FICA basics for merchants: what applies to your business

The Financial Intelligence Centre Act (FICA) is South Africa's anti-money-laundering law. For most merchants it matters in three ways: your bank and payment providers must verify your business before letting you collect money (that's why onboarding asks for documents), every business must report suspicious and unusual transactions to the Financial Intelligence Centre, and some businesses (such as high-value goods dealers, estate agents and attorneys) are accountable institutions with much heavier obligations.

This is general information. The Financial Intelligence Centre (FIC) publishes the Act, guidance notes and registration details.

Why payment providers ask for so many documents

Banks, and many payment service providers, are accountable institutions under FICA, or work under a bank that is. Before they can process payments for you, they must identify and verify you and understand your business. Typical requests:

They'll also ask what you sell, your expected volumes and your website. Answer accurately: selling something different from what you declared can lead to your account being suspended.

Beneficial ownership matters: providers must identify the natural persons who ultimately own or control a company. Companies must also keep a beneficial ownership register and file it with CIPC.

Obligations every business has

Even if you're not an accountable institution, section 29 of FICA applies to any person who carries on a business, is in charge of or manages a business, or is employed by one. If you know or suspect that:

• your business has received or is about to receive the proceeds of crime,
• a transaction has no apparent business or lawful purpose,
• a transaction is structured to avoid reporting thresholds, or
• the business is being used for money laundering or terrorist financing,

you must report it to the FIC. Reports are made electronically through the FIC's reporting system. You must not tip off the person involved.

For a normal merchant this looks like: a customer who wants to pay a large amount in cash and then asks for a refund by EFT to a different account, repeated overpayments with refund requests, or payments from unrelated third parties for one customer's account.

Are you an accountable institution?

FICA's Schedule 1 lists accountable institutions. The list was expanded with effect from 19 December 2022. Examples include banks, attorneys, estate agents, long-term insurers, trust companies, crypto asset service providers and high-value goods dealers: businesses that deal in goods valued at R100,000 or more and receive payment of R100,000 or more for them (in a single transaction or linked transactions).

Accountable institutions must, among other things:

• Register with the FIC.
• Have a Risk Management and Compliance Programme (RMCP).
• Identify and verify clients (customer due diligence), including beneficial owners.
• Keep records of client information and transactions.
• Report cash transactions above the prescribed threshold, suspicious transactions and terrorist property.
• Train staff and appoint a compliance officer.

If you sell vehicles, jewellery, art or other high-value goods, check the FIC's guidance to see whether you're caught.

FICA and your debit orders

Your customers' banks also apply FICA to their account holders. If a customer's bank account is restricted because the customer hasn't updated their FICA documents, debit orders can be returned unpaid. Netcash, for example, lists unpaid code 56 "Not FICA compliant". Treat it like a data problem: contact the customer and collect another way until it's resolved. See unpaid debit order reason codes.

Practical steps for merchants

• Keep your company records, beneficial ownership information and director details current (CIPC and your providers)
• Keep an up-to-date bank confirmation letter on file for onboarding
• Describe your products and expected volumes accurately to payment providers
• Brief staff on red flags and who to tell
• Refund only to the original payment method or account (see EFT proof of payment)
• Check whether you're an accountable institution if you deal in high-value goods
• Keep transaction records in line with record keeping requirements

FICA and POPIA

FICA requires collection and retention of identity information; POPIA requires you to protect it and use it only for lawful purposes. The two work together: collect what FICA (or your provider) requires, secure it, and don't reuse it for unrelated purposes. See POPIA and customer payment data.

How CentraPoint helps

CentraPoint isn't a FICA compliance tool, but it supports good practice: every payment, refund and debit order is recorded against a customer with an audit trail, refunds are tied to original transactions, and roles and permissions limit who can change customer banking details. Onboarding with each payment gateway (including FICA verification) happens directly with that provider. See security and the gateways page.

Frequently asked questions

Does FICA apply to small businesses?

Every business must report suspicious and unusual transactions under section 29. The heavier obligations (registration, customer due diligence, compliance programmes) apply to accountable institutions listed in Schedule 1.

Why does my payment provider need my ID and company documents?

Banks and many payment providers must verify who they do business with under FICA. They can't process payments for you until they've identified and verified your business and its owners.

What is a high-value goods dealer under FICA?

Since 19 December 2022, a business that deals in goods valued at R100,000 or more and receives payments of R100,000 or more for them is an accountable institution under Schedule 1.

What does "Not FICA compliant" mean on a debit order?

It means the customer's bank has restricted the account because the account holder hasn't met their bank's FICA requirements. Contact the customer and use another payment method until it's resolved.