Reviewed by Jose Joseph CFP®, founder of EBlink and a practising employee benefits consultant.
FICA compliance for brokers is no longer something a practice can treat as a once-off onboarding form. The Financial Intelligence Centre Act requires accountable institutions to understand their clients, assess money-laundering and terrorist-financing risk, keep records and report suspicious activity.
Whether FICA applies to your practice, and how far, depends on the financial products you deal in. This guide sets out eight practical steps for FICA compliance for brokers, with a focus on employee benefits practices. It is a practical overview, not legal advice, so confirm your specific obligations with your compliance officer and the Financial Intelligence Centre (FIC).
Key Takeaways
- FICA compliance for brokers starts with confirming whether your FSP is an accountable institution under Schedule 1.
- Accountable institutions must register with the FIC and maintain a Risk Management and Compliance Programme (RMCP).
- Client due diligence must include the beneficial owners of employer clients, not just the company.
- Records generally need to be kept for at least five years and be easy to retrieve.
- Suspicious transactions must be reported to the FIC, and clients must never be tipped off.
- A risk-based approach focuses effort on the clients and products that carry the most risk.
Does FICA Apply to Your Brokerage?
FICA places its main duties on accountable institutions, which are listed in Schedule 1 to the Act. The list includes long-term insurers and certain financial services providers, depending on the products they advise on and the services they provide.
Employee benefits brokers often deal in long-term insurance products and investment-type products such as retirement funds, so many practices fall within the scope of FICA in some way. Because the definitions are specific, the first step in FICA compliance for brokers is to confirm exactly where your practice stands.
Step 1: Confirm Your Status and Register With the FIC
Work out whether your FSP is an accountable institution under Schedule 1. If it is, it must register with the FIC.
Keep a written record of how you reached your conclusion. If your business changes, for example by adding new product types, review your status again.
Step 2: Build a Risk Management and Compliance Programme (RMCP)
Accountable institutions must have a Risk Management and Compliance Programme, usually called an RMCP. This is the core document of FICA compliance for brokers.
Your RMCP should explain how your practice:
- Identifies and assesses money-laundering and terrorist-financing risk
- Performs client due diligence at the right level for each client
- Keeps records
- Reports to the FIC
- Trains staff
- Reviews and updates the programme
The RMCP must reflect how your business actually works. A generic template that does not match your clients and products will not protect you.
Step 3: Take a Risk-Based Approach
FICA expects you to focus effort where the risk is highest. Assess each client relationship and product against risk factors such as:
- The type of client, for example a listed company, a private company or a trust
- The products involved and how money flows through them
- The source of funds
- Any links to high-risk jurisdictions
An employer group buying group risk cover through payroll may be low risk, while a complex investment structure may need more scrutiny. Document how you rate each client.
Step 4: Perform Client Due Diligence
Client due diligence, often called CDD, means establishing and verifying who your client is. For employer clients, this usually includes:
- Verifying the legal entity, such as its registration details
- Identifying the people authorised to act on its behalf
- Identifying the beneficial owners, the natural persons who ultimately own or control the entity
- Understanding the nature and purpose of the business relationship
Apply enhanced due diligence for higher-risk clients and ongoing due diligence for the life of the relationship, not just at onboarding. Our guide to employee benefits client onboarding shows how to build these checks into your onboarding process.
Step 5: Screen Against Sanctions Lists
Accountable institutions must check whether clients appear on the targeted financial sanctions lists published by the FIC. Screen new clients before you take them on and check existing clients when the lists change.
Record each screening, its date and its result.
Step 6: Keep Records for the Required Period
FICA requires you to keep records of client due diligence and transactions. These records are generally kept for at least five years after the relationship or transaction ends.
Records must be easy to retrieve. During an inspection you may need to produce a specific client’s FICA documents quickly, so store them against the client record rather than in scattered email folders. Our article on employee benefits scheme records covers how to keep client information organised.
Step 7: Report to the FIC When Required
FICA compliance for brokers includes reporting obligations. Depending on your status and the circumstances, these may include:
- Suspicious and unusual transaction reports where you know or suspect that a transaction may involve the proceeds of crime or terrorist financing
- Cash threshold reports for cash transactions above the prescribed amount
- Terrorist property reports where relevant
Reports are made to the FIC through its online reporting system. Never tip off a client that a report has been made.
Step 8: Train Your Team and Review Regularly
FICA compliance depends on people. Everyone who deals with clients should understand the basics of your RMCP, how to spot red flags and how to escalate a concern.
Keep a record of training and review your RMCP at least once a year, or sooner if the law or your business changes. Training on FICA can also count towards CPD where it is relevant to your authorisation.
Common FICA Mistakes in Brokerages
- Treating FICA as a once-off document collection exercise
- Not identifying the beneficial owners of employer clients
- Keeping FICA documents in personal inboxes instead of client records
- An RMCP that has never been updated
- No record of sanctions screening
- No clear owner for FICA compliance in the practice
Each of these is easy to fix once you can see where every client stands.
FICA Compliance for Brokers: Tracking Status Across Your Book
When you have dozens of employer clients, it is hard to know at a glance which ones are fully verified, which need updating and which have outstanding documents.
A broker CRM built for South African practices can record each client’s CDD/FICA status alongside the rest of your compliance work. In EBlink, CDD/FICA sits in the same regulatory suite as FAIS licence conditions, Section 14, Section 37C and CPD, with outstanding items surfaced first. Principals can see the whole book’s status, and consultants can see what they need to complete for their own clients.
FICA Compliance for Brokers: Checklist
- Status as an accountable institution confirmed and recorded
- Registered with the FIC where required
- RMCP written, approved and reviewed annually
- Risk rating recorded for every client
- CDD completed, including beneficial owners
- Sanctions screening done and recorded
- Records kept for at least five years and easy to retrieve
- Reporting procedures in place
- Staff trained and training recorded
FICA Compliance FAQs
Do all brokers need to comply with FICA?
Not in the same way. Obligations depend on whether your FSP is an accountable institution and on the products you deal in. Confirm your status with your compliance officer.
How often should client FICA information be updated?
Ongoing due diligence applies for the life of the relationship. Update information when something changes and review higher-risk clients more often.
What is a beneficial owner?
A beneficial owner is the natural person who ultimately owns or controls a client entity. For employer clients, you need to identify these people, not just the company itself.
FICA Red Flags in a Benefits Practice
Money laundering risk in employee benefits work is usually lower than in, for example, cash-intensive businesses, but it is not zero. Watch for warning signs such as:
- A client that is reluctant to provide ownership information or keeps changing it
- Complex company structures with no clear business reason
- Unusual requests to pay benefits or refunds to third parties
- Large or unexplained lump-sum contributions to investment-type products
- Links to high-risk jurisdictions without a clear explanation
- Pressure to complete transactions quickly while skipping normal checks
When something seems unusual, escalate it internally according to your RMCP. Do not discuss the concern with the client.
A Simple Risk Rating Approach
Your RMCP should explain how you rate risk. A practical approach for a benefits practice is to rate each client as low, medium or high, based on:
- Client type: for example, listed companies and government entities may be lower risk than complex private structures.
- Products: risk-only group cover through payroll is generally lower risk than investment products with flexible contributions.
- Geography: clients with links to higher-risk countries may need more checks.
- Delivery channel: face-to-face relationships may carry less risk than clients you never meet.
Record the rating and the reasons, then match the level of due diligence to the rating. Review high-risk clients more often.
Working With Product Providers on FICA
Insurers and fund administrators have their own FICA obligations, and they may ask you for client documents or verification. Agree with each provider who collects what, so the employer is not asked for the same documents several times.
Keep a record of what you have sent to each provider and when. Our guide to broker insurer management explains how to keep provider correspondence organised.
FICA Compliance for Brokers: Key Terms
- Accountable institution: a business listed in Schedule 1 to FICA that carries the Act’s main obligations.
- RMCP: the Risk Management and Compliance Programme that sets out how you comply.
- CDD: client due diligence, the process of identifying and verifying clients.
- Beneficial owner: the natural person who ultimately owns or controls a client entity.
- Enhanced due diligence: extra checks applied to higher-risk clients.
- Targeted financial sanctions: lists of people and entities you must screen against.
More Questions Brokers Ask
What is an RMCP and who approves it?
An RMCP is the Risk Management and Compliance Programme that sets out how your practice complies with FICA. It should be approved by senior management or the board, reviewed regularly and made available to staff who need it.
Do we need to repeat FICA checks for existing clients?
Ongoing due diligence applies for the life of the relationship. You do not necessarily need to collect every document again, but you should keep information up to date and review it when something changes or the client’s risk rating increases.
Can we rely on an insurer’s FICA checks?
Product providers may perform their own checks, but your own obligations as an accountable institution remain. Agree with each provider who collects what, and keep records of the checks you rely on.
How do FICA and POPIA work together?
FICA requires you to collect and keep certain client information, while POPIA requires you to protect it and use it only for lawful purposes. Store FICA documents securely, limit access by role and keep them only for as long as the law requires.
Related Guides
If this topic is relevant to your practice, these guides go deeper:
- Employee benefits compliance in South Africa: the full picture of your regulatory obligations
- Employee benefits client onboarding: building due diligence into onboarding
- Employee benefits scheme records: keeping client information organised and retrievable
- Broker insurer management: working with product providers
Final Thoughts
FICA compliance for brokers is about knowing your clients, managing risk sensibly and being able to prove it. Build a practical RMCP, keep your records organised and review them regularly.
To see how EBlink tracks CDD/FICA status alongside your other obligations, explore the features, read our employee benefits compliance guide, or start a free 30-day trial.