ANTI-FINANCIAL CRIME LAWyers | south africa

The key laws making up the financial crime legal framework in South Africa include:

• • Prevention and Combating of Corrupt Activities Act, 2004;
  • Financial Intelligence Centre Act, 2001;
  • Prevention of Organised Crime Act, 1998;
  • Protected Disclosures Act, 2000; and
  • Protection of Constitutional Democracy Against Terrorist and Related Activities Act, 2004.

For Accountable Institutions under the Financial Intelligence Centre Act it is a requirement.

• The organisation lacks skill or experience to perform the services they are tendering for;
• If an organisation starts requesting payment on an urgent basis, or upfront payment;
• Generally secretive behaviour such as a person wanting to keep his/her involvement a secret or trying to share obviously confidential information; or
• Requests for payments into multiple bank accounts or offshore bank accounts.

Our law does not specifically define a bribe but it can be more than an exchange of cash and can include a gift or a kick-back. A bribe effectively secures an improper advantage or rewards improper conduct.

Fines and imprisonment are possible consequences. The maximum sentence is life imprisonment.

Financial crime is a broad umbrella covering illegal conduct that generates, moves, or conceals money improperly – including bribery and corruption, money laundering, terrorist financing, fraud, market abuse, and sanctions evasion. Most of what’s published on this topic online is written for the victims of fraud rather than the businesses managing the compliance side of the equation. For a business, financial crime risk isn’t primarily about being defrauded – it’s about the legal exposure of being connected to it: through a client, a supplier, a staff member, or a weak compliance process, a business can find itself implicated in, or liable for failing to prevent, financial crime it didn’t directly commit.

For South African businesses, the financial crime risks that matter most fall into five broad categories: fraud (internal or external, including procurement and invoice fraud), bribery and corruption (particularly in dealings with public officials or in competitive tender processes), money laundering (being used, knowingly or not, to move or conceal the proceeds of crime), market abuse (insider trading and market manipulation, relevant to listed and regulated entities), and sanctions evasion (transacting with sanctioned individuals, entities, or countries). Most businesses are exposed to more than one of these simultaneously through their customer base, supply chain, and staff – which is why a compliance programme needs to address all five rather than the one that feels most obviously relevant.

Effective financial crime prevention rests on a small number of connected building blocks: a documented risk assessment identifying where the business is actually exposed, board-approved policies addressing bribery, money laundering, and third-party risk specifically, proportionate due diligence on customers, suppliers, and other third parties before onboarding them, staff training that’s refreshed regularly rather than delivered once, and a clear internal reporting channel for concerns. Where a business qualifies as an “accountable institution” under FICA, these elements move from best practice to a legal requirement, with specific obligations set out in the Act itself.

An accountable institution under the Financial Intelligence Centre Act (FICA) is required to register with the Financial Intelligence Centre, develop and implement a Risk Management and Compliance Programme (RMCP), conduct customer due diligence (including identifying and verifying clients and, where relevant, beneficial owners), keep records of transactions and due diligence for the prescribed period, appoint a compliance officer, and report certain transactions – including suspicious and unusual transactions and cash transactions above the prescribed threshold – to the Financial Intelligence Centre. These obligations apply on an ongoing basis, not just at the point of onboarding a client. 

Accountable institutions are listed in Schedule 1 of FICA, and the category is broader – and has been expanded more recently – than many businesses assume. It includes the obvious categories (banks, financial services providers, and legal and accounting practitioners in certain circumstances) but also extends to businesses that deal in high-value goods above a prescribed single transaction threshold, and crypto asset service providers. A business that assumes FICA “doesn’t apply to us” because it isn’t a bank or a law firm should check its position against the current Schedule 1 list directly rather than relying on that assumption – the scope has moved in recent years specifically to catch businesses that previously fell outside it.

An effective anti-bribery and corruption programme should include a clear, board-approved policy prohibiting bribery in all forms (including facilitation payments and improper gifts and hospitality), risk-based due diligence on third parties – particularly agents, intermediaries, and government-facing counterparties – clear rules and approval thresholds for gifts, hospitality, and donations, a confidential reporting channel for concerns, and regular training tailored to the roles most exposed to bribery risk. South Africa’s Prevention and Combating of Corrupt Activities Act (PRECCA) makes both offering and accepting a bribe a criminal offence, and extends liability to corporates for the conduct of their employees and agents in some circumstances – which is exactly why a documented, actively used programme matters, not just a policy on file.

Where an accountable institution knows, or ought reasonably to have known or suspected, that a transaction or activity is related to money laundering, it’s required to report this to the Financial Intelligence Centre – and is prohibited from “tipping off” the client or third party involved that a report has been made. The report needs to be filed within the prescribed timeframe once the suspicion arises. Businesses should have a clear, documented internal escalation process so staff know exactly who to report a concern to internally, and that person in turn knows their obligations to the Financial Intelligence Centre – waiting to “gather more evidence” before reporting is a common and risky mistake.

South African companies are required to identify their beneficial owners – the natural persons who ultimately own or control the company – and file this information with the Companies and Intellectual Property Commission (CIPC), alongside maintaining an internal beneficial ownership register. This requirement was introduced as part of South Africa’s response to concerns about the use of opaque corporate structures to facilitate money laundering and corruption, and the specific filing mechanics and thresholds have been an active area of legislative change. Given the pace of updates here, businesses should confirm the current CIPC filing requirements directly rather than relying on older guidance.