Everything an accountable institution must have on file

A supervisory inspection asks for the same file every time: proof of registration under the correct item number, a written Risk Management and Compliance Programme, customer due diligence records, evidence of reports filed, training records, and the compliance officer's appointment.

Reviewed by TefCo Compliance Research — last verified 7 September 2026.

In short

The RMCP is the centrepiece — it is required by the Financial Intelligence Centre Act 38 of 2001, section 42.
Guidance Note 7A, finalised in February 2025, revised what the RMCP must cover.
Training and screening records are part of the RMCP, not an optional extra.

The core file

Proof of registration with the Centre under the correct Schedule 1 item number (FIC Act 38 of 2001, section 43B).
Written Risk Management and Compliance Programme (section 42), current and board-approved.
Compliance officer appointment record.
Customer due diligence records — identification and verification for every client, including beneficial owners.
Enhanced due diligence records for higher-risk clients and domestic and foreign prominent influential persons.
Sanctions and targeted financial sanctions screening records.
Copies of every cash threshold, suspicious transaction and terrorist property report filed, with goAML acknowledgements.
Copies of Risk and Compliance Returns submitted.
Employee training records covering the RMCP.
CIPC beneficial ownership filing confirmation for the institution itself.

What the RMCP has to actually do

An RMCP that repeats the Act is the most common finding. Guidance Note 7A, published in final form in February 2025, revised the guidance on what the programme must contain — how the institution identifies and assesses its own money laundering, terrorist financing and proliferation financing risk, and what it then does differently for high-risk relationships.

The Act does not fix a review interval. In practice, supervisors expect the programme to be reviewed whenever the business, its products or its risk picture change, and to be able to show when that last happened.

In March 2025 the Centre made a one-off call for supervised institutions to submit a copy of their RMCP. Keep a current, dated version that could be sent the same week if asked again.

Records retention

Due diligence and transaction records must be kept so that the Centre or a supervisory body can reconstruct a relationship. In practice that means keeping the identification documents, the risk rating that was applied and the reason for it, and the transaction history together rather than in three separate systems.

Frequently asked

Are we an accountable institution?

Check Schedule 1 to the Financial Intelligence Centre Act 38 of 2001 item by item. Legal practitioners, estate agents, trust and company service providers, crypto asset service providers, high-value goods dealers and credit providers are all captured under their own items.

How often must the RMCP be reviewed?

The Act sets no fixed interval. The safe practice is annually, plus whenever a new product, channel, jurisdiction or client type is added.

Does a small firm need a full compliance officer?

The obligation to appoint a person responsible for compliance applies regardless of size. In small firms it is usually a director, but the appointment must be recorded.

Sources

TefCo Corporate Compliance (Pty) Ltd is a compliance management platform, not a legal, tax or advisory firm. This guide is general information, not advice. Fees, dates and thresholds change — confirm current figures with the regulator before you rely on them.