Only 12% of firms submit risk data as FATF deadline looms

You can also listen to this podcast on iono.fm here.

JIMMY MOYAHA: The ongoing mutual evaluation period for South Africa has commenced, and this will obviously run until the latter part of next year.

What this, of course, means for South Africa is that we need to ensure that we are continuously meeting the obligations of the Financial Action Task Force [FATF] that we promised we would [meet] to get ourselves off the grey list.

Read/listen:

We’re going to take a look at this in a bit more detail with the executive manager for compliance and prevention at the Financial Intelligence Centre [FIC] unit. Christopher Malan joins me on the line now to see what is unfolding here.

Christopher, lovely having you on the show, as always. Thanks so much for taking the time. You’re currently in Paris at a FATF gathering. Give us a sense of what’s happening there and why South Africa is there in this particular week.

CHRISTOPHER MALAN: Thank you, Jimmy, for the opportunity, and good evening to your listeners. South Africa is a member of the Financial Action Task Force, a long-standing member since 2003, and we attend three meetings a year for the FATF plenary.

This is the June meeting. There are meetings in February, June and October. At each meeting, the FATF deals with a range of issues but, most importantly for the purposes of our discussion, mutual evaluation reports.

So this year, I’ve just come out of discussions as one of the country interrogators of the report. We covered the report of Canada and the report of Türkiye today.

The lessons learned from those give South Africa a good sense of where the international scrutiny and level of debate is on all elements of compliance, which leads us fantastically into how we are stacking up to prepare for mutual evaluation.

JIMMY MOYAHA: Let’s take a look at that mutual evaluation, Christopher. We were just removed from the grey list in October of 2025. The last thing we want to do is [to fail to] ensure that we adhere to the promises we made to the Financial Action Task Force – and find ourselves back in a precarious position.

Where do we currently stand as South Africa, and what do we need to be focusing on here?

CHRISTOPHER MALAN: Well, South Africa is very much in the execution phase. Just as an interesting aside, the mutual evaluation report of Türkiye was discussed this week; they were greylisted just before us, if you recall, and came off the grey list.

So it was very much a discussion that gave due acknowledgement to all the good work and improvement that country had done.

And similarly, South Africa now needs to build on the foundation, the strong intergovernmental foundation we had put in place to exit the grey list.

We now need to take the bar increasingly higher.

And in that context we, as the FIC, are raising a concern with our recent media release that we need industry and businesses to be our partners and to cooperate with us.

JIMMY MOYAHA: Christopher, when we speak of industry, can we perhaps take a look at where some of the industry participants rank and stand at the moment?

We know that from a monitoring perspective, especially if we look at the areas of anti-money laundering and terror financing, there are specific reporting requirements that need to come through from everyone – from crypto asset service providers to casinos to trusts to standard company service providers.

But where do we stand on a matter like that?

CHRISTOPHER MALAN: Okay, let me go back to greylisting. When we were put into greylisting, the FIC was charged with key deliverables.

The first of the key deliverables was to ascertain a risk appreciation – a profile, in a sense, of each and every entity that we supervised. We had to put in place a system to evaluate that. That then became the 2023 Risk and Compliance Return [RCR].

Read/listen:

That enabled us, after we had engaged with the industry, to gather sufficient information to make decisions regarding supervision, including identifying the higher-risk entities, and then putting in place measures to monitor and inspect them.

Similarly, with our 2026 risk and compliance submission process, we’ve now moved on three years. The questionnaire is tighter, and this for now is our most critical request to industry.

There are two tranches of sectors. The tranche that is coming up for closure by the 30th of June – and that’s why we are concerned – is less than 12 days away.

These are the crypto asset providers, as you mentioned, the trust service providers, the company service providers, the credit providers that are not banks, and the casinos. They constitute our first reporting group.

So we are concerned that that tranche is seemingly not engaging with our questionnaire and submitting to a level that gives us any comfort. You would have seen from our media release, on average we’re looking at 12% of these specified accountable institutions that have taken the time to file with us. And there are 12 days to go.

JIMMY MOYAHA: Christopher, what is the danger here if we are not compliant? We know that, from a greylisting perspective, we’ve already seen what it’s like to be on that list. The last thing we want to do is end up back on that list.

But what is the danger here, especially during a mutual evaluation period, if we are not adhering to the promises that we made?

CHRISTOPHER MALAN: Well, the danger, simply put, in the language of the Financial Action Task Force, is that it is incumbent upon the country’s supervisors. And here the Financial Intelligence Centre is the prime supervisor for non-banks, businesses and professions.

We need to have information on hand to make certain key determinations and decisions about profiling each and every entity within each sector.

So that is why, for now, in the absence of credible input data that we would receive through the submission of the returns, it obviously prevents us from having a good-sized population.

Nine out of 10 and more is ideal, which means we should be getting 90% of the sectors responding on time. We then analyse that information and then put it through our risk engine.

That then enables us to risk-rank these entities and to make supervisory decisions.

In the absence of that, we will not be able to demonstrate with any credible systemic basis that we know, we understand and can identify our higher-risk entities, like which are our higher-risk lawyers and estate agents in each sector. So that goes to the heart of the effective methodology.

It starts with us being able to at-risk identify, because the FATF says we then, because we have limited resources – no supervisor has enough resources – must then apply our limited resources where the greater risks lie; and that is through the identification process, which starts with the RCR submission that we are so concerned about.

JIMMY MOYAHA: Christopher, before I let you go, I want to take a look at the enforcement side of things from an FIC perspective. The Financial Intelligence Centre, as you mentioned, is the respective body responsible for monitoring the promises that we made to FATF.

From your perspective, if the institutions, the various parties – whether they be the casinos, whether they be other sector institutions, those that are within the remit of the FIC to monitor – if they are not compliant, what are we looking to do to either help them along with compliance, or ensure that they do not put South Africa in a precarious position?

CHRISTOPHER MALAN: Okay. Thank you, Jimmy, that’s an excellent question. So what has the FIC done right, very importantly? When we started the process, we immediately issued what we called a Draft Public Communication.

It went out under No 125. In essence, that was the questionnaire. So we gave the industry way up front, weeks ago, a sight of what the form is with which they would have to comply. We went through an additional process to say, ‘Look, this is our questionnaire. Are there any [questions]?’

And then we listed it for consultation – not to change the form necessarily, but to clarify areas where people were not certain. So if people were raising concerns that they didn’t quite understand this concept, we could, through guidance, then clarify it.

We issued that clarifying guidance recently. So now there’s a full suite of material available, and we’ve been holding extensive webinars with the industry to take them through the form, to take them through our approach as to how they build the data.

By the way, on the costs side of it, we’re very conscious about the impact on time and cost for entities. They should have this data.

Read/listen:

It’s a matter of if they have kept reasonable records they should be able to collate the information like we all have to do for the tax year. The information is there; we need to collate it and then present it in the format that the questionnaire requires.

But Jimmy, if it’s not done, we very, very reluctantly then go into enforcement mode. But it’s not enforcement mode necessary to penalise. We have three targeted approaches. We go and target the sectors that are not responding well.

We will have more webinars, number one. Number two, we will then also have inspections or reviews to get to understand what the problem is. And then our third [action] is then to start the enforcement process.

Another approach we take is, if you’ve not filed your return by the due date – which is the 30th of June – you will be considered and deemed to be high risk, which automatically puts you through your own non-compliance into the pool of entities we will scrutinise more closely.

Read:

So those are the three responses we have in place and that is a set of responses. We had a similar set of responses for the FATF greylisting, and that was well received by the FATF. That methodology we applied.

JIMMY MOYAHA: Ensuring that South Africa remains protected and in line with global standards on anti-money laundering and terror financing, the team at the FIC is currently getting some useful and critical insights from the FATF gathering taking place in Paris at the moment.

We look forward to seeing how they bring those insights back to South Africa and to South African businesses.

For now, we will leave the conversation on that note. Christopher Malan, executive manager for compliance and prevention at the Financial Intelligence Centre unit, joined us to take a look at ongoing compliance and monitoring as South Africa enters its next mutual evaluation period.