What Must a FICA Verification Collect? The KYC Checklist

The short answer

A FICA verification has to establish and record who your customer is and where they live, plus — depending on risk — where their money comes from and whether they are a politically exposed person. For an individual that means, at minimum: full name, identity number, a verified identity document, and proof of residential address. For a business you also verify the entity and its beneficial owners.

FICA doesn’t just ask you to look at these documents — it requires you to keep a record of the verification for at least five years. That record-keeping is where paper-based KYC usually falls apart.

The FICA / KYC checklist for individuals

• Full legal name and date of birth.
• South African ID number (or passport number for foreign nationals).
• A copy of the identity document — green ID book, smart ID card, or passport.
• Residential address, plus proof of address not older than three months (utility bill, bank statement, municipal account, lease).
• Contact details — mobile number and email.
• Source of funds / source of wealth where the risk rating calls for it.
• PEP declaration — whether the person, or a close associate, holds a prominent public position.
• Tax number where relevant to the product or service.

What about verifying a business (juristic person)?

For a company, close corporation, trust, or partnership you verify the entity and the humans behind it:

• Registered name and registration number (CIPC documents).
• Registered and trading address.
• Identity verification of directors, members, or trustees.
• Beneficial ownership — the natural persons who ultimately own or control the entity.
• Authority of the person acting on the entity’s behalf (resolution or mandate).

Who has to do FICA verification?

FICA obligations apply to accountable institutions listed in Schedule 1 of the Act — banks, attorneys, estate agents, financial service providers, accountants, casinos, money remitters, crypto asset service providers, and others. If you’re on that list, you must verify customers before (or shortly after) establishing a business relationship, apply a risk-based approach, and keep records. The KYC process is the practical mechanism for meeting those duties.

How long must FICA records be kept?

FICA requires accountable institutions to retain identification and verification records, and records of transactions, for at least five years from the end of the business relationship or the date of the transaction. The records must be retrievable and able to be produced to the Financial Intelligence Centre on request — another reason a searchable digital store beats a filing cabinet.

How do digital forms streamline FICA?

The hard part of FICA isn’t knowing what to collect — it’s collecting it cleanly, verifying identity, and keeping a five-year, audit-ready record. Digital KYC forms help by:

• Capturing documents directly — ID and proof-of-address uploads in one submission.
• Verifying identity — an OTP ties the submission to a real, contactable person.
• Built-in PEP and source-of-funds fields so nothing is skipped.
• A retained, searchable record with a tamper-evident audit trail, sealed into a PDF.

The FlexForms FICA / KYC template covers the standard fields out of the box — identity document, proof of address, source of funds, and PEP declaration — and you can tailor it to your institution’s risk rating. For the bigger picture, read What is FICA Compliance.

Frequently asked questions

This article is general information about South African law and is not legal or compliance advice. Apply your institution’s own risk-based FICA programme and consult a compliance professional where needed.