The problem most small practices have
The Schedule 1 amendments brought a lot of practices into scope that had never dealt with the Financial Intelligence Centre before. Registration was the easy part. The difficulty is everything after it: a written programme, client risk ratings, due diligence that actually happens on every file, records that can be produced on request, and training that can be evidenced.
Most practices don't need a compliance department. They need someone who has done it before to sit down, work out what applies to them specifically, and put a workable programme in place that the firm can actually follow.
The whole thing, in five parts
A compliance programme is a lot to hold in your head at once. In practice it comes down to five things, worked through in this order.
-
01
Risk
The four risk areas
The firm, its services, its clients and its employees — each rated. Set out below.
-
02
Language
Terminology and definitions
The terms the Act uses, defined so that everyone in the firm reads a file the same way.
-
03
Documents
Supporting documents
The RMCP, rating sheets, intake and verification forms, registers and training records.
-
04
Lifecycle
The client cycle
From take-on through to reporting — the nine steps set out below.
-
05
Duties
Duties to the Centre
What goes to the FIC, and what comes back — each carries a duty:
- To report
- To freeze assets
- Not to conduct business
- Not to tip off
The client cycle — nine steps
- 1 Risk assess
- 2 Identify and verify the client
- 3 Identify and verify beneficial owners
- 4 Screen the client and beneficial owners
- 5 Risk rate the beneficial owner
- 6 Document and record
- 7 Reminder letters
- 8 Ongoing monitoring
- 9 Reporting
The four risk areas in a firm
Before any of the due diligence work makes sense, the firm has to know where its own risk sits. A business risk assessment looks at four areas. Three of them are assessed and rated on their own, and those ratings feed upward into the fourth — the firm itself.
The Firm
The firm's rating is driven by the results of the three areas below, plus three things that belong to the firm alone.
How the firm conducts business and takes clients on — face to face, remotely, online, or through an intermediary.
Where the firm operates from, where its clients and their funds sit, and whether a higher-risk jurisdiction is involved.
The services offered, the volume of work, and how many people are involved in a single file.
Products and Services
- Cash-based transactions
- Crypto and virtual assets
- Trust and company formation work
- Holding or moving client funds
- Complex or cross-border structures
- New services taken on without assessment
Clients
- Type of client — individual, company, trust
- How complex the beneficial ownership is
- Prominent influential persons and associates
- Cash-intensive or high-risk industries
- Where the client is based and operates
- Source of funds and how well the client is known
Employees
- Screening before appointment
- Training received, and whether it is evidenced
- Access to client funds, records and systems
- Awareness of reporting duties
- Staff turnover and reliance on one person
- Whether the programme is actually followed
Each area is rated on its own factors, and those ratings feed into the firm's rating
The firm's rating is not an average of the three. A single high-risk factor — one crypto client, one service line that moves money — can lift the firm's rating on its own, and the assessment has to explain why it did or didn't. This assessment is what the RMCP is built on, so it needs to be documented, approved, and revisited when the client base, the service list or the staff complement changes.
What we help with
- Scoping. Working through your actual service list to establish whether, and on what basis, the practice is an accountable institution.
- Business risk assessment. Identifying where the money laundering and terrorist financing risk sits in your client base and your services, and rating it.
- RMCP drafting. A programme written around how your practice works, not a template with your name at the top.
- Client due diligence. Practical identification and verification processes, including enhanced due diligence and ongoing monitoring, that fit into how files are actually opened.
- Implementation. Getting the programme into daily use — forms, file requirements, who does what, and staff training.
- Inspection readiness. Making sure the evidence exists and can be produced, and walking the file before it goes across.
Common questions
What are the four risk areas in a FICA business risk assessment?
The firm, its products and services, its clients, and its employees. Products and services, clients and employees are each assessed and rated on their own factors, and those ratings feed upward into the firm's overall rating. The firm's rating also takes in two things that belong to the firm alone: its delivery channels, meaning how it conducts business and takes clients on, and its geographic location, meaning where it operates and where its clients and their funds sit. The firm's rating is not an average of the other three — a single high-risk factor can lift it.
What is customer due diligence under FICA?
Customer due diligence is the process of identifying and verifying who your client is, establishing who the beneficial owners are, understanding the purpose of the relationship, and keeping that information current for as long as the relationship lasts. The depth of the work depends on the risk rating given to the client, and how you decide that rating must be set out in your Risk Management and Compliance Programme.
What are the types of due diligence?
There are three levels plus an ongoing obligation. Standard due diligence is the baseline applied to most clients. Simplified due diligence is a reduced level of verification permitted where the risk is demonstrably low and your RMCP allows for it. Enhanced due diligence applies additional measures to higher-risk clients, including prominent influential persons, and covers source of funds, source of wealth and senior approval. Ongoing due diligence runs for the life of the relationship — monitoring activity, keeping client information current and revisiting the risk rating when circumstances change.
When is enhanced due diligence required?
Enhanced due diligence is required for domestic and foreign prominent influential persons, their immediate family members and known close associates, and for any client, structure, product or jurisdiction that your own risk assessment rates as high. In practice it means going further on source of funds and source of wealth, obtaining senior approval before taking the client on, and monitoring the relationship more closely than a standard-risk client.
Are accountants FIC accountable institutions?
Many are, but not all. Whether a practice is an accountable institution depends on the services it provides rather than on it being an accounting firm. Trust and company service work brings a practice in; routine bookkeeping, compiling financial statements and filing tax returns on their own generally do not. The test is the activity, so a practice should assess its actual service list rather than assume either way.
When did accountants become accountable institutions?
Schedule 1 to the Financial Intelligence Centre Act was amended at the end of 2022, which brought several new categories of business into scope. Practices caught by the change were required to register with the Financial Intelligence Centre and to have a Risk Management and Compliance Programme in place. Many small practices are still working through what that means for them.
What is an RMCP and who must have one?
A Risk Management and Compliance Programme is the written document setting out how an accountable institution identifies, assesses and manages money laundering and terrorist financing risk. Every accountable institution must have one. It covers client due diligence, risk rating, record keeping, reporting obligations, training and the roles of the people responsible for compliance.
Can I use an RMCP template?
A template is a reasonable starting point but it is not compliance on its own. An RMCP has to reflect the way your practice actually works, the clients you actually take on and the risks you actually face. An inspector reads it against your real processes, so a generic document that nobody in the firm follows is worse than no document, because it demonstrates the gap.
Who is responsible for FICA compliance in a firm?
Accountability sits with the board or the senior management of the institution. They must approve the RMCP and make sure it is implemented. A compliance officer may be appointed to run the programme day to day, but appointing one does not move the responsibility off the people running the firm.
What happens during an FIC inspection?
An inspection tests whether your written programme matches your practice. Expect to produce the RMCP itself, evidence of client due diligence on a sample of files, your risk ratings, training records, and proof of registration and of any reporting done. The most common finding is not an absent document but a document that the firm has not actually followed.
Who does this work
Bernice Kruger, Chartered Business Accountant in Commerce (CIBA). Earlier FICA exposure came from working inside a financial services provider; the compliance work since has been drafting and implementing Risk Management and Compliance Programmes for practices newly brought into scope, and taking one through its first FIC audit.
Based in Centurion, working with practices across Gauteng and countrywide. More about the practice.