Accountable institutions must develop, document, maintain and implement a risk management and compliance programme (RMCP) for ant-money laundering (AML), counter-terrorist financing (CTF), and counter proliferation financing (CPF). The accountable institution’s RMCP documentation must record all the elements of the programme as set out in section 42 of the FIC Act.
It is important that Accountable institutions acknowledge in their RMCPs that the board of directors (where the accountable institution is a legal person with a board of directors), or the senior management of an accountable institution without a board of directors, is ultimately responsible for ensuring that the accountable institution implements and complies with their RMCPs.
An Accountable institution that is a legal person must have a compliance function and design a person with sufficient competent and seniority to assist the board of directors or senior management in complying with the FIC Act and their RMCP. An Accountable institution that is not a legal person (except a sole proprietor) must appoint a person with sufficient competence as the compliance officer.
The RMCP must adequately address the full scope of section 42 of the FIC Act. The board of directors, senior management or other person(s) with the highest authority should ensure that the RMCP is adequate, suitable and effective for the accountable institution.
On the 7th of November 2025 the Prudential Authority (PA), statutory body regulating the compliance of the FIC Act, announced that it has imposed administration sanctions on Discovery Bank Limited – including a fine of R3 million – for non-compliance with the Financial Intelligence Centre Act (FICA).
The PA detected the non-compliance when it conducted an inspection in 2021. The samples assessed covered the period from 1 July 2019 to 31May 2021.
The following non-compliance were found:
- Late submission of suspicious activity reports – Discovery Bank failed timeously to submit 24 suspicious and unusual transaction reports or suspicious and unusual activity reports to the FIC, as required by section 29 read with section 42 of FICA and Regulation 24(3) of the FICA Regulations. The PA cautioned the bank not to repeat the conduct that led to the non-compliance and imposed a fine of R1m, of which R500 000 was conditionally suspended for 36 months.
- Failure to provide FICA training – The bank failed to provide as prescribed by its Risk Management and Compliance Programme (RMCP), per section 43 of FICA. Specifically, 84 out of 155 of its new employees did not receive training within 30 days of being appointed; 47 out of 109 of its employees did not receive annual refresher training within a year; and two out of six of its senior management had not received training within 30 days of being appointed. The PA cautioned the bank and imposed a fine of R1m.
- Delayed attention to monitoring alerts – Discovery Bank failed timeously to attend to 2 281 of its automated transaction monitoring system alerts within the prescribed period of 48 hours, as required by Directive 5/2019. The bank was cautioned and fined R1m, of which R500 000 was conditionally suspended for 36 months.
- Deficiencies in the RMCP – The bank failed to comply with section 42 of FICA because it did not provide evidence that it had documented the step-by-step working methods and or listed the trigger events that would require it, the bank to review its RMCP. The RMCP also did not define a “business day” for the purposes of identifying cash transactions to be reported in terms of section 28 read with section 42 of the FIC Act. The bank was cautioned not to repeat the conduct that led to the non-compliance. The PA said it received Discovery Bank’s co-operation in undertaking the remedial action required to address the identified compliance deficiencies and control weaknesses.
For more information, get in touch.
Tel: 011 367 0636
Dr Pete Mhlanga
Morningside Consulting and
Training Group (Pty) Ltd
66 Park Lane
Sandton 2196
