What the FIC expects in a FICA file, and how PremHQ helps

If your business is an accountable institution under the FIC Act (a business the Act lists, such as an estate agency or a law firm), an inspector can come and check how you know your clients. Inspectors are appointed by the Financial Intelligence Centre (the FIC) or by the body that oversees your industry.

This post sets out what the law asks for on a client file, what the FIC's own guidance adds, and what PremHQ does for each part. PremHQ's Identity & FICA module is built around the FIC's guidance. It is not approved or endorsed by the FIC. This post is our plain reading of the Act and the guidance, not legal advice.

Three kinds of rule

The Act. These are musts. Breaking one can lead to a sanction.

The FIC's guidance. Guidance Note 7B (3 August 2026) says firms "must take the guidance issued by the Centre into account". If you do something else, you should be able to show that you still comply just as well.

Your own programme. The Act calls it your Risk Management and Compliance Programme. You must write it down and follow it. Where the law leaves a choice to you, the choice goes in there.

PremHQ keeps these apart on screen. A check the law sets says "The law requires this". A check the FIC expects says "Expected by the FIC for every new client".

Your programme says what you check at each risk level

The law says your programme must deal with your risk, and must say how you do extra checks for higher risk clients and when lighter checks are allowed. The FIC expects the checks for each risk level to be written down, and expects your board or senior management to approve the programme.

What PremHQ does. A screen called "What happens for each client" lets you pick a type of client, a kind of deal and a risk level. It shows what is asked, what is checked and what needs approval. The checks the law sets stay on at every level. You add your own extras for each level on top. High cannot be saved without an extra, because the law asks for something more at high risk. Only an admin who ticks "I am authorised to approve our risk programme." can save it. Each save is a new version with the approver's name and the date, and earlier versions stay listed.

Know who your client is

The law says you must establish and verify who your client is. No law lists the documents any more. The FIC expects full names, date of birth and, in most cases, an ID or passport number. It expects these to be checked against a reliable, independent source, and says government sources are best. Something the client made themselves does not count as an independent source.

What PremHQ does. The client fills in their details and uploads documents through a link. A South African ID number can be checked against the Department of Home Affairs' National Population Register.

For a client from another country, PremHQ can check their home-country identity document against that country's own register. Today that covers Côte d'Ivoire, Ghana, Kenya, Nigeria, Zambia and Zimbabwe. For a client from anywhere else, PremHQ cannot ask that country's own register, and the file says so plainly. Their passport is still checked: on the higher levels it is examined for signs of forgery and matched to a live selfie of the client.

A selfie and face match are extra checks. The law does not ask for them, and a company can switch them off. The FIC says a person's "physical appearance or other biometric information" may be added to their identity, as one option among many.

Someone acting for someone else

If your client acts for another person, or someone acts for your client, the law says you must check who that person is and that they have the authority to act.

What PremHQ does. This check is locked on in every risk level. A company, trust or partnership file always asks for the person who acts for it.

The real people behind a company, trust or partnership

The law says you must find out what the business does, who owns and controls it, and who its real owners are. For a company, it sets three steps in order. First, who owns a controlling interest. Then, if in doubt or nobody does, who controls it in other ways. Last, who manages it. For a trust or a partnership, the law lists the people to identify instead, such as a trust's founders, trustees and named beneficiaries, or every partner and whoever runs the partnership. If one of those people is itself a company or other legal person, the law asks for the real owner behind it too. This applies to once-off deals too, not only ongoing clients.

The FIC "strongly recommends" treating anyone with five percent or more as a real owner. That figure is guidance, not the Act. The FIC also says these checks apply whatever the client's risk rating.

What PremHQ does. The three steps are walked in that order. Each conclusion is recorded with its reason, including "nobody was found". For an ongoing client, the file is held back from approval until this is done. For a once-off deal it is asked for, and held back too where your set-up requires it.

Ongoing clients: the purpose and the money

For an ongoing relationship, the law says you must find out what kind of relationship it is, what it is for, and where the client's money will come from. The FIC says you do not have to check that the answers are true.

What PremHQ does. The file cannot be approved until these are recorded. The client can answer on the file, or a staff member writes down what the client said.

Public officials and their families

Your programme must have a way of finding out whether a client, or a real owner behind a company, is or was a public official. This covers their family and close associates too. For an ongoing relationship with a public official from another country, the law asks for three things: a senior person's approval, where their wealth and money come from, and closer watching. For a South African public official, the same three apply when you rate the relationship as higher risk.

The FIC says the client is "the most valuable source" for this. So asking the client stays your job.

What PremHQ does. Once a public official is confirmed on a file, the file is held until a senior person's sign-off and where the wealth and money come from are recorded. Staff who are not admins only see "An admin still has something to resolve on this file."

Sanctions

For ongoing clients, the law says you must check your clients against the sanctions list when the FIC gives notice of a change. The FIC says there is no situation where you skip this for a new ongoing client, whatever the risk. For once-off clients, the FIC recommends the same check.

What PremHQ does. Sanctions screening is locked on for every file. Each real person behind a company is screened before the file can be approved. When a match is confirmed, the screen says: "Stop dealing with this person, freeze anything of theirs you hold, do not release it, and do not tell them why." It shows when your report is due. PremHQ does not freeze or report for you. It records what you tell it you did.

When the checks cannot be finished

The law says that if you cannot identify and verify a client or the real people behind it, or cannot get the details of the relationship, you may not go ahead, an existing relationship must end, and you must consider a report to the FIC.

What PremHQ does. The Approve button stays held, with the reason beside it, until the list for that file is done.

Keep it up to date

For ongoing clients, the law says you must keep their details up to date. The FIC expects you to decide how often each risk rating is looked at again, and to write that down.

What PremHQ does. Each ongoing client gets a review date set by its risk rating. Out of the box that is every 12 months for High, 24 for Medium and 36 for Low. You can set your own.

Keep the records

The law says you must keep a copy of, or a reference to, the information used to check a person. For ongoing clients you must also keep the purpose and source of funds. Records are kept for at least five years. For an ongoing client, the five years count from the day the relationship ends. For a once-off deal, they count from the day the deal is done. Records may be kept electronically.

What PremHQ does. Each file's compliance pack names the source behind each check and records what the file needed when it was approved. You choose how long files are kept, from 5 to 10 years. For a once-off deal the clock starts on the completion date you record, but never before the file was approved. Until a completion date is recorded, the file is kept. For an ongoing client it starts only when you mark the relationship ended, and until then the file is never deleted automatically.

What stays with you

Software cannot make a firm compliant. These stay your firm's own work:

• Writing your full programme and having your board or senior management approve it. The "What happens for each client" screen records your checks for each level. It is not the whole programme.
• Asking clients whether they, or their family, hold or held public office.
• Freezing property and filing reports with the FIC.
• Watching the money that moves through your business.
• Training your people.

PremHQ makes the right steps the easy path, and holds a file back until they are done. See how it works on the Identity & FICA page.

Sources

Legal sources (all read 2026-10-05 unless stated):

• Financial Intelligence Centre Act 38 of 2001, FIC consolidated copy (fic.gov.za): s21(1)(a) to (‌c) (identify and verify; acting for); s21A(a) to (‌c) (nature, purpose, source of funds, business relationships); s21B(1), (2)(a)(i) to (iii) and (b) (nature of business, ownership and control, the three-step cascade, "a client contemplated in section 21" so single transactions too); s21B(3)(b)(ii), (4)(‌c)(ii), (4)(d)(iA) and (4)(e)(iA) (the beneficial owner of a partner, founder, trustee or named beneficiary that is a legal person; read 2026-10-08); s21C(1)(b) (keep up to date); s21E (cannot complete: may not proceed, consider a s29 report); s21F (foreign PEP: senior management approval, source of wealth and funds, enhanced monitoring, business relationships); s21G (domestic PEP, only where the relationship "entails higher risk"); s21H (family and known close associates); s22(1), (2)(a), (b) (records: copies or references); s23 (at least five years); s24(4) (electronic form); s28A(3)(b) (scrutinise business-relationship clients on a Director's notice); s42(1) ("develop, document, maintain and implement"); s42(2)(a), (l), (m) (risk, PEP process, EDD and simplified CDD); s45A and s45B (inspectors of the Centre or a supervisory body).
• Guidance Note 7B, 3 August 2026 (fic.gov.za) (downloaded 2026-10-05): preface iii ("must take the guidance ... into account"; "equivalent level of compliance"); paras 46 and 47 (re-evaluation intervals, documented); para 55 (enhanced measures at higher risk); para 60 (levels of due diligence per risk level documented in the RMCP); para 83 (verification against reliable and independent third-party sources); para 84 (methods now the firm's choice, described in the RMCP); para 85 (full names, date of birth, ID or passport number "will always be used"); para 86 ("may be supplemented ... physical appearance or other biometric information"); para 87 (client-generated sources not independent); para 88 (government sources); para 126 (no duty to verify s21A information); para 150 (the client is "the most valuable source" on PEP status); para 181A (board or senior management must approve the RMCP); para 198 (screen at take-on and as UNSC measures change).
• PCC 59, Beneficial ownership (fic.gov.za): para 2.18 (five percent "strongly recommends"); para 9.1 (s21B "applies as a rule and are not based upon the risk rating").
• PCC 44A, Targeted financial sanctions (fic.gov.za): para 18 (s28A(3)); para 19 (screening once-off clients "recommends"); para 20 ("no scenario" without screening a new business relationship, regardless of risk).