Transaction monitoring for South Africa: Directive 5's 48-hour alert rule, the 15-day STR and the R49,999.99 cash line.
Batch files and streaming payments run through the same rule engine, with a starter pack of rules aligned to common typologies and back-testing on historical data before any rule goes live. Each alert becomes an owned case with a deadline, and suspicious and threshold reports reach the FIC on goAML after draft, review and approval.
South Africa's rules in brief.
- Suspicious and unusual transaction reports
- As soon as possible, and no later than 15 days (excluding weekends and public holidays) after becoming aware of the facts, which is usually before a suspicion is formed (s.29; reg 24(3))
- Alerts
- With an automated monitoring system, every alert is attended to within 48 hours (two business days), and the STR is due within 15 days of the alert (FIC Directive 5 of 2019; PCC 45)
- System review
- Effectiveness reviewed and approved at least once a year by the board or senior management; using an automated system is optional (Directive 5; PCC 45)
- Cash threshold reports
- Cash above R49,999.99 paid to or received from a client, within 3 days (excluding weekends and public holidays); EFTs, wire transfers and bank cheques are not cash (s.28; reg 24(4))
- Counting cash
- Only the cash part of a transaction is reported; cash received and cash paid are separate reports; foreign currency is converted at the rate at the time of the transaction
- Split cash
- Not aggregated for a cash threshold report, but transactions structured to avoid a report are considered for an STR (s.29(1)(b)(iii))
- Records
- At least 5 years from the end of the relationship, the conclusion of a single transaction or the date a section 29 report was submitted (s.23)
- Inspection findings
- Deficient monitoring rules at 18 banks, inadequate alert investigation at 14 and missed 48-hour alert reviews at 10 (PA banking sector risk assessment, December 2025)
- Volumes in 2025/26
- The FIC received 10,863,741 reports; banks filed 4,074,930 cash threshold reports and 485,520 suspicious transaction reports (FIC Annual Report 2025/26)
Checked against primary sources on 1 October 2026.
What South Africa requires, and how the module handles it
Sections 28 and 29 of the FIC Act, regulation 24 and FIC Directive 5 set the clocks a South African monitoring programme runs to. Listed here: the duty, the text it comes from, and the monitoring feature that answers it:
| What South Africa requires | Where it sits | How the module handles it |
|---|---|---|
| Report what you know, suspect or ought reasonably to have suspected, including attempted transactions and enquiries that were never concluded | FIC Act s.29(1)–(2) | The same rules, written in the engine's own rule language, run on streaming payments as they arrive and on overnight batch files. |
| Attend to each automated alert within 48 hours, and file within 15 days of the alert, with no time added for internal review | Directive 5 of 2019; PCC 45; Guidance Note 4B | Each alert becomes a case with an owner and a deadline, and the STR passes draft, review and approval before submission to the FIC on goAML. |
| Report cash above R49,999.99, paid or received, within 3 days, counting only the cash portion | s.28; reg 24(4); Guidance Note 5C | A rule in the engine's rule language can be set at the R49,999.99 line, and the threshold report follows the same approval path to goAML. |
| Consider an STR where cash is split below the line to avoid a report | Guidance Note 5C; s.29(1)(b)(iii) | A starter pack of rules and a typology library, aligned with common laundering patterns, to switch on and tune instead of writing every rule from scratch. |
| Have the board or senior management review and approve the system's effectiveness at least annually | Directive 5 of 2019 | Before a rule changes, a back-test on historical data shows its alert volumes and outcomes; the change goes live as a new version and the previous one stays on file for audit. |
| Watch accounts daily, since knowledge of a cash deposit can arise from a bank statement or deposit slip | Guidance Note 5C | Connectors for ISO 20022, Kafka, change data capture, REST and SFTP use idempotency, replay and a dead-letter queue, so a failed load is flagged instead of leaving a silent gap; a data-requirements service shows which rules have the fields they need to fire. |
Summaries of the primary texts as checked on 29 and 30 September and 1 October 2026: the FIC Act, regulation 24 of the Money Laundering and Terrorist Financing Control Regulations, Guidance Notes 4B and 5C, Directive 5 of 2019 and PCC 45, the PA's December 2025 banking sector risk assessment and the FIC Annual Report 2025/26. Not legal advice.
Frequently asked questions.
How long do we have to file an STR with the FIC?
As soon as possible, and no later than 15 days after becoming aware of the facts that give rise to the suspicion, excluding Saturdays, Sundays and public holidays (regulation 24(3)). The FIC says the 15 days usually start before a suspicion is formed, and that time for alert handling or internal review cannot be added on top. Late filing is condoned only in exceptional cases, on application to the FIC.
What does Directive 5 require of automated transaction monitoring?
FIC Directive 5 of 2019 applies to institutions that use an automated transaction monitoring system. Every alert must be attended to within 48 hours, which PCC 45 counts as two business days. The institution is deemed to know of the possible suspicion once the alert is generated, so the STR is due within 15 days of the alert. The board or senior management reviews and approves the system's effectiveness at least annually.
Is automated transaction monitoring mandatory in South Africa?
Not under the FIC's rules: PCC 45 says using an automated system is not mandatory. The Prudential Authority encourages the banks and life insurers it supervises to use effective transaction-monitoring systems, and once a system is in use, Directive 5 applies.
What counts as cash for a cash threshold report?
Coin, paper money and travellers' cheques; EFTs, wire transfers, bank cheques and drafts do not count. A report is due when cash above R49,999.99 is paid to or received from a client, a person acting for the client or a person the client acts for, within 3 days excluding weekends and public holidays. Where a transaction is partly in cash, only the cash portion is reported.
Should smaller cash amounts be aggregated into one report?
No. Cash below the threshold is not aggregated into a cash threshold report. Where transactions look structured to avoid the reporting duty, Guidance Note 5C says to consider an STR under section 29(1)(b)(iii), and structuring to avoid a reporting duty is itself an offence under section 64.
Does the software decide whether to file an STR?
No. Rules, and machine-learning scores if you switch them on, raise alerts; an analyst makes the decision, and every AI score shows its top three reasons and a confidence level. Reports pass draft, review and approval before they are submitted through goAML.
See it on your own data.
Bring your own customers and scenarios to a live demo of the AML compliance software, set up for the country you report in.