FIC issues Directive 12: Mandatory annual RMCP submissions
The Financial Intelligence Centre (FIC) has officially issued the final Directive 12 on the submission of risk management and compliance programmes, under section 43A(1) of the Financial Intelligence Centre Act (FIC Act). Following a public consultation period from 31 July 2026 to 21 August 2026, the Centre has considered comments from banks, financial services providers, crypto asset service providers, legal practitioners, authorised dealers, estate agents, high value goods dealers, industry associations, consultants and other stakeholders, and has now issued Directive 12 in its final form on 4 September 2026, alongside a consultation feedback note responding to the issues raised.
Specified accountable institutions (AIs) are now required to submit their Risk Management and Compliance Programmes (RMCPs) to the FIC on an annual basis, via the Centre's registration and reporting platform (goAML), from a commencement date of Monday, 7 September 2026.
Why has the FIC moved to mandatory annual submissions?
As set out in the Centre's consultation feedback note, the obligation to develop and approve an RMCP is not new, Directive 12 simply formalises the requirement to submit that RMCP to the FIC annually, rather than only producing it on request during inspections. The Centre has confirmed that this shift enhances the overall level of compliance across the AML/CFT/CPF regime and considers the annual submission requirement to be both necessary and proportionate.
Who does this impact?
Directive 12 applies to AI's listed under Schedule 1 of the FIC Act as follows:
Item 1: Legal Practitioners / Attorneys
Item 2: Trust and Company Service Providers (TCSPs)
Item 3: Estate Agents
Item 9: Gambling Institutions
Item 11: Credit Providers (excluding banks, mutual banks, and co-operative bank credit providers)
Item 14: South African Postbank
Item 20: High-Value Goods Dealers
Item 21: South African Mint Company
Item 22: Crypto Asset Service Providers (CASPs)
Final deadlines for submission
The submission dates have been confirmed as follows:
9 October 2026, and annually thereafter: Items 1, 2, 9 and 11
31 October 2026, and annually thereafter: Items 3, 14, 20, 21 and 22
Newly established accountable institutions: where an AI subject to the Directive commences business after these dates, its first RMCP must be submitted within 90 days of commencing business.
Amendments outside the annual cycle: the Centre has confirmed that amended RMCPs, approved outside of the annual submission period, must be submitted within 10 days of approval by the board, senior management, or persons with the highest authority. The Centre did not extend this to 90 days as some commentators had requested, and has indicated it will not provide advice on what constitutes a "material" versus "non-material" amendment.
Key clarifications from the consultation process
The Centre's consultation feedback note addressed a number of practical questions raised by industry, including:
Branch submissions: Where an AI has multiple branches that are not themselves separate accountable institutions, only one consolidated RMCP submission is required. Where branches are standalone accountable institutions in their own right, each must submit its own RMCP.
Multiple item registrations: Where an AI holds more than one item registration (Org ID), a separate RMCP submission is required for each registration.
RCR vs RMCP: The Centre has stressed that RMCP submissions via goAML are entirely separate from risk and compliance return (RCR) obligations under Directives 6, 7 and 11, these use different systems, and incorrect submissions may result in administrative penalties.
Submission is not approval: Successful upload of an RMCP on goAML merely confirms that the document was received in the correct format and naming convention, it does not constitute FIC approval of the RMCP's adequacy, nor does it relieve an AI of its section 42 obligations.
Format and content: AIs must submit the RMCP as approved by their board, senior management, or persons with the highest authority. A dedicated user guide will be published setting out the practical steps, naming conventions and file format requirements for uploading RMCPs.
Banking and group structures: Certain AI types that form part of a banking group (such as high value goods dealers, crypto asset service providers, trusts and company service providers) remain in scope of Directive 12 despite being part of a wider group. Where an AI operates under a group-wide RMCP framework, it must submit relevant extracts of that group RMCP as annexures to its own submission.
Other sectors: The Centre confirmed it is engaging with other regulatory bodies on how AIs not yet covered by Directive 12 will be brought into a similar annual submission regime, with further directives possible in future.
What affected AIs should do now
With Directive 12 now final and in force from 7 September 2026, we recommend you do the following:
Confirm your submission group and deadline: Check which item category your institution falls under and diarise the correct due date (9 October or 31 October).
Finalise and approve your RMCP: Ensure your RMCP has been approved by your board, senior management, or persons with the highest authority, and reflects your actual business-level, product-level and client-level risk assessments.
Verify goAML access: Confirm your AMLCO has active login credentials on the FIC's goAML platform ahead of the deadline.
Watch out for the user guide: The Centre has indicated it will publish a user guide with practical instructions on file format, naming conventions and the upload process, we will keep an eye on the FIC's website for its release and provide our clients with the user guide.
Build in a 10-day process: Ensure your internal governance processes can accommodate submitting any board-approved RMCP amendments to the Centre within 10 days.
New entities: If you are newly established and fall within scope, diarise your 90-day submission deadline from the date you commence business.
If you need help finalising your RMCP or navigating the goAML submission process ahead of the deadlines, feel free to contact us, we are here to help.
