South African authorities continue to focus on addressing the outstanding action items identified by the Financial Action Task Force (FATF) in order to exit the grey list. On 25 October 2024 National Treasury provided a progress update following the FATF Plenary which took place on the same day, confirming that South Africa is now deemed to have largely or fully addressed 16 of the 22 action items in its Action Plan. Six outstanding action items still need to be addressed for the last scheduled reporting cycle, concluding in February 2025.

The remaining six action items relate to:

• Demonstrating a sustained increase in the investigation and prosecution of complex money laundering, terror financing and unlicensed cross-border money of value transfer services; and
• Timely access of beneficial ownership information in respect of companies and trusts, and the imposition of remedial action and dissuasive sanctions by designated anti-money laundering and countering the financing of terrorism (AML/CFT) supervisors.

At the time of our July 2024 update, 14 action items remained outstanding. The reduction of these outstanding action items to six by October 2024, within a three-month period, shows continued dedication by the relevant South African agencies. However, National Treasury has reiterated that despite the positive progress, it remains a challenge to exit the grey list at the conclusion of the February 2025 cycle. If South Africa is successful in addressing all the remaining action items in the next reporting cycle, the February 2025 FATF Plenary will authorise an onsite visit by the FATF Africa Joint Group in around May 2025 to confirm their assessment on the progress of all action items. Should such onsite assessment result in a positive outcome, a recommendation will be made to the June 2025 FATF Plenary for South Africa to be delisted from the FATF grey list. If any of the remaining 14 outstanding action items are not addressed by the end of January 2025, South Africa will need to continue reporting to the FATF every four months, until all the deficiencies have been addressed. This will push out the potential removal of South Africa from the grey list to October 2025 or later.

The interdepartmental committee chaired by National Treasury is co-ordinating the process to exit the FATF grey list. It has indicated that some of its focus areas have been action items related to outbound mutual legal assistance requests, seizure and confiscation of proceeds of crime, implementation of terror financing strategy and ensuring the effective implementation of targeted financial sanctions, and action items related to investigations and prosecutions. 

Some of the recent steps taken by various agencies in achieving the action items, including those related to the remaining six action items, are:

• With effect from 30 September 2024, low-value electronic funds transfers (EFTs), debit and credit payments made between Common Monetary Area (CMA) countries (being Eswatini, Lesotho, Namibia and South Africa) will be treated as cross-border transactions and subject to greater due diligence requirements. Previously such low-value retail payments between the CMA countries were treated as domestic payments and processed via South Africa’s domestic retail payment system. The South African Reserve Bank announced on 26 July 2024, as part of the country’s efforts to address several recommendations made by FATF to strengthen AML/CFT and combating proliferation financing regimes, that these payments would be regularised. Banks operating in the CMA have elected to process these low-value retail payments using the regional payments infrastructure (i.e. the Southern African Development Community real-time gross settlement system) primarily used for high-value payments. This new approach will include the treatment of debit orders, which will now be required to be collected from an account domiciled int eh respective CMA country.
• As part of the drive to achieve the action item related to beneficial ownership registries, National Treasury has called upon all companies and professional trustee service providers to ensure registration by companies and trusts they engage before 30 November 2024 in order to significantly increase the coverage in beneficial ownership registries held by the CIPC and the Masters Office.

Various agencies have been focussed on strengthening of AML/CFT supervisory capacity. These include the Financial Sector Conduct Authority (FSCA), Prudential Authority (PA), which are designated as supervisory bodies responsible for ensuring that accountable institutions in the financial services sector comply with the Financial Intelligence Centre Act, 2001 (FICA). Both the PA and FSCA, as well as the Financial Intelligence Centre (FIC), have increased both human and financial resources, with the FSCA in particular increasing their AML/CFT department from one person to 16 people over a period of 18 months (and further expansion to 29 analysts planned over the next three years). In addition, in demonstrating the action item requiring supervisors to apply effective, proportionate and dissuasive sanctions, as well as to demonstrate sustained effectiveness, the FSCA and PA have recently imposed several substantial administrative fines on financial institutions who have failed to comply with FICA:

• On 28 February 2024, a R16 million fine was imposed by the FSCA on the Ashburton Fund Managers Proprietary Limited (Ashburton) for failing to comply with certain provisions of FICA, following an inspection 2022, of which R6 million was suspended in recognition of remedial action taken. The administrative sanction was imposed as a result of Ashburton’s failure to develop, document, maintain and implement an Risk Management and Compliance Programme (RMC Programme), failures to sufficiently identify and verify the identity of clients, and a failure to sufficiently scrutinize client information to determine whether such clients are listed in terms of the Protection of Constitutional Democracy Against Terrorist and Related Activities Act, 2004 and the Targeted Financial Sanctions Lists issued by the United Nations Security Council.
• On 1 August 2024, a fine of R209.6 million was imposed by the PA on Sasfin Bank Limited (Sasfin) for historical non-compliance with FICA, principally within Sasfin’s discontinued foreign exchange business (of which R49 million is suspended). This follows an administrative penalty of R500,000 imposed on Sasfin in 2019 relating to a lack of training on FICA and weak internal rules. The August 2024 fine is based on an investigation by the PA which uncovered contraventions of various laws, including FICA, the Banks Act and Exchange Control Regulations, arising from contraventions by a syndicate of Sasfin employees who colluded with clients to circumvent South Africa’s exchange control and anti-money laundering regulations, resulting in the unlawful expatriation of money out of South Africa. Such contraventions also led to the institution of civil proceedings by the South African Revenue Service in December 2023 to recoup R4.87 billion (plus interest and costs) in respect of such unlawful expatriation of money. 
• On 2 August 2024, the PA imposed administrative sanctions on Monarch Insurance Company Limited as a result of its non-compliance with the provisions of FICA, following an inspection in 2022. The administrative sanctions imposed emanate from failures to register as an accountable institution with the FIC, to comply with its ongoing AML/CFT compliance training for its employees, and to adequately develop and implement its RMC Programme. The latter failure included failures to develop, document, maintain and implement an RMC Programme, to identify, assess, monitor, mitigate and manage its money laundering and terrorist financing risks, and to have its RMC Programme approved. The sanctions imposed by the PA for these failures included a reprimand, two cautions not to repeat the conduct which led to the non-compliance, and financial penalties of R1 million (with R200,000 conditionally suspended for 36 months).
• On 2 August 2024, the PA imposed administrative sanctions on Assupol Life Limited as a result of its non-compliance with the provisions of FICA, following an inspection in 2020. The administrative sanctions arose from failures to comply with its customer due diligence (CDD) obligations, record keeping obligations in respect of clients, and a failure to adequately develop and implement its RMC Programme. Numerous failures were identified in relation to Assupol’s RMC Programme, including failures to identify beneficial owners of legal persons and partnerships, to determine if a prospective client is a domestic prominent influential person (DPIP), including family members and known close associates, and to adequately develop, document and/or implement processes and procedures to sanction screen all clients at onboarding. The administrative sanction imposed by the PA for these failures consists of three cautions, a reprimand, and a financial penalty of R4 million.
• On 2 August 2024, the PA imposed administrative sanctions on the State Bank of India, South Africa (SBI) as a result of its non-compliance with the provisions of FICA, following an inspection in 2020. The administrative sanctions were imposed as a result of inter alia SBI’s failures to comply with its customer due diligence obligations, its cash threshold reporting obligations, section 42 of FICA read with FIC Directive 5/2019 in relation to its money laundering and terrorist financing risk assessment approach, its RMC Programme, and its Automated Transaction Monitoring System. The administrative sanctions imposed on SBI as a result of these failures consists of four cautions and a total financial penalty of R10 million, of which R4.5 million was conditionally suspended for 36 months. This follows a prior imposition of financial penalties of approximately R10 million (with R3.5 million suspended) imposed on SBI for failures to comply with obligations in terms of FICA arising from inspections in 2014 and 2020, which were unsuccessfully appealed in April 2024. 
• On 27 September 2024 the PA imposed administrative sanctions of four cautions and a financial penalty of R15.9 million on Old Mutual Life Assurance Company (South Africa) Limited as a result of its non-compliance with the provisions of FICA following an inspection of 2020. The non-compliance included a failure to comply with CDD obligations (particularly to verify physical addresses and identify beneficial owners of clients), failing to comply with cash threshold reporting obligations to report transactions above prescribed limits to FIC, failing to timeously report on suspicious and unusual transactions to FIC, and a failure to adequately develop and implement various aspects of its RMC Programme.
• On 4 October 2024 the PA imposed an administrative sanction of R5 million on Bidvest Bank Limited as a result of its failure to implement its RMC Programme in relation to the assessed trade-based transactions in respect of a sample of clients assessed during a 2022 inspection. R2.5 million of the R5 million Rand penalty is conditionally suspended for 12 months.
• On 4 October 2024 the PA imposed administrative sanctions of three cautions and a financial penalty of R9.5 million on HSBC Bank Plc – Johannesburg Branch as a result of its non-compliance with the provisions of FICA following an inspection in 2021. The non-compliance included a failure to comply with CDD obligations, including deficiencies in the identification and verification of beneficial owners of clients, failure to attend to automated transaction monitoring system alerts within the required 48-hour period, and a failure to adequately develop, document and/or implement its RMC Programme to effectively enable it to identify and verify beneficial owners of clients.

Whilst the PA, as a prudential regulator and supervisor, is not enforcement-led (preferring co-operation from and voluntary compliance by regulated institutions), it has indicated that it will not hesitate to take appropriate enforcement action where necessary. It combines supervisory activities with targeted regulatory actions in order to address actual or suspected non-compliance with the financial sector laws and other relevant legislation such as FICA. 

The above sanctions demonstrate how the PA is flexing its muscles to apply effective, proportionate and dissuasive sanctions, as well as demonstrating sustained effectiveness. This is evidenced by a marked increase in both the frequency and quantum of sanctions imposed by the PA. In 2020/2021 insurers who failed to comply with their AML/CFT obligations could often expect to receive a mere caution not to repeat such conduct, with the higher end of financial penalty imposed for substantial non-compliance during this period being approximately R2 million. In comparison, the sanctions handed down thus far in 2024 on insurers all include high financial penalties, with the largest penalty amounting to R4 million. Moreover, although the penalties imposed by the PA on banks for non-compliance with FICA have historically been higher than those imposed on insurers, these have also seen a substantial increase in recent months. Over the years, these financial penalties have varied substantially, depending on the relevant non-compliance, and have ranged from R500,000 to R75 million. The total financial penalties imposed on registered banks for a failure to comply with legislative obligations in relation to Money Laundering and Terrorist Financing (ML/TF) risks over the period January 2014 to December 2019 totalled approximately R277 million. In comparison, the recent fine imposed on Sasfin in August 2024 of R209 million almost equalled the cumulative total over the 6-year period commencing in 2014 when the ML/TF legislation was amended.

The PA and FSCA have indicated that in the coming period, as part of their on-site inspections, they intend to look into inter alia (i) whether financial institutions have identified their ML/TF risks; (ii) whether they have detailed such risks in their RMC Programme and have developed policies and procedures as documented in such RMC Programme to mitigate against ML/TF risks; and (iii) whether the financial institutions are able to demonstrate that their RMC Programme is effective in mitigating against ML/TF risks. 

Ahead of the January 2025 FATF deadline, we anticipate continued intensified supervisory activity, with an increase in the frequency and quantum of financial penalties being imposed for non-compliance. 

In anticipation of such increased activity, accountable institutions should proactively review, and where necessary update, their RMC Programmes and AML/CFT policies and procedures in order to ensure compliance, as well as auditing the effectiveness of same. 

Should you require assistance in relation to proactive reviews and audits, drafting of RMC Programme and AML/CFT policies, preparation for on-site inspections, regulatory investigations or other interactions with supervisors, please contact Ernie van der Vyver, Nicole Britton or Kate Swart.