Skip to content

Client Onboarding & KYC

Applicable Legislation

Act Section What It Governs
FICA §20A–21 Accountable institutions must identify and verify clients before concluding a business relationship or transacting
FICA §22–23 Must establish and record the beneficial owner of a legal person/trust
FICA §24 Risk management and compliance programme (RMCP) required
FICA §26–27 Ongoing due diligence — must keep client data current
FIC Regulations §22A Record keeping — prescribed periods for retaining KYC documents
PPA §48 Practitioner must keep proper records of transactions
POPIA §13 Purpose limitation — only collect KYC data for the lawful purpose of verifying identity

✅ Compliance Checklist

  • Identity of client (seller, buyer, landlord, tenant) is verified before accepting a mandate or presenting an offer — not after

  • Verification using valid original or certified copy of:

  • ✅ South African ID (green ID book, smart ID card)

  • ✅ Passport + valid visa/permit for foreign nationals

  • ✅ Company registration documents for legal entities

  • Beneficial ownership established — who ultimately owns/controls the entity (FICA §22)

  • Source of funds established for high-value or suspicious transactions
  • A Risk and Compliance Return (RCR) is filed with the FIC annually if required
  • Copies of KYC documents are kept for 5 years after the relationship ends
  • RMCP (Risk Management and Compliance Programme) is documented and available
  • Suspicious Transaction Report (STR) process is known — report to FIC within 15 days
  • Ongoing due diligence — client data is re-verified if relationship continues for extended period

❌ Prohibited Actions

  • ✗ Entering into a mandate relationship before completing FICA verification
  • ✗ Relying on a copy of an ID sent via WhatsApp as sufficient verification — must be original or certified
  • ✗ Processing cash transactions above a threshold without reporting
  • ✗ Ignoring red flags because "the client seems trustworthy" — wilful blindness is an offence
  • ✗ Destroying KYC records before the 5-year retention period expires

⚠️ Warning Flags

  • "I'll send you my ID later" — later means before mandate acceptance. Not after. FICA doesn't bend on timing.
  • Trust purchases — you MUST identify the trustees and beneficiaries, not just the trust itself.
  • Foreign buyers — verify their passport AND South African visa/permit; keep a copy of both.
  • Multiple offers on one property — you need KYC on each prospective buyer, even unsuccessful ones (data retention applies to all).
  • Cash offers over R50,000 — may trigger FIC reporting obligations.