South Africa Greylisting: What it means for AML
Updated: 3 days ago
South Africa is no longer on the FATF grey list. It was removed on 24 October 2025, and the European Union took it off its list of high-risk third countries in January 2026. If your country-risk settings, EDD triggers or onboarding rules for South African customers still reflect 2023, they are out of date.
Delisting did not make compliance lighter. The Financial Intelligence Centre Act still applies in full, the FIC issued a wave of new directives in 2026, and a new FATF mutual evaluation is already under way, with an on-site visit expected in early 2027.
This guide covers what South Africa greylisting meant, what changed, which AML obligations still apply, what the next evaluation will test, and what compliance teams inside and outside South Africa should do now.
South Africa greylisting Key Takeaways |
|
|
|
|
|
|
Is South Africa still on the FATF grey list?
No. The Financial Action Task Force removed South Africa from its list of jurisdictions under increased monitoring on 24 October 2025, after 32 months on the list.
The decision followed an on-site visit by the FATF Africa Joint Group in July 2025, which confirmed that the reforms in South Africa's 22-point action plan had been implemented and were being sustained.
The European Union followed in January 2026, removing South Africa from its list of high-risk third countries with effect from 29 January 2026. South Africa is now in the FATF's new round of mutual evaluations, with an on-site visit indicated for early 2027 and a plenary discussion in October 2027.
Status as at 30 October 2026
Item | Status |
FATF grey list (jurisdictions under increased monitoring) | Not listed. Removed 24 October 2025 |
FATF black list (high-risk jurisdictions subject to a call for action) | Never listed |
EU list of high-risk third countries | Not listed. Removal published 9 January 2026, effective 29 January 2026 |
FATF mutual evaluation (fifth round) | Under way. On-site visit indicated for February to March 2027; plenary discussion expected October 2027 |
Next FATF decision point for South Africa | October 2027 plenary (dates indicative) |
The FATF updates its lists three times a year, after plenaries in February, June and October. South Africa was not under monitoring at the October 2026 plenary, so no change to its status was on the table.
Compliance teams should still check each plenary outcome, because the 2027 evaluation is where South Africa's next rating will be decided.
What does it mean when a country is greylisted?
Greylisting means the FATF has identified strategic deficiencies in a country's framework for countering money laundering, terrorist financing and proliferation financing, and the country has committed at a political level to fix them under an agreed action plan and timeline.
The FATF's official term is "jurisdictions under increased monitoring". It is not a sanction, it does not prohibit transactions with the country, and the FATF does not call for enhanced due diligence on grey-listed countries as a class.
In practice, however, banks, investors and regulators in other jurisdictions treat grey-list status as a country-risk signal, which raises scrutiny and cost for cross-border business.
The important distinction is with the FATF black list, formally "high-risk jurisdictions subject to a call for action". That list is reserved for countries such as Iran and North Korea, where the FATF does call on members to apply enhanced due diligence or countermeasures. South Africa was never on it.
For a compliance team, greylisting matters in three ways:
Country risk. Most institutions raise the risk rating of a grey-listed country in their customer risk models, which can trigger enhanced due diligence on customers and counterparties linked to it.
Correspondent and cross-border relationships. Foreign banks and payment partners may apply extra checks, ask more questions about ownership and source of funds, or slow down onboarding.
Domestic supervision. The listed country usually tightens its own AML laws and enforcement to meet the action plan, which raises the bar for every accountable institution operating there.
Why South Africa was greylisted in 2023
South Africa was placed on the grey list on 24 February 2023. The decision traced back to the FATF's mutual evaluation report published in October 2021, which found significant weaknesses across the system.
The problems were less about missing laws and more about results:
too few investigations and prosecutions of complex money laundering,
limited use of financial intelligence,
weak supervision of non-financial businesses and professions,
poor access to accurate beneficial ownership information.
The FATF action plan contained 22 items across eight strategic areas:
Risk-based supervision of designated non-financial businesses and professions, with effective sanctions for non-compliance
Timely access by competent authorities to accurate and up-to-date beneficial ownership information for legal persons and arrangements
Greater use of financial intelligence from the FIC by law enforcement
A sustained increase in investigations and prosecutions of serious and complex money laundering
Enhanced identification, seizure and confiscation of proceeds of crime
An updated terrorist financing risk assessment and a national counter-terrorist financing strategy
A sustained increase in terrorist financing investigations and prosecutions
Effective implementation of targeted financial sanctions
South Africa had already passed the General Laws (Anti-Money Laundering and Combating Terrorism Financing) Amendment Act 22 of 2022 and amendments to the Protection of Constitutional Democracy Against Terrorist and Related Activities Act in December 2022.
Those amendments closed most of the legal gaps. What took the next two and a half years was proving that the system worked.
How South Africa got off the grey list: timeline 2021 to 2027
South Africa's route off the grey list ran from a critical mutual evaluation in 2021 to delisting in October 2025, and the next evaluation cycle is already scheduled.
The table below shows the milestones that matter for compliance teams, including the 2026 regulatory changes that followed delisting.
Date | Event | Why it matters |
October 2021 | FATF publishes South Africa's mutual evaluation report | Identifies the deficiencies that lead to greylisting |
December 2022 | General Laws (AML/CTF) Amendment Act 22 of 2022 and POCDATARA Amendment Act enacted; Schedule 1 to the FIC Act expanded (CASPs, credit providers, high-value goods dealers and others become accountable institutions) | Closes most legal gaps; widens the regulated population |
24 February 2023 | FATF places South Africa under increased monitoring with a 22-item action plan | Country-risk ratings rise worldwide |
August 2023 | EU adds South Africa to its list of high-risk third countries | EU institutions must apply enhanced due diligence to South African exposure |
1 July 2024 | CIPC blocks annual return filing until beneficial ownership information is filed (the "hard-stop") | Beneficial ownership becomes enforced, not optional |
October 2024 | FATF recognises 16 of 22 action items as largely or fully addressed | Six items remain, mostly on investigations and prosecutions |
June 2025 | FATF determines that all 22 items are substantially complete and authorises an on-site visit | Final verification stage |
Late July 2025 | FATF Africa Joint Group on-site visit | Confirms reforms are implemented and sustainable |
24 October 2025 | FATF removes South Africa from the grey list (with Nigeria, Mozambique and Burkina Faso) | Country-risk signal lifted |
9 January 2026 (effective 29 January) | EU removes South Africa from its high-risk third-country list | EU statutory EDD trigger lifted |
March to May 2026 | Cabinet approves and Parliament receives the General Laws (AML/CTF) Amendment Bill B15–2026 (tabled 27 May 2026) | Beneficial ownership discrepancy reporting and stronger CIPC powers proposed; Bill still before Parliament as at October 2026 |
31 July 2026 | FIC Directive 10 takes effect (geographic particulars of business, due by 31 October 2026 for existing institutions) | New registration data obligation |
7 September 2026 | FIC Directive 12 takes effect: annual submission of Risk Management and Compliance Programmes, first deadlines 9 and 31 October 2026 | RMCPs now reviewed by the FIC every year |
February to March 2027 (indicative) | FATF on-site visit for the fifth-round mutual evaluation | Effectiveness tested in person |
October 2027 (indicative) | FATF plenary discusses South Africa's mutual evaluation report | Next rating; a poor result can lead back to increased monitoring |
The dates for 2027 come from the FATF's published assessment calendar and from National Treasury briefings to Parliament, and the FATF describes them as indicative.
What delisting changed for businesses, and what it did not
Delisting removed the formal country-risk signal and the EU's statutory enhanced due diligence trigger, but it changed nothing about the obligations of accountable institutions inside South Africa.
Cross-border friction has eased, correspondent and payment partners have more room to normalise their treatment of South African counterparties, and the cost of doing business with Europe has fallen.
At the same time, the FIC, the Prudential Authority and the FSCA have kept enforcement at the level built up during the greylisting years, and the FIC has added new obligations in 2026.
What changed | What did not change |
South Africa is no longer a FATF jurisdiction under increased monitoring | The FIC Act and its regulations apply in full to every accountable institution |
EU institutions no longer have a statutory obligation to apply EDD to South African exposure | Each foreign institution still sets its own country-risk rating under its risk-based approach |
Country-risk inputs in most vendor and bank models have been lowered or are being lowered | Supervisory inspections, administrative sanctions and RMCP scrutiny continue, and have increased in 2026 |
Reputational and investment signal improved | Beneficial ownership filing with CIPC, targeted financial sanctions screening and reporting duties remain mandatory |
Cross-border onboarding and correspondent relationships are easier to open and maintain | A new FATF evaluation is under way and the outcome in 2027 could change the signal again |
The key point for anyone building a risk model: the removal of a country from the EU list allows institutions to adjust their policies, but it does not compel them to.
Many international banks update country ratings on an annual cycle, so some South African businesses still encounter residual friction a year after delisting.
For institutions outside South Africa: reviewing country risk now
If your institution is in the EU, the UK or the Gulf and holds South African customers or counterparties, three checks are worth doing now.
Revisit the country-risk score. Many institutions raised South Africa's score in early 2023 and never revisited it. Grey-list status was one input; it has been removed. Decide, and document, what the score should be today.
Review automatic EDD triggers. If South African nationality, incorporation or transaction corridor automatically triggers enhanced due diligence, check whether that rule still reflects your current assessment or is simply a leftover from 2023.
Watch the 2027 evaluation. Build a trigger to review the rating again when the mutual evaluation report is adopted.
For example, a Gulf-based bank that onboarded a Johannesburg-headquartered corporate in 2024 may still be applying annual enhanced reviews and senior-management approval to every transaction with that client, because a country rule was set when South Africa was listed.
If the institution's current risk-based assessment no longer supports that treatment, the rule should change, and the reasoning should be recorded.
This is also a familiar pattern in the Gulf. The United Arab Emirates left the grey list in February 2024, Nigeria left on the same day as South Africa, and Kuwait was added in February 2026.
In each case, the compliance work for institutions elsewhere was the same: recalibrate country risk on evidence, not on a label that has already changed.
Who must comply with AML rules in South Africa?
AML obligations in South Africa apply to "accountable institutions", the businesses and professions listed in Schedule 1 to the Financial Intelligence Centre Act 38 of 2001 (the FIC Act).
Schedule 1 was expanded with effect from 19 December 2022 as part of the greylisting response, and it now covers a wide range of financial and non-financial businesses.
If your business falls into a Schedule 1 category, you must register with the FIC, maintain a risk management and compliance programme, carry out customer due diligence, screen against targeted financial sanctions lists, keep records and report to the FIC, regardless of South Africa's FATF status.
Schedule 1 categories include, among others:
Banks, mutual banks and co-operative banks
Long-term insurers and other financial services providers authorised under the Financial Advisory and Intermediary Services Act
Collective investment scheme managers, and authorised users of an exchange
Legal practitioners, including attorneys, conveyancers and notaries
Trust and company service providers
Estate agents and property practitioners
Credit providers
Money or value transfer providers and foreign exchange businesses
Crypto asset service providers (item 22)
Dealers in high-value goods, precious metals and stones, above the prescribed threshold
Casinos and gambling businesses
The South African Mint Company and the Postbank
Two practical points follow. First, many businesses added in December 2022, such as credit providers, high-value goods dealers and CASPs, were new to FIC supervision and have been a focus of registration and inspection activity since.
Second, the categories are defined by activity, not by how a business describes itself. A fintech that extends credit, or a platform that exchanges crypto assets for fiat, is an accountable institution whether or not it thinks of itself as a financial institution.
Compliance note: this list is a summary. Confirm your category against the current Schedule 1 to the FIC Act and the FIC's guidance before relying on it.
Who regulates AML in South Africa?
The Financial Intelligence Centre is South Africa's financial intelligence unit and the central AML authority, but supervision is shared.
The FIC directly supervises most non-financial accountable institutions, while the South African Reserve Bank's Prudential Authority and the Financial Sector Conduct Authority supervise banks and non-bank financial institutions, respectively.
Several professional and sector bodies also supervise FIC Act compliance in their own sectors. The Companies and Intellectual Property Commission runs the beneficial ownership register that the FIC Act's customer due diligence rules depend on.
Authority | Role in AML/CFT | Who it supervises for FIC Act purposes |
Financial Intelligence Centre (FIC) | Financial intelligence unit; receives reports via goAML; issues directives, guidance and public compliance communications; imposes administrative sanctions | Most non-financial accountable institutions, including legal practitioners, property practitioners, trust and company service providers, credit providers, high-value goods dealers, CASPs and others not supervised by another body |
Prudential Authority (South African Reserve Bank) | Prudential supervisor; inspects and sanctions banks for FIC Act compliance | Banks, mutual banks, co-operative banks and life insurers |
Financial Sector Conduct Authority (FSCA) | Market conduct regulator; inspects and sanctions FSPs for FIC Act compliance | Financial services providers under FAIS, collective investment scheme managers, exchange participants, and crypto asset service providers licensed as FSPs |
Legal Practice Council | Professional body with FIC Act supervisory functions | Attorneys, conveyancers and notaries |
Property Practitioners Regulatory Authority | Sector regulator with FIC Act supervisory functions | Estate agents and property practitioners |
National Gambling Board and provincial licensing authorities | Sector regulators with FIC Act supervisory functions | Casinos and gambling businesses |
Companies and Intellectual Property Commission (CIPC) | Maintains the company beneficial ownership register; blocks annual returns where beneficial ownership information is missing | All companies and close corporations (not an AML supervisor, but central to beneficial ownership compliance) |
National Treasury | Policy lead; chairs the interdepartmental committee that managed the grey-list exit and now coordinates the mutual evaluation | Not a supervisor |
In practice, the question for a compliance team is simple: which body inspects you, and what has it been sanctioning lately.
The answer shapes where to focus, because the FIC, the Prudential Authority and the FSCA publish their enforcement actions and their inspection findings follow recognisable patterns.
Fully Compliant Everywhere
Learn how azakaw makes MLRO life easier with an AI-powered AML solution that uses regulator-specific templates or allows you to create your own rules and workflows.
What AML obligations still apply after delisting?
Every obligation under the FIC Act that applied during greylisting still applies, and 2026 has added more.
Accountable institutions must register with the Financial Intelligence Centre (FIC). They need to adopt and maintain a documented Risk Management and Compliance Programme.
Institutions must identify and verify customers and beneficial owners on a risk-sensitive basis. They are also required to screen these individuals against United Nations Security Council sanctions lists.
All transaction and customer records must be kept for at least five years.
In addition, institutions must report specific activities directly to the FIC. This includes suspicious and unusual transactions, cash transactions that exceed the regulatory threshold, and any matches found on sanctions lists.
Finally, institutions must appoint a compliance officer. They must also provide regular compliance training to their staff.
Since mid-2026, the FIC has also required specified institutions to submit their RMCPs annually, to disclose the geographic particulars of their business, and to file updated risk and compliance returns. CASPs must apply the Travel Rule to crypto asset transfers.
The sections below group the obligations the way a compliance team usually works through them. Where an item is a FIC directive or guidance rather than a provision of the Act itself, the text says so.
TIP: Read our guide to learn everything you need about a risk-based approach
Risk management and compliance programme (RMCP)
Section 42 of the FIC Act requires every accountable institution to develop, document, maintain, and implement an RMCP that explains how the institution identifies, assesses, monitors, mitigates, and manages its money laundering, terrorist financing, and proliferation financing risks.
The RMCP is the first document an inspector asks for, and FIC sanction notices regularly cite RMCPs that were generic, outdated, or not actually followed.
Three 2026 developments change how the RMCP is treated:
Directive 12 (effective 7 September 2026) requires accountable institutions in specified Schedule 1 categories, including banks, FSPs, legal practitioners, trust and company service providers, gambling businesses and CASPs, to submit a copy of their RMCP documentation to the FIC through goAML every year. The first deadlines fell on 9 October 2026 for some categories and 31 October 2026 for others, and the same dates recur annually. New institutions must submit within 90 days of starting business, and a revised RMCP must be resubmitted within 10 business days of approval. The FIC has said it may extend the requirement to other categories.
Guidance Note 7B updates the FIC's guidance on implementing the Act, including the business risk assessment and the RMCP.
The FIC has warned that submission is not the same as compliance. An RMCP will be tested against the institution's actual activities and the Act's requirements, and a late submission is treated as non-compliance.
The FIC has also stressed that an RMCP submission under Directive 12 does not replace the risk and compliance returns required under Directives 6, 7 and 11. Institutions that confuse the two may be sanctioned for both.
Customer due diligence, PEPs and beneficial ownership
Sections 20A to 21H of the FIC Act set out customer due diligence.
Institutions must establish and verify client identities. They must also verify anyone acting on a client's behalf.
It is essential to understand the nature and purpose of every business relationship. For legal persons, trusts, and partnerships, institutions must identify and verify the ultimate beneficial owners.
When dealing with higher-risk relationships, institutions must apply enhanced due diligence. This applies specifically to Prominent Influential Persons (PIPs), South Africa's term for PEPs, as well as their family members and close associates.
Finally, due diligence must be continuous. Institutions must keep client information up to date and closely monitor transactions against the client's known risk profile.
Beneficial ownership is the area where supervisors are pushing hardest.
Since 1 July 2024, the CIPC has blocked companies from filing their annual returns until beneficial ownership information is lodged and current, and an outstanding annual return can lead to deregistration.
Trusts must lodge beneficial ownership registers with the Master of the High Court under section 11A of the Trust Property Control Act. For an accountable institution, that means two things in practice:
Collecting a declared list of owners is no longer enough. Supervisors expect the institution to verify ownership and control down to natural persons, including through layered structures, and to keep that picture current when directors or shareholders change.
The General Laws (AML/CTF) Amendment Bill B15–2026, tabled in Parliament on 27 May 2026, proposes that "obliged entities" report material discrepancies between the beneficial ownership information they hold and the CIPC register, and gives the CIPC stronger enforcement and deregistration powers.
The Bill had not been enacted as at October 2026, but National Treasury has said it wants the amendments in force in time to count for the 2027 evaluation.
Screening and reporting duties
Section 28A, read with sections 26A to 26C, requires every accountable institution to scrutinise client information against the UN Security Council targeted financial sanctions lists, to freeze property where there is a match and to report it to the FIC.
The FSCA has sanctioned firms specifically for failing to screen against these lists. Many institutions pair sanctions screening with PEP screening and adverse media screening as part of the same workflow.
Reporting obligations run through the FIC's goAML platform:
Suspicious and unusual transaction reports under section 29, within the prescribed period after the suspicion arises
Cash threshold reports under section 28 for cash transactions above the prescribed limit
Terrorist property reports under section 28A
Risk and compliance returns under Directives 6, 7 and 11, which the FIC uses to profile risk across sectors. Non-submission of these returns accounted for more than half of the FIC's published administrative sanctions in the year to April 2025.
Geographic particulars under Directive 10, in force since 31 July 2026: accountable institutions must disclose where they operate, with existing institutions required to update their registration by 31 October 2026.
Records of client identification, transactions and reports must be kept for at least five years from the end of the business relationship or the date of the transaction, and the FIC and supervisors may inspect them.
Know Who Is Your Customer
Screen transactions and entities against over 1,400 global sanctions, Politically Exposed Persons (PEPs), and adverse media watchlists. Safeguard your business.
Crypto asset service providers: the Travel Rule
CASPs have been accountable institutions under item 22 of Schedule 1 since 19 December 2022, and most also need an FSP licence from the FSCA. FIC Directive 9 implements the FATF Travel Rule for crypto asset transfers that take place within, originate from or are received into South Africa.
A public compliance communication issued by the FIC in 2026 sets out the FIC's expectations in detail: originator and beneficiary information must travel with the transfer, the FIC treats crypto asset transfers in a business relationship as subject to the rule at a zero threshold, CASPs must carry out due diligence on counterparty CASPs, including whether the counterparty itself implements the Travel Rule, and there are no exemptions.
Where a counterparty in another jurisdiction does not comply, the South African CASP is still expected to meet its own obligations and may need to hold the transfer pending the missing information.
CASPs in Schedule 1 item 22 were also among the categories required to submit their RMCPs under Directive 12 by 31 October 2026. For a wider view of the risks in this sector, see our guide to AML for crypto businesses.
Compliance note: the obligations above are a summary of statutory duties, FIC directives and FIC guidance as understood at the date of this article. Thresholds, deadlines and the exact categories covered by each directive should be confirmed against the current text on fic.gov.za.
What happens if you don't comply? Penalties and enforcement
Non-compliance with the FIC Act exposes an accountable institution to administrative sanctions from its supervisor and, for certain conduct, to criminal prosecution.
Under section 45C of the FIC, the Prudential Authority, the FSCA and other supervisory bodies may impose a caution, a reprimand, a directive to take remedial action, a restriction or suspension of business activities, and a financial penalty of up to R10 million for a natural person and R50 million for a legal person.
Criminal offences under the Act carry, for the most serious, imprisonment of up to 15 years or a fine of up to R100 million under section 68(1), with lower maximums of five years or R10 million for specified offences under section 68(2).
Money laundering itself is prosecuted under the Prevention of Organised Crime Act, where section 8 provides for a fine of up to R100 million or imprisonment of up to 30 years.
Enforcement has not slowed since delisting. Supervisors have made clear that remediation after an inspection does not cancel a penalty, and the FIC Appeal Board has upheld that principle more than once.
Institution | Supervisor | Sanction | Main findings |
Sanlam Collective Investments (October 2025) | FSCA | R10.6 million, R3.6 million suspended for two years | FIC Act compliance failures identified in a March 2024 inspection |
Ninety One Fund Managers (May 2025) | FSCA | R3 million, R500,000 suspended for three years | FIC Act contraventions; appeal lodged with the FIC Appeal Board |
Ashburton Fund Managers (February 2024) | FSCA | R16 million, R6 million suspended for three years | Failures to identify and verify clients |
Law firm KR Inc (appeal decided 2025) | FIC, upheld by FIC Appeal Board | R7.7 million | Non-compliance including reporting failures; the Board held that later remediation does not avoid sanction |
Various DNFBPs, April 2024 to April 2025 | FIC | Penalties from R20,000 to R7.8 million | Mostly non-submission of risk and compliance returns, failure to register, and screening failures |
The pattern is consistent. The large penalties go to institutions whose customer identification, beneficial ownership verification or sanctions screening did not work in practice.
The volume of smaller penalties goes to businesses that did not register, did not file returns or could not produce a usable RMCP. Both are the kind of gap the FATF assessors will look for in 2027 when they ask whether supervision is effective and sanctions are dissuasive.
Avoid Legal Sanctions & Penalties
Streamline compliance from identity and business verification to corporate compliance and AML transaction monitoring, reducing costs and complexity so you can scale with confidence.
What the next FATF mutual evaluation will test (2026 to 2027)
South Africa is being assessed under the FATF's fifth round of mutual evaluations, which uses the 2022 Methodology (most recently amended in June 2026) and is designed to be tougher on results than the round that led to greylisting.
Assessors rate technical compliance with the 40 FATF Recommendations and, separately, effectiveness across 11 Immediate Outcomes, each rated low, moderate, substantial or high.
National Treasury has told Parliament that South Africa is largely compliant with 38 of the 40 Recommendations, so the legal framework is not where the risk sits.
The risk sits in effectiveness: whether investigations, prosecutions and asset recovery can be demonstrated at a level that matches the country's risk profile.
The process began in the first half of 2026, with key reports due in July and October 2026, an on-site visit indicated for February to March 2027 and plenary discussion in October 2027.
A mutual evaluation is a different exercise from a grey-list action plan. The action plan was a fixed list of 22 fixes, and completing it was effectively pass or fail.
The evaluation is a report card on the whole system, and the FATF's fifth-round approach places more weight on outcomes: are risks understood, is financial intelligence used, are beneficial owners known, are criminals prosecuted and their assets taken.
Could South Africa be greylisted again?
It is possible, and the question is being asked openly in South Africa.
The path back to the grey list runs through the FATF's International Co-operation Review Group: a country whose evaluation produces poor effectiveness ratings in priority areas can be referred for review and, if deficiencies are confirmed, placed under increased monitoring again.
National Treasury has described an ICRG referral as difficult to reverse.
In its October 2026 quarterly assessment, the business organisation Business Leadership South Africa warned that stalled anti-corruption reforms and weaknesses in investigating organised crime, securing convictions and recovering criminal assets could count against South Africa, and that the risk of a return to the grey list was significant.
The Madlanga Commission's findings on failings in police and intelligence leadership have added to that concern. This is an industry assessment of risk, not an outcome: the evaluation is still in progress and no FATF determination has been made.
Why your institution's evidence feeds the national result
Assessors do not only interview government departments. They sample how the system works at the level of banks, fintechs, law firms and property practitioners:
whether beneficial owners are actually verified
whether suspicious transaction reports are filed and useful
whether sanctions screening catches matches
whether supervisors find and fix weaknesses.
An institution that cannot show a clear rationale and audit trail for its risk ratings, escalations and reports is a weak data point in a national picture that South Africa needs to be strong.
That is why the FIC's 2026 push on RMCP submissions, geographic particulars and returns is best read as evaluation preparation, and why supervisors are unlikely to soften before October 2027.
Advanced Transaction Monitoring Tool
Detect, prevent, and resolve suspicious activities in real-time with azakaw's AI-powered AML solution. Adopt a smarter and faster monitoring system that reduces false positives.
How compliance teams can prepare now
The most useful thing a compliance team can do in the year before the on-site visit is to make its AML compliance programme evidence-ready: able to show not just that controls exist, but that they produce decisions a third party can follow.
The steps below are an example workflow, not a regulatory procedure, and should be adapted to your Schedule 1 category and supervisor.
Refresh the business risk assessment and the RMCP. Check that both reflect what the business does today, including new products, channels and geographies, and that the RMCP has been approved by senior management. If you are in a Directive 12 category, confirm the submission was made and keep the FIC's acknowledgement on file.
Verify beneficial ownership; do not just collect it. Map corporate clients to the natural persons who own or control them, compare your records with the CIPC register, screen those individuals, and set a trigger to refresh the picture when directors or shareholders change. Discrepancy reporting is coming if the 2026 Bill is enacted; building the comparison now avoids a scramble later.
Recalibrate country risk for South African exposure. For institutions outside South Africa, document a current rating that reflects delisting, review automatic EDD triggers, and diarise a review for when the 2027 evaluation report is published.
Screen continuously, not only at onboarding. Sanctions lists, PEP status and adverse media change between periodic reviews. Ongoing screening is what turns a point-in-time check into the "ongoing due diligence" the FIC Act requires.
Make every decision evidence-ready. Record the rationale for risk ratings, alert closures, escalations and reporting decisions, with timestamps and reviewer identity. This is what inspectors and assessors mean by effectiveness.
Close the small gaps that generate most sanctions. Confirm FIC registration details, Directive 10 geographic particulars, risk and compliance returns, training records and the compliance officer appointment. These are the cheapest failures to fix and the most common ones in published sanctions.
If you are a CASP, test the Travel Rule end to end. Check that originator and beneficiary data travels with transfers, that counterparty CASP due diligence is documented, and that there is a defined process for transfers where the required information is missing.
Track the legislative pipeline. The General Laws (AML/CTF) Amendment Bill B15–2026, the FIC's directive programme and the FATF's 2027 timetable will all change obligations over the next 12 months. Assign someone to watch them.
Where technology can help
Most of what the FATF means by effectiveness, and most of what South African supervisors are now sanctioning, comes down to the same operational problems:
ownership that was declared but never verified
screening that happened once
risk ratings nobody can explain
decisions with no audit trail
Technology does not create a compliant programme on its own, but it can remove the manual work that makes these gaps appear.
In practice, the capabilities that matter most for a post-greylisting environment are:
Structured KYB and UBO mapping, so that corporate onboarding captures ownership and control down to natural persons, with its own audit trail and its own monitoring after onboarding rather than a one-off form.
Screening with ongoing monitoring, so that sanctions, PEP and adverse media checks are repeated automatically across the customer base and changes surface as alerts rather than at the next annual review.
Configurable risk scoring, so that country risk, product risk and customer risk can be adjusted as the facts change, with the logic documented, which is exactly what institutions need when a jurisdiction leaves or joins the grey list.
Transaction monitoring with alert triage, so that unusual activity is detected consistently across fiat and crypto flows and investigators spend their time on cases that deserve it.
Audit-ready records, so that every screening result, rating and decision can be produced for an inspector or an assessor with its rationale.
Enterprise Compliance, Simplified
Detect, prevent, and resolve suspicious activities in real-time with azakaw’s AI-powered AML solution. Adopt a smarter and faster monitoring system that reduces false positives.
Frequently asked questions
When was South Africa removed from the FATF grey list?
On 24 October 2025, at the close of the FATF plenary in Paris. South Africa had been under increased monitoring since 24 February 2023, a period of 32 months. Nigeria, Mozambique and Burkina Faso were removed at the same plenary.
Is South Africa still on the EU list of high-risk third countries?
No. The European Commission published South Africa's removal on 9 January 2026 and it took effect on 29 January 2026.
EU institutions are no longer required by that listing to apply enhanced due diligence to South African exposure, though each institution still sets its own country-risk approach.
Did delisting reduce AML requirements for businesses in South Africa?
No. The FIC Act, its regulations and all existing directives continue to apply. In 2026, the FIC added obligations, including annual RMCP submissions under Directive 12, geographic particulars under Directive 10 and updated risk and compliance returns under Directive 11.
When is South Africa's next FATF mutual evaluation?
It has already started. The FATF's assessment calendar indicates an on-site visit around February 2027, National Treasury has referred to 2 to 19 March 2027, and the report is expected to be discussed at the October 2027 plenary. The FATF describes these dates as indicative.
Could South Africa go back on the grey list?
It is possible. A poor effectiveness rating in the mutual evaluation could lead to a referral to the FATF's International Co-operation Review Group and, ultimately, renewed increased monitoring. Business Leadership South Africa flagged this risk in October 2026, citing weaknesses in investigations, prosecutions and asset recovery. No FATF determination has been made.
Do foreign banks still have to apply enhanced due diligence to South African customers?
There was never a FATF requirement to apply EDD to grey-listed countries as a class; the EU listing created a statutory trigger for EU institutions, and that trigger was lifted in January 2026. Whether EDD applies to a given South African customer now depends on the institution's own risk-based assessment of that customer, not on a country label.
Who is the AML regulator in South Africa?
The Financial Intelligence Centre is the financial intelligence unit and central AML authority. Supervision of FIC Act compliance is shared with the Prudential Authority (banks), the FSCA (non-bank financial institutions and licensed CASPs), the Legal Practice Council, the Property Practitioners Regulatory Authority and gambling regulators.
Are crypto companies accountable institutions in South Africa?
Yes. Crypto asset service providers have been accountable institutions under item 22 of Schedule 1 to the FIC Act since 19 December 2022. They must comply with the full FIC Act regime, apply the Travel Rule under FIC Directive 9, and, from 2026, submit their RMCPs annually under Directive 12.
What are the penalties under the FIC Act?
Administrative sanctions under section 45C include a caution, reprimand, remediation directive, restriction or suspension of business activities and financial penalties of up to R10 million for a natural person and R50 million for a legal person.
Criminal offences under section 68 carry up to 15 years' imprisonment or a fine of up to R100 million for the most serious offences, and up to five years or R10 million for specified others.
Conclusion
South Africa's exit from the FATF grey list in October 2025 was a real achievement, and the EU's decision to follow in January 2026 confirmed it. But for compliance teams, the practical message is the opposite of relief.
Inside South Africa, the FIC Act applies in full and the 2026 directives have added annual RMCP submissions, geographic disclosures and updated returns, with enforcement that has not slowed.
Outside South Africa, the task is to recalibrate country risk on evidence rather than on a label from 2023. And for everyone, the fifth-round mutual evaluation now under way, with an on-site visit in early 2027 and a decision in October 2027, is the test that will decide whether the signal changes again.
The institutions that can show their controls work, with verified ownership, continuous screening and decisions that leave a trail, are the ones that will be ready whatever the outcome.
Advanced Transaction Monitoring Tool
Detect, prevent, and resolve suspicious activities in real-time with azakaw's AI-powered AML solution. Adopt a smarter and faster monitoring system that reduces false positives.
South Africa Greylisting - Video Explainer
Related articles
Sources
FATF – Outcomes of the FATF Plenary, 22–24 October 2025
FATF – Jurisdictions under Increased Monitoring, 19 June 2026
FATF – Outcomes of the FATF Plenary, 17–19 June 2026
FATF – Global Assessment Calendar
FATF – FATF Week, October 2026
National Treasury statement on South Africa’s exit from the FATF grey list, 24 October 2025 (via Corruption Watch)
Cliffe Dekker Hofmeyr – Removal of South Africa from the EU list of high-risk third countries
Parliament of South Africa – General Laws (AML/CTF) Amendment Bill (B15–2026)
GoLegal – Parliament briefed on the Anti-Money Laundering Amendment Bill, 19 October 2026
Lexology – South Africa proposes tougher beneficial ownership rules
Acts Online – Companies Act amendments and the CIPC beneficial ownership hard-stop
Moonstone – FIC Directive 12: annual RMCP submissions
GoLegal – RMCP compliance: what Directives 10 and 12 and Guidance Note 7B require
Financial Intelligence Centre – Public Compliance Communication on the Travel Rule for CASPs
Financial Intelligence Centre Act 38 of 2001, section 68 (penalties)
South African Reserve Bank – Administrative sanctions under the FIC Act
FAnews – FIC Act sanctions: lessons from the past year
BusinessTech – FSCA sanction on Sanlam Collective Investments, October 2025
Moonstone – FIC Appeal Board upholds R7.7 million penalty against a law firm
The Citizen – National Treasury briefing to Parliament on the FATF mutual evaluation
Moonstone – Latest FATF review puts South Africa under a harsher spotlight
ENS – South Africa’s post-greylisting moment: why enforcement now matters more than ever
Sowetan / Reuters – BLSA quarterly assessment on grey-list risk, 28 October 2026
This content is provided for general informational purposes and does not constitute legal or regulatory advice. AML and counter-terrorist financing obligations in South Africa depend on an institution's Schedule 1 category, its supervisory body and the directives and guidance in force at the time. FATF evaluation dates are indicative and may change, and the General Laws (Anti-Money Laundering and Combating Terrorism Financing) Amendment Bill, 2026 had not been enacted at the date of writing. Organisations should consult the Financial Intelligence Centre Act, the guidance of their supervisor and qualified legal or compliance professionals before acting on any point in this article.
