South Africa’s financial sector is governed by a complex and fast-evolving regulatory landscape. Banks, insurers, investment managers, and financial service providers are required to demonstrate robust compliance across AML, market conduct, cybersecurity, data protection, and the FSCA’s new OMNI Conduct & Risk Return.
Below is a concise breakdown of the core obligations — and how institutions can get ahead of regulatory expectations.
1. Anti-Money Laundering (AML) Requirements
Under the FIC Act, institutions must prevent and detect money laundering, terrorist financing, and proliferation financing. Key duties include:
- Registering on goAML
- Appointing a senior Compliance Officer
- Implementing a documented RMCP
- Conducting CDD and EDD (PEPs, FPEPs, DPEPs)
- Performing ongoing monitoring and sanctions screening
- Submitting CTR, STR/SAR, TPR reports
- Retaining AML records for five years
- Conducting staff training and employee vetting
- Submitting annual Risk & Compliance Returns
Regulators are expected to intensify RMCP enforcement in 2026.
2. Market Conduct & Customer Fairness
The FSCA expects institutions to embed customer-centricity through:
- Treating Customers Fairly (TCF)
- Strong governance and board accountability
- Transparent disclosures
- Fit & proper oversight
- Conflict of interest management
- Complaints handling with defined turnaround times
- Product governance aligned to needs and value
- Accurate FSCA regulatory reporting
The upcoming COFI framework will consolidate conduct rules into one outcomes-based regime.
3. FSCA OMNI Conduct & Risk Return
The OMNI Return is now the FSCA’s consolidated supervisory tool. It assesses:
- Governance and compliance
- Customer outcomes and complaints
- Operational and IT risk
- AML controls
- Market integrity and conflict management
Best practices include:
maintaining evidence packs, using dashboards, conducting pre-submission assurance, and retaining submissions for five years.
4. Cybersecurity & Technology Risk
Under the PA/FSCA Joint Standard (2024), institutions must demonstrate operational and cyber resilience through:
- Board-approved cyber policies
- Appointment of a CISO or equivalent
- Integrated cyber/IT risk frameworks
- Third-party security oversight
- MFA, access controls, and identity management
- SOC monitoring, vulnerability testing, and incident reporting
- Alignment with POPIA safeguards
Regulatory focus areas for 2026: cloud governance and outsourced IT monitoring.
5. POPIA & Data Protection
To ensure lawful processing of client data, institutions must:
- Register an Information Officer
- Maintain a Personal Information Inventory
- Implement privacy notices and POPIA policies
- Secure data (encryption, access controls, destruction)
- Ensure operator/third-party compliance
- Respond to data subject requests
- Notify data breaches under Section 22
- Conduct regular PIAs
Data governance must increasingly integrate with cyber frameworks and digital onboarding models.
6. Governance, Oversight & Training
Boards, compliance, risk, and internal audit share responsibility for demonstrating robust oversight.
Institutions must ensure:
- Annual AML, POPIA, Conduct, and Cybersecurity training
- Documented oversight in Board/EXCO packs
- Tested incident response plans
- Updated policy frameworks
- Evidence-based monitoring
7. Recordkeeping Essentials
Most regulatory records — AML, complaints, OMNI submissions, cyber logs, POPIA consents — must be retained for five years.
8. Key Takeaways for Financial Institutions
- Compliance is now integrated: AML, conduct, cyber, POPIA, and governance are interconnected.
- The OMNI Return will drive supervisory focus going forward.
- Evidence, documentation, and data quality are becoming non-negotiable.
- Institutions with proactive compliance frameworks will reduce regulatory and reputational risk.
Need Support Strengthening Your Compliance Framework?
Navigate is an FSCA-licensed compliance practice, a QCTO-accredited training provider, and a specialist in compliance project management and regulatory resourcing.
We help organisations build mature, future-ready compliance frameworks across AML, conduct, cyber, POPIA, third-party governance, and digital transformation.
👉 Book a Compliance Readiness Session
📩 info@navigatecompliance.co.za
🌐https://www.navigatecompliance.io