South African Regulatory Glossary

A set of procedures, laws, and regulations designed to prevent criminals from disguising illegally obtained funds as legitimate income. Central to FICA compliance in South Africa.

Businesses listed in Schedule 1 of FICA that must comply with customer identification, record-keeping, and reporting requirements. Includes banks, estate agents, attorneys, and accountants.

Identity verification using unique biological characteristics such as fingerprints, facial features, or iris patterns. Used to confirm identity against official records like HANIS.

The natural person(s) who ultimately owns or controls a legal entity, typically defined as holding 25% or more of shares or voting rights, or exercising control through other means.

The standard level of identity verification required under FICA when establishing a business relationship. Includes verifying identity, understanding the nature of the business relationship, and ongoing monitoring.

South African government agency responsible for company registration, intellectual property, and maintaining the public register of companies, close corporations, and co-operatives.

A report that must be filed with the FIC for cash transactions above R24,999.99. Required under FICA for all accountable institutions.

Measures to detect and prevent the use of funds to finance terrorist activities. Often combined with AML efforts under FICA requirements.

Under POPIA, the person to whom personal information relates. Data subjects have rights including access to their information, correction, and objection to processing.

A higher-risk FICA measure under section 21A, including closer monitoring, source-of-funds evidence, senior-management approval and reporting for PEPs and other higher-risk customers. Ongoing AML monitoring can supply screening evidence for those EDD reviews after onboarding.

South African legislation (Act 38 of 2001) that requires accountable institutions to verify customer identities, keep records, and report suspicious transactions to the Financial Intelligence Centre (FIC).

The South African government agency responsible for identifying proceeds of crime, combating money laundering, and overseeing FICA compliance by accountable institutions.

Biometric technology that compares facial features between two images to determine if they are the same person. Used to verify selfies against ID photos or HANIS records.

South Africa's national identity database managed by the Department of Home Affairs. Contains biographic and biometric information for all South African citizens and permanent residents.

The independent body established under POPIA to monitor and enforce compliance with data protection legislation, handle complaints, and issue guidance on personal information processing.

The process of verifying customer identity before establishing a business relationship. Required under FICA for all accountable institutions in South Africa.

Technology that assesses a biometric capture for signs associated with a live presentation rather than a presentation attack. It is a risk signal, not proof of identity.

The South African regulatory body responsible for overseeing the credit industry, enforcing the National Credit Act, and registering credit providers and credit reporting entities.

South African legislation (Act 34 of 2005) that regulates the credit market, promotes responsible lending, and protects consumers from reckless credit granting.

Customer due diligence after onboarding. Under FICA, accountable institutions must keep understanding the customer, watch for material changes, and repeat screening when identity details, risk or published lists change.

The FICA and FATF term for customer due diligence after onboarding: keep understanding the customer, watch for material change, and repeat checks when identity, risk or published lists change. Also called ongoing CDD. VerifyNow AML on the licensed API supports the screening part of ODD and can supply evidence for enhanced due diligence (EDD) reviews after onboarding.

South Africa's data protection law (Act 4 of 2013) that governs how personal information must be processed, stored, and protected. Similar to GDPR in the European Union.

Keeping Know Your Customer controls current instead of relying only on a periodic file review. Ongoing AML and customer screening against refreshed sanctions and PEP lists is one pKYC control, alongside ongoing due diligence (ODD).

An individual who holds or has held a prominent public position, or their close associates and family members. PEPs require enhanced due diligence under FICA.

A documented programme required under FICA that outlines how an accountable institution identifies, assesses, and manages money laundering and terrorist financing risks.

A regulatory approach that requires institutions to allocate compliance resources based on the assessed risk level of customers and transactions. Higher-risk situations require enhanced measures.

Under POPIA, the public or private body, or any other person, that determines the purpose and means of processing personal information. Similar to "data controller" in GDPR.

A report that accountable institutions must file with the FIC when they suspect a transaction involves the proceeds of crime or is related to money laundering or terrorist financing.

The process of checking individuals and entities against international sanctions lists (UN, EU, OFAC, etc.) to ensure compliance with trade restrictions and prevent prohibited transactions.