--- title: "What Must a FICA Verification Collect? The KYC Checklist" description: "A practical FICA verification checklist for South African accountable institutions: the KYC fields to collect for individuals and businesses, the five-year record-keeping rule, and PEP and source-of-funds requirements." author: FlexForms Team datePublished: 2026-06-30 dateModified: 2026-06-30 canonical: https://flexforms.co.za/Blog/fica-verification-checklist tags: Compliance, FICA, KYC, South Africa --- # What Must a FICA Verification Collect? The KYC Checklist ## The short answer A [FICA](https://flexforms.co.za/Home/Glossary#fica) verification has to establish and record **who your customer is** and **where they live**, plus — depending on risk — **where their money comes from** and whether they are a [politically exposed person](https://flexforms.co.za/Home/Glossary#pep). For an individual that means, at minimum: full name, identity number, a verified identity document, and proof of residential address. For a business you also verify the entity and its beneficial owners. FICA doesn’t just ask you to *look* at these documents — it requires you to **keep a record** of the verification for at least five years. That record-keeping is where paper-based KYC usually falls apart. ## The FICA / KYC checklist for individuals - **Full legal name** and **date of birth**. - **South African ID number** (or passport number for foreign nationals). - **A copy of the identity document** — green ID book, smart ID card, or passport. - **Residential address**, plus **proof of address** not older than three months (utility bill, bank statement, municipal account, lease). - **Contact details** — mobile number and email. - **Source of funds / source of wealth** where the risk rating calls for it. - **PEP declaration** — whether the person, or a close associate, holds a prominent public position. - **Tax number** where relevant to the product or service. ## What about verifying a business (juristic person)? For a company, close corporation, trust, or partnership you verify the entity *and* the humans behind it: - Registered name and registration number (CIPC documents). - Registered and trading address. - Identity verification of directors, members, or trustees. - **Beneficial ownership** — the natural persons who ultimately own or control the entity. - Authority of the person acting on the entity’s behalf (resolution or mandate). ## Who has to do FICA verification? FICA obligations apply to **accountable institutions** listed in Schedule 1 of the Act — banks, attorneys, estate agents, financial service providers, accountants, casinos, money remitters, crypto asset service providers, and others. If you’re on that list, you must verify customers before (or shortly after) establishing a business relationship, apply a [risk-based](https://flexforms.co.za/Home/Glossary#kyc) approach, and keep records. The [KYC](https://flexforms.co.za/Home/Glossary#kyc) process is the practical mechanism for meeting those duties. ## How long must FICA records be kept? FICA requires accountable institutions to retain identification and verification records, and records of transactions, for at least **five years** from the end of the business relationship or the date of the transaction. The records must be retrievable and able to be produced to the Financial Intelligence Centre on request — another reason a searchable digital store beats a filing cabinet. ## How do digital forms streamline FICA? The hard part of FICA isn’t knowing what to collect — it’s collecting it cleanly, verifying identity, and keeping a five-year, audit-ready record. Digital KYC forms help by: - **Capturing documents directly** — ID and proof-of-address uploads in one submission. - **Verifying identity** — an [OTP](https://flexforms.co.za/Home/Glossary#otp) ties the submission to a real, contactable person. - **Built-in PEP and source-of-funds fields** so nothing is skipped. - **A retained, searchable record** with a tamper-evident audit trail, sealed into a PDF. The FlexForms [FICA / KYC template](https://flexforms.co.za/Templates/fica-kyc) covers the standard fields out of the box — identity document, proof of address, source of funds, and PEP declaration — and you can tailor it to your institution’s risk rating. For the bigger picture, read [What is FICA Compliance](https://flexforms.co.za/Blog/what-is-fica-compliance). ## Frequently asked questions ### What documents are needed for FICA verification? For an individual: a valid identity document (ID book, smart ID card, or passport) and proof of residential address not older than three months, such as a utility bill, bank statement, or lease. Higher-risk customers may also need source-of-funds evidence and a PEP declaration. ### How long must FICA records be kept? At least five years from the end of the business relationship or the date of the transaction, and the records must be retrievable on request by the Financial Intelligence Centre. ### Who must comply with FICA? Accountable institutions listed in Schedule 1 of FICA, including banks, attorneys, estate agents, financial service providers, accountants, casinos, money remitters, and crypto asset service providers. ### What is a PEP and why does it matter for FICA? A politically exposed person holds a prominent public function, or is a close family member or associate of someone who does. FICA requires enhanced due diligence on PEPs because of the elevated risk of corruption and money laundering, so KYC forms include a PEP declaration. *This article is general information about South African law and is not legal or compliance advice. Apply your institution’s own risk-based FICA programme and consult a compliance professional where needed.* --- Published by [FlexForms](https://flexforms.co.za) — send secure, OTP-authenticated forms via WhatsApp or email, capture e-signatures, and get branded PDFs back. Operated by OrganiCode (Pty) Ltd, South Africa.