Question 1

What is Enhanced Due Diligence (EDD) and when is it required under FICA?

Accepted Answer

Enhanced Due Diligence (EDD) is a heightened level of customer due diligence required under the Financial Intelligence Centre Act when a business relationship presents an elevated risk of money laundering, terrorist financing, or proliferation financing. South African accountable institutions must apply EDD when onboarding clients identified as Politically Exposed Persons (PEPs) or Prominent Influential Persons (PIPs), clients connected to high-risk or FATF grey-listed jurisdictions, entities with complex or opaque ownership structures, and relationships where the source of wealth or funds cannot be readily established through standard CDD. Unlike standard Customer Due Diligence, EDD requires deeper investigation, a documented risk rationale, senior management sign-off in high-risk cases, and more frequent ongoing review. KYCopilot generates a structured, fully source-cited EDD report in under five minutes - covering adverse media, sanctions, PEP/PIP status, court records, and country risk across 200+ jurisdictions.

Question 2

Who qualifies as an accountable institution under the FIC Act?

Accepted Answer

Schedule 1 of the Financial Intelligence Centre Act designates the categories of businesses legally subject to FICA's full Customer Due Diligence, Enhanced Due Diligence, and record-keeping obligations. These include banks and mutual banks, long-term insurers, attorneys and conveyancers, estate agents and property practitioners, financial services providers (FSPs), investment managers and unit trust administrators, forex and exchange-controlled entities, gambling and betting operators including online platforms, crypto asset service providers (CASPs), trust and company service providers, accounting and auditing firms, and motor vehicle dealers transacting above prescribed thresholds. If your business falls within Schedule 1, you are legally required to maintain a Risk Management and Compliance Programme (RMCP), conduct customer due diligence at onboarding, and screen clients against sanctions and adverse media databases. KYCopilot is purpose-built for all Schedule 1 categories operating in South Africa.

Question 3

What is the difference between a PEP and a PIP under South African law?

Accepted Answer

Internationally, a Politically Exposed Person (PEP) refers to an individual entrusted with a prominent public function - typically heads of state, senior politicians, senior government officials, military officers, and executives of state-owned enterprises. The Financial Intelligence Centre Act adds a South Africa-specific category: the Prominent Influential Person (PIP). A PIP includes individuals who hold, or have held, senior executive or board-level positions in significant private or public sector organisations in South Africa - such as CEOs, CFOs, and board members of major listed or large private companies - who may not hold formal government positions but carry comparable influence and potential exposure to corruption risk. FICA requires accountable institutions to identify both PEPs and PIPs and apply enhanced due diligence accordingly. KYCopilot screens for all three PEP types - Domestic, Foreign, and International Organisation - as well as South African PIPs, with full role history and sub-category tagging.

Question 4

What is a Risk-Based Approach to FICA compliance and how should I document it?

Accepted Answer

The Financial Action Task Force (FATF) and the FIC Act require accountable institutions to implement a Risk-Based Approach - meaning compliance resources and scrutiny must be proportionate to the actual money laundering and terrorist financing risk each client relationship presents. In practice, your institution must assess and document the risk profile of every client across factors including the nature of the business relationship, products and services used, geographic exposure, delivery channels, and the client's PEP or PIP status. These risk assessments must be maintained in your Risk Management and Compliance Programme (RMCP) and updated when material changes occur. KYCopilot's COMFORT Score™ provides a structured, percentage-based risk rating for every entity screened - covering all required risk dimensions with transparent, auditable reasoning - giving your compliance team a defensible score to anchor your RBA documentation and RMCP.

Question 5

How often are sanctions databases updated, and why does the refresh frequency matter?

Accepted Answer

KYCopilot's sanctions data is refreshed every 60 minutes across 12+ lists - including OFAC (US), UN Consolidated Sanctions, EU Sanctions, the FIC Targeted Financial Sanctions List (South Africa), the UK Sanctions List (UKSL), INTERPOL-UN Security Council Special Notices, the World Bank Debarred List, the Canadian Autonomous Sanctions List, SECO (Switzerland), the US DEA List, and the US Denied Persons List. Refresh frequency matters because sanctions designations can happen without warning - a client who was clean at onboarding may be listed within hours of a geopolitical event or regulatory decision. Institutions relying on weekly or monthly database updates carry an exposure window during which they may unknowingly transact with a newly designated party - a sanctions violation regardless of intent. Real-time refresh is the only defensible approach under FICA's ongoing Customer Due Diligence obligations.

Question 6

What is adverse media screening and is it a legal obligation under FICA?

Accepted Answer

Adverse media screening - the systematic review of global news and media sources for evidence of a client's involvement in financial crime, corruption, terrorism, trafficking, fraud, or other risk categories - is not merely best practice. The Financial Action Task Force, whose standards South Africa's FICA framework implements, treats adverse media screening as a required component of a compliant Customer Due Diligence and Enhanced Due Diligence programme. Relying solely on sanctions lists and PEP databases leaves significant risk intelligence gaps that the FIC expects accountable institutions to address. KYCopilot screens across 22 adverse media categories - including corruption, financial crime, regulatory breaches, ESG controversies, cybersecurity incidents, and court records - using AI-powered analysis. Critically, KYCopilot also surfaces probable absolution signals, ensuring a balanced assessment that does not penalise clients for allegations that were later disproven or withdrawn.

Question 7

Can KYCopilot reports be used as documentary evidence during a FIC inspection?

Accepted Answer

Yes. KYCopilot reports are structured to meet the documentary standards expected during a Financial Intelligence Centre inspection or regulatory review. Each report includes source citations linked to original materials, a transparent risk rationale explaining how each risk score was derived, a named list of screening databases checked, and a clear audit trail of the search. The FIC does not mandate a specific tool or report format - it requires that your institution demonstrate that due diligence was conducted, that its depth was proportionate to the risk level identified, and that records are retained for the period prescribed under Section 28. KYCopilot reports satisfy all three requirements. They are fully exportable as structured documents, making them straightforward to archive against your record-keeping obligation and present to auditors or supervisors on request.

Question 8

What does POPIA require when collecting CDD data, and does it conflict with FICA?

Accepted Answer

The Protection of Personal Information Act (POPIA) and the Financial Intelligence Centre Act impose overlapping but reconcilable obligations. POPIA requires institutions to collect only the minimum personal information necessary for a specified, lawful purpose - which appears to conflict with FICA's requirement to gather comprehensive CDD information including identity documents, source of wealth evidence, and business relationship context. However, POPIA provides a direct exception: personal information may be processed where it is necessary to comply with a legal obligation. FICA's CDD requirements constitute precisely that obligation, enabling your institution to collect and process required due diligence data on that basis. The key constraint is proportionality - collect what FICA requires, not more - and comply with Section 28's five-year retention limit, after which data must be deleted absent a separate lawful retention basis. KYCopilot processes only the data required to execute FICA-mandated screening.

Your compliance questions, answered.

Have a question specific to your institution?