📖 Estimated reading time: 6 minutes
Key Takeaways |
|
• The FIC published Directive 12 in Government Gazette No. 55337 on 4 September 2026; it takes effect on 7 September 2026 |
|
• Legal practitioners (Item 1) must submit their RMCP via goAML by 9 October each year |
|
• Estate agents (Item 3) have an annual submission deadline of 31 October |
|
• Any RMCP amendment approved after an annual submission must be resubmitted within 10 days of approval |
|
• Newly established accountable institutions must submit their RMCP within 90 days of commencing business |
|
• A successful goAML upload confirms file format only; it is not FIC approval of the RMCP |
|
• RMCP submissions under Directive 12 are entirely separate from Risk and Compliance Returns required under Directives 6, 7, and 11 |
|
• Non-compliance may result in financial penalties of up to R10 million for natural persons and up to R50 million for legal entities |
South Africa’s compliance environment has been tightening for several years and the October 2026 deadlines now make that tightening tangible. For legal practitioners, estate agents, and other specified accountable institutions, 7 September 2026 marks the start of a new annual obligation: submitting the documentation describing their Risk Management and Compliance Programme (RMCP) to the Financial Intelligence Centre (FIC) via goAML. Most firms already have an RMCP. The question is whether it is board-approved, current, and ready to upload.
What Is FICA Directive 12?
FICA Directive 12 is a legally binding directive issued by the Financial Intelligence Centre that requires specified accountable institutions, including legal practitioners and estate agents, to submit the documentation describing their Risk Management and Compliance Programme (RMCP) to the FIC annually via the goAML platform. Published in Government Gazette No. 55337 on 4 September 2026 and effective 7 September 2026, the first submissions are due in October 2026.
An RMCP is the foundational policy document that sets out how an accountable institution identifies, assesses, monitors, mitigates, and manages the risks of money laundering, terrorist financing, and proliferation financing within its practice. The obligation to have one has existed for years. Directive 12 adds an annual, externally submitted dimension: the programme must now be submitted to the FIC, kept current, and resubmitted within a defined window whenever approved amendments are made.
Directive 12 is issued under section 43A of the Financial Intelligence Centre Act, No. 38 of 2001 (FICA), which means it carries the full force of law. Non-compliance is treated as a statutory violation, not an administrative shortcoming. (FIC Directive 12, Government Gazette No. 55337, September 2026)
Who Must Comply, and What Are the Deadlines?
Directive 12 applies to nine categories of accountable institutions listed in Schedule 1 to FICA:
- Item 1: Legal practitioners
- Item 2: Certain trust and company service providers
- Item 3: Estate agents
- Item 9: Gambling institutions
- Item 11: Credit providers (excluding banks, mutual banks, and co-operative bank credit providers)
- Item 14: The South African Postbank Limited
- Item 20: High-value goods dealers
- Item 21: The South African Mint Company (RF) (Pty) Ltd
- Item 22: Crypto asset service providers (CASPs)
Two groups of annual deadlines apply:
| Institutions | Annual Deadline |
|---|---|
| Items 1, 2, 9, and 11 | 9 October |
| Items 3, 14, 20, 21, and 22 | 31 October |
Beyond the annual cycle, two further submission triggers apply:
New institutions. An accountable institution commencing business must submit its RMCP within 90 days of starting operations, rather than waiting for the next annual submission window.
Amended RMCPs. Where an institution updates and approves its RMCP after making its annual submission, the amended version must be submitted to the FIC within 10 days of approval. The FIC declined to limit this obligation to material amendments only: any change approved by the board, senior management, or the person with highest authority triggers the 10-day clock. Institutions should note that the final directive specifies 10 calendar days, not the 10 business days that appeared in the draft.
What Legal Practitioners Need to Know
For attorneys and other legal practitioners under Item 1, the 9 October annual deadline means an RMCP must be reviewed, updated where necessary, approved by the relevant authority within the firm, and submitted through goAML before that date. Given that any board-approved amendment made after an annual submission triggers a fresh 10-day submission obligation, RMCP management is no longer a once-a-year exercise.
The Legal Practice Council (LPC) already expects FICA compliance from its members, and Directive 12 creates a formal submission trail that both the FIC and the LPC can draw on during monitoring, inspections, and enforcement. The FIC described its overall RMCP submission response rate after the one-off submission exercise of March 2025 as poor and in urgent need of immediate action, noting that not all institutions required to be registered with the FIC were in fact registered. (SA Accounting Academy, citing the FIC, 2025)
Two common mistakes are worth flagging:
Confusing RMCP submissions with RCR submissions. The RMCP under Directive 12 is submitted via goAML. Risk and Compliance Returns (RCRs) under Directives 6, 7, and 11 use separate submission systems. Submitting one does not fulfil the obligation to submit the other. The FIC has warned that institutions submitting their RCRs or RMCPs through the wrong channel may face administrative penalties.
Treating a successful upload as FIC approval. A completed goAML submission confirms only that the file was uploaded in the correct format and naming convention. The FIC and other supervisory bodies retain the right to access and act on submitted RMCPs as part of their ongoing supervisory functions, which may include guidance, monitoring, inspections, and enforcement.
The consequences of RMCP non-compliance in legal practice are well-documented. The FIC Appeal Board upheld a R7.7 million administrative penalty against a Johannesburg-based law firm for failing to implement adequate customer due diligence and for failing to develop a robust RMCP.
What Estate Agents Need to Know
Estate agencies operate under oversight from both the FIC and the Property Practitioners Regulatory Authority (PPRA). During PPRA inspections, agencies are already expected to provide immediate access to their RMCP, client due diligence files, source-of-funds records, and evidence of sanctions and politically exposed person (PEP) screening. (BusinessTech, May 2026)
Directive 12 means that from October 2026, estate agencies need to do more than keep an RMCP on file. They must submit it annually via goAML by 31 October, keep it current, and resubmit within 10 days of any approved amendment.
Enforcement already shows what non-compliance costs. The FIC Appeal Board upheld a R266,000 penalty against Capital Point Properties in August 2024. The finding: the agency’s compliance existed only on paper. With individual FIC sanctions now reaching R7.8 million, the message for property practitioners is that programmes not backed by operating processes do not withstand scrutiny. (Property Professional, May 2026)
For agencies operating through branch networks: where branches are not accountable institutions in their own right, one RMCP submission covers the entire network. Where branches are standalone registered accountable institutions, each must submit its own RMCP.
How Lexpro and nCino KYC Help Your Firm Stay Ahead
An RMCP describes how a firm manages compliance in practice. For that document to carry weight with the FIC, the processes it describes need to be running consistently across the firm: every client onboarded through a documented KYC process, identities verified against third-party data, clients screened for sanctions and adverse media, and risk ratings applied consistently from day one.
Lexpro has integrated with nCino KYC, formerly known as DocFox, to give legal practitioners and estate agents using the Lexpro platform the tools to run those compliance processes from within their existing practice management workflow.
From within Lexpro, users can:
- Initiate the nCino KYC document uploading process without re-entering client data already held in Lexpro
- Access KYC summary PDFs directly within the Lexpro system
- Ensure every member of the firm follows the same documented, auditable onboarding process
- Perform required KYC and customer due diligence checks before proceeding with any new client matter
This kind of operational consistency is exactly what a credible RMCP is expected to describe, and what the FIC expects to find in practice when it reviews a submission. With Directive 12 now requiring that RMCP to be submitted annually, the gap between what a firm documents and what it actually does carries real regulatory risk.
Find out how the Lexpro and nCino KYC integration can support your firm’s FICA compliance: book a demo or contact the Lexpro team.
Frequently Asked Questions About FICA Directive 12
What is FICA Directive 12?
FICA Directive 12 is a legally binding directive issued by the Financial Intelligence Centre under section 43A of the Financial Intelligence Centre Act, 2001. It requires specified accountable institutions, including legal practitioners, estate agents, and credit providers, to submit the documentation describing their Risk Management and Compliance Programme to the FIC annually via the goAML platform. It was published on 4 September 2026 and took effect on 7 September 2026, with first submissions due in October 2026.
Does submitting my RMCP under Directive 12 replace my obligation to submit a Risk and Compliance Return?
No. RMCP submissions under Directive 12 are entirely separate from Risk and Compliance Returns (RCRs) required under Directives 6, 7, and 11. These are different documents, submitted through different platforms. An RMCP is submitted via goAML. RCRs use dedicated RCR submission systems. Neither submission satisfies the other obligation, and institutions that submit the wrong document through the wrong channel may face administrative penalties.
What penalties apply to institutions that fail to comply with Directive 12?
Non-compliance with Directive 12 is a statutory violation under FICA. Under section 45C(3) of the FIC Act, the FIC may impose financial penalties of up to R10 million for natural persons and up to R50 million for legal entities. Additional sanctions can include cautions, reprimands, directives for remedial action, and the restriction or suspension of business activities. The FIC may also refer matters to the South African Police Service or the National Prosecuting Authority for criminal investigation.
Directive 12 Is a Baseline, Not a Finish Line
Directive 12 formalises something that should already be in place: a current, board-approved RMCP that accurately reflects how your firm actually manages compliance. The obligation to have such a programme is not new. The obligation to submit it annually, keep it updated, and resubmit within 10 days of any approved amendment is. First deadlines arrive in October 2026: 9 October for legal practitioners, 31 October for estate agents. Firms whose compliance infrastructure is already operational are better placed to meet those deadlines without disruption. Lexpro and nCino KYC give you the tools to build that infrastructure into your daily workflow, rather than treating compliance as a separate, periodic burden.
Contact Lexpro
To find out how Lexpro and nCino KYC can support your firm’s FICA compliance under Directive 12:
Lexpro Systems 118 Sovereign Drive, Route 21 Business Park, Centurion, 0157 📞 012 345 4510 🌐 lexpro.co.za 📅 Book a demo ✉️ Contact us
