RMCPs: More Than a Document on a Shelf

Why your RMCP matters

For businesses that qualify as accountable institutions under South Africa’s Financial Intelligence Centre Act (FIC Act), a Risk Management and Compliance Programme (RMCP) is a central part of their compliance arrangements.

An RMCP should explain how an institution identifies, assesses, monitors, mitigates and manages the risks of money laundering, terrorist financing and proliferation financing relevant to its activities.

But preparing a document is only the starting point.

An RMCP must be appropriate to the nature, size and complexity of the business, and its procedures need to be implemented in practice.

Having an RMCP is not the same as implementing one

A business may have a detailed compliance document but still struggle to demonstrate how its procedures operate.

For example, its RMCP might describe customer due diligence requirements without clearly explaining who performs the checks, when additional scrutiny is required or how decisions are recorded.

Similarly, a risk assessment may have been completed when the business first registered as an accountable institution but not revisited after changes to its customers, products, services or operating arrangements.

The challenge is not necessarily an absence of documentation. It is often the gap between what the RMCP says and what happens in the business.

What effective implementation looks like

An effective RMCP should be understood by the people responsible for applying it.

This means translating regulatory requirements into practical procedures that are proportionate to the business’s actual risks.

Depending on the institution and its activities, this may involve customer due diligence, identifying beneficial ownership, applying enhanced measures where appropriate, monitoring relevant transactions, maintaining records and meeting applicable reporting obligations.

Responsibilities should be clearly allocated, and management should have sufficient oversight to understand whether the programme is working.

The RMCP should also be reviewed and updated when changes in the business or its risk environment make this necessary.

Five questions worth asking about your RMCP

Before relying on an existing RMCP, management should consider five questions:

1. Does it reflect the business as it operates today? Consider changes to customers, products, services, locations, payment methods and operating practices.
2. Is the underlying risk assessment current and appropriate? The RMCP should be informed by the risks the business actually faces, rather than relying solely on generic assumptions.
3. Are responsibilities clearly assigned? Employees and management should understand who is responsible for applying procedures, making decisions and escalating concerns.
4. Can the business demonstrate implementation? Relevant records, decisions and evidence of controls should support what is described in the programme.
5. Have applicable regulatory requirements been checked? Confirm whether any current FIC directives, returns or submission obligations apply to the institution and whether the relevant deadlines have been met.

These questions can help identify weaknesses before they become more significant compliance concerns.

What about RMCP submissions?

Certain accountable institutions may be required to submit their RMCPs under applicable FIC directives or regulatory requests.

It is important to distinguish these specific submission requirements from the broader obligation to develop, document, maintain and implement an appropriate RMCP.

Businesses should confirm the requirements that apply to their accountable institution category, including any relevant submission method, deadline and subsequent update obligations.

Whether or not an RMCP must be submitted, the underlying responsibility remains the same: the programme should be appropriate, current and effectively implemented.

A practical approach to improvement

Reviewing an RMCP does not always mean starting again.

A proportionate review can identify where the existing programme remains suitable, where procedures need clarification and where practical implementation could be strengthened.

For some businesses, this may involve updating their risk assessment. For others, the priority may be improving recordkeeping, clarifying responsibilities or aligning documented procedures with actual working practices.

The objective is a programme that supports the business in managing its financial crime risks, rather than one maintained purely for compliance purposes.

The bottom line

An RMCP should be more than a document on a shelf.

Its value lies in how effectively it reflects the business’s risks, guides day-to-day decisions and supports ongoing compliance with the FIC Act.

A well-designed, proportionate programme is one that the business understands, uses and maintains.