FIC Compliance in 2026: Understanding RMCP Submissions and Risk and Compliance Returns

Two requirements, two purposes

The Financial Intelligence Centre issued two directives in 2026 that affect many accountable institutions under South Africa’s Financial Intelligence Centre Act (FIC Act).

Directive 11 requires specified institutions to complete a risk and compliance return (RCR). Directive 12 requires specified institutions to submit a copy of their Risk Management and Compliance Programme (RMCP) every year.

Both give the Centre information about an institution’s approach to financial crime risk. They are, however, different exercises with different purposes.

Risk and compliance returns

An RCR is a questionnaire. It asks an institution about its understanding of its money laundering, terrorist financing and proliferation financing risks, and about the controls it has in place.

The Centre uses the results to inform its risk-based supervision, including identifying institutions that may warrant closer attention.

Directive 11 was published on 31 March 2026, and returns were submitted through the Centre’s online platform. For 2026, the deadline was 30 June for some categories of institution and 31 July for others, including legal practitioners, estate agents, high-value goods dealers and non-casino gambling institutions. Public Compliance Communication 60 provides practical guidance on completing the return.

The Centre has said that institutions that miss the deadlines will be treated as non-compliant and may face administrative sanctions.

RMCP submissions

An RMCP is the institution’s own documented programme: how it identifies, assesses, monitors, mitigates and manages its financial crime risks.

Directive 12 was published on 4 September 2026. It requires the institutions it covers to submit a copy of their RMCP to the Centre annually through goAML. The annual date is 9 October for some categories, including legal practitioners and non-bank credit providers, and 31 October for others, including estate agents and high-value goods dealers.

The Directive also addresses new institutions and amended programmes, and the RMCP must be approved by the board, senior management or the person exercising the highest level of authority.

A successful upload does not mean the Centre has approved the content of the programme.

How they differ

The distinction is straightforward but important:

• The RCR records the institution’s answers to the Centre’s questions at a point in time.
• The RMCP sets out the institution’s own risk-based policies, procedures and controls, and must be maintained and implemented on an ongoing basis.

Completing one does not satisfy the other.

Why consistency matters

For many institutions, the Centre now holds both a completed return and a copy of the programme.

If the return describes controls that the RMCP does not mention, or the RMCP describes procedures that are not applied in practice, those inconsistencies may become visible during supervision or inspection.

The most reliable position is one where the risk assessment, the RMCP, the return and day-to-day practice all tell the same story.

Five questions to ask before your next submission

1. Which requirements apply to us? Confirm the institution’s category under Schedule 1 and the directives and deadlines that apply to it.
2. Is our RMCP current and approved? It should reflect the business as it operates today and carry the required approval.
3. Does our return match our programme? Answers given in the RCR should be supported by what the RMCP says.
4. Can we evidence what we describe? Records, training and monitoring should support both documents.
5. Who is responsible? Someone with sufficient seniority should own each submission and the accuracy of the information provided.

The bottom line

RMCP submissions and risk and compliance returns are separate obligations, but they draw on the same foundation: a sound understanding of the institution’s risks and controls that work in practice.

Treating them as part of one coherent compliance approach, rather than as two forms to complete, is the most effective way to meet both.