Authority rate banks and life insurers?
In its December 2025 sector risk assessments, the PA rated inherent money-laundering risk high for large, medium and small domestic banks, medium-high for foreign banks, medium for mutual banks and medium-low for co-operative banks. For life insurers it rated inherent money-laundering risk medium-high, and named fraud, corruption and bribery, tax evasion and drug trafficking as the main threats.
Can a life insurer accept premiums before it has rated a new client?
No. The FIC's PCC 48 says an institution may not receive funds, such as premiums or debit orders, or make pay-outs until the client's money-laundering and terrorist-financing risk has been identified and its due diligence completed. A nominated beneficiary becomes the client when the benefit vests.
What do Prudential Authority inspections find in customer due diligence?
The PA's December 2025 banking assessment lists business risk assessments, customer due diligence and beneficial-ownership verification among the controls that need enhancing. Its published sanctions have cited risk-model calibration in a bank's RMCP (2023) and separate penalties for customer, enhanced and ongoing due diligence failures (2026).
Does the software write our RMCP?
No. The RMCP is your institution's own document, approved by your board. The module supplies the controls it describes, a weighted six-factor rating, reviews by risk band and four-eyes overrides, together with the audit trail behind each rating.
See it on your own data.
Bring your own customers and scenarios to a live demo of the AML compliance software, set up for the country you report in.