--- title: "What is FICA Compliance, and How Digital Forms Make It Painless" description: "Plain-English guide to FICA compliance for South African businesses: which businesses are accountable institutions, what KYC information you must collect, and how digital forms streamline verification." author: FlexForms Team datePublished: 2026-05-01 dateModified: 2026-05-01 canonical: https://flexforms.co.za/Blog/what-is-fica-compliance tags: Compliance, FICA, KYC, South Africa --- # What is FICA Compliance, and How Digital Forms Make It Painless ## FICA in one paragraph The **Financial Intelligence Centre Act, 2001 (FICA)** is South Africa’s anti-money-laundering and counter-terror-financing law. It requires certain businesses — called *accountable institutions* — to know who their customers are, keep records of that information, and report suspicious transactions to the Financial Intelligence Centre (FIC). The customer-identification side of FICA is what most people mean when they say “FICA compliance”: collecting an ID copy, proof of address, and supporting information when onboarding a client. ## Who has to FICA? FICA applies to *accountable institutions* listed in Schedule 1 of the Act. The list was significantly expanded by the General Laws (Anti-Money Laundering and Combating Terrorism Financing) Amendment Act in 2022. It now includes, among others: - Banks, mutual banks, and the Postbank. - Authorised financial services providers (FSPs) and long-term insurers. - Attorneys and trust company service providers. - Estate agents and high-value-goods dealers (R100,000+ cash transactions). - Crypto asset service providers. - Co-operative banks and money-remittance providers. If you’re an accountable institution, you must be registered with the FIC, have a Risk Management and Compliance Programme (RMCP) in place, and conduct customer due diligence (CDD) on every client. ## What you actually have to collect FICA’s 2017 amendments shifted South Africa from a tick-box approach to a **risk-based approach**. The exact information you collect depends on the risk profile of the client, but the baseline for an individual is: - Full names and surname. - South African ID number (or passport number for non-citizens). - Date of birth. - Residential address. - Income tax number, if registered. - Source of funds and source of wealth (for higher-risk clients). For a juristic person (company, CC, trust), you’re also collecting registration documents, proof of address, names of directors / members / trustees, and identifying the **beneficial owners** — the natural persons who ultimately own or control the entity. ## What counts as a verified record? A FICA record needs to do three things: 1. **Identify** the client (the information above). 1. **Verify** the information against an independent source — an ID document, a recent utility bill, the CIPC register, the SARS database, or a sanctions / PEP screening service. 1. **Be retrievable** for at least five years after the business relationship ends, in a form that can be produced to the FIC on request. ## Why paper FICA folders go wrong The classic FICA failure mode is a filing cabinet of A4 envelopes with photocopied IDs, faded utility bills, and a sticky note saying “need to recheck address”. The compliance officer can’t tell at a glance which clients are out of date, which are missing documents, and which were screened against PEP and sanctions lists. When the FIC inspects, that ambiguity becomes a finding. ## How digital forms change the picture A purpose-built FICA onboarding form does the boring parts for you: - **Structured fields** — ID number is validated as you type, address is captured in components rather than free text, and required fields can’t be skipped. - **Document upload** — ID and proof of address attach to the record, not a separate folder. - **OTP signing** — the client confirms their information by entering a PIN sent to the mobile or email number on file. - **Audit trail** — every change, every signature, every download is timestamped. - **Renewal reminders** — when an address proof is older than 3 months or a record is approaching review date, the system flags it. ## What about POPIA? FICA forces you to collect personal information; POPIA tells you how to handle it once you have it. The two work together: - Collect only what FICA requires (data minimisation under POPIA). - Store it securely, with access controls and an audit log. - Tell the client what you’re collecting, why, and how long you’ll keep it — FICA’s 5-year retention is a legal basis for keeping it that long. - Have a plan for handling subject-access requests and deletion requests at the end of the retention period. ## Practical checklist - Confirm whether your business is an accountable institution under Schedule 1. - Register with the FIC via the goAML portal if you are. - Build (or buy) a digital onboarding form that captures the FICA fields and supporting documents in one go. - Add PEP and sanctions screening — either via an integrated service or as a separate workflow. - Store records electronically with retention dates, retrievable for at least 5 years. - Document the whole process in your Risk Management and Compliance Programme (RMCP). *This article is general information and not legal or compliance advice. For your business’s obligations, consult a qualified compliance professional or attorney.* --- Published by [FlexForms](https://flexforms.co.za) — send secure, OTP-authenticated forms via WhatsApp or email, capture e-signatures, and get branded PDFs back. Operated by OrganiCode (Pty) Ltd, South Africa.