FIC Draft Directive 12
The Financial Intelligence Centre (FIC) has officially issued Draft Directive 12 for public comment under Section 43A(1) of the Financial Intelligence Centre Act (FIC Act). This draft directive signals a major shift in oversight: specified accountable institutions (AI’s) will soon be required to submit their Risk Management and Compliance Programmes (RMCPs) to the FIC on an annual basis.
Why is the FIC moving to mandatory annual submissions?
Historically, AI’s were expected to maintain an updated RMCP on file and produce it upon request during audits or inspections. Draft Directive 12 shifts regulatory oversight from reactive inspections to proactive, continuous monitoring.
By requiring institutions to upload their RMCP documentation directly to the FIC’s goAML portal, the regulator aims to actively assess compliance across high-risk sectors.
Who does this impact?
Draft Directive 12 applies directly to specified AI’s listed under Schedule 1 of the FIC Act:
Item 1: Legal Practitioners / Attorneys
Item 2: Trust and Company Service Providers (TCSP)
Item 3: Estate Agents
Item 9: Gambling Institutions
Item 11: Credit Providers (excluding registered banks, mutual banks, and co-operative bank credit providers).
Item 14: South African Postbank
Item 20: High-Value Goods Dealers
Item 21: South African Mint Company
Item 22: Crypto Asset Service Providers (CASPs)
Deadlines, submission timelines and important things to note
Every AI covered by this Directive must submit its RMCP via the Centre's registration and reporting platform, following the deadlines set out below:
Group A (Schedule 1, Items 1, 2, 3, 9, & 11): First submission due by 30 September 2026, and by 30 September annually thereafter.
Group B (Schedule 1, Items 14, 20, 21, & 22): First submission due by 31 October 2026, and by 31 October annually thereafter.
Newly established entities: Must submit their RMCP within 90 days of commencing business operations.
Updates to RMCP: If an AI updates and approves its RMCP (under section 42(2B)) after its respective deadline has already passed, it must submit the updated, approved RMCP via the Centre's platform within 10 business days of that approval.
Administrative sanctions: Non-compliance will trigger administrative sanctions under Sections 42(4), 61(c), and 45C of the FIC Act.
Have your say during the comment period
Submit Public Comments (Deadline: Monday, 21 August 2026): AI’s are invited to submit feedback on Draft Directive 12 using the FIC’s online consultation form before close of business on 21 August 2026.
Queries: Contact the FIC’s compliance contact centre on 012 641 6000 or submit a query on the FIC’s website here: https://www.fic.gov.za/compliance-queries-2/.
No action due yet - but here's how to prepare
No submission required yet: Draft Directive 12 is still in public consultation and is not yet in force. Your RMCP does not need to be submitted at this stage, the items below are simply to help you prepare ahead of the eventual deadlines.
Check your existing RMCP: Conduct an immediate check to ensure your framework reflects your actual business-level, product-level, and client-level risk assessments.
Verify portal credentials: Ensure your AMLCO has active login access to the FIC’s goAML platform well ahead of the September/October cutoff dates.
We suggest that you start preparing your RMCP documentation now and review the Draft Directive closely while the comment window remains open. Feel free to contact us if you need any assistance, we are here to help.
