Your questions about the FIC's 2026 Risk and Compliance Return answered. On 31 March 2026, the Financial Intelligence Centre (FIC) officially issued Directive 11 of 2026, requiring specified accountable institutions to submit a Risk and Compliance Return (RCR) electronically via the FIC's goAML platform. With the submission window now open and deadlines fast approaching, compliance officers across South Africa have questions and we’re here to help answer them!
We hosted a webinar to walk accountable institutions through the requirements and received dozens of questions from attendees in real time. Below, we've compiled the most frequently asked questions from that session, along with additional guidance drawn from the Directive itself, Draft PCC 125, and the FIC's published communications.
Whether you're an estate agent, motor dealer, legal practitioner, crypto asset service provider, or high-value goods dealer, this guide is designed to help you understand your obligations and submit with confidence.
What is Directive 11?
Directive 11 of 2026 is a legally binding directive issued by the FIC under section 43A of the Financial Intelligence Centre Act (FICA). It requires specified accountable institutions to complete and submit a Risk and Compliance Return (RCR) — a self-assessment questionnaire that covers your institution's understanding of money laundering, terrorist financing, and proliferation financing (ML/TF/PF) risks, along with the controls you have in place to manage those risks. The RCR covers a three-year reporting period and must be submitted electronically via the FIC's goAML platform.
When did Directive 11 come into effect?
Directive 11 came into effect on 1 April 2026. It was published in draft form on 11 March 2026 for public consultation, and the final version was gazetted on 31 March 2026. The submission window opened on 4 May 2026.
What is the reporting period for the RCR?
The RCR covers three reporting years. For most accountable institutions, the reporting period runs from 1 April 2023 to 31 March 2026. For some categories, the period begins on 1 July 2023. Your sector-specific questionnaire will clarify which period applies to you.
What is Draft PCC 125 and why does it matter?
Draft Public Compliance Communication 125 (PCC 125) was published alongside Directive 11 to provide practical guidance on how to complete and submit your RCR. While the Directive establishes the legal obligation, PCC 125 explains the format, the method of completion, and what the FIC expects in practice. Accountable institutions should read PCC 125 carefully before beginning their submission.
Do Third Party Payment Providers (TPPPs) need to submit?
Third Party Payment Providers do not appear to be included in Directive 11. That said, we encourage you to review PCC 125 yourself for certainty.
My company doesn't fit neatly into any of the specified industries. Do I still need to submit?
If your business is not specifically listed in the Directive, then you will not need to complete the RCR. The obligation is tied to the categories of accountable institutions specified in Schedule 1 of FICA, not to all businesses generally.
Does a small sole proprietor nearing retirement still need to submit?
Yes. The obligation to complete and submit the RCR is not linked to the size of the business, its ownership structure, or the volume of business being conducted. It depends solely on whether your business falls within one of the accountable institution categories specified in the Directive.
I have one legal entity but multiple accountable institutions (AIs) registered under it. Do I submit one RCR or multiple?
Where branches or subsidiaries fall within your legal structure, the head office should submit a single, consolidated RCR on behalf of the entity.
What are the submission deadlines?
There are two staggered deadlines depending on your category:
30 June 2026 (by 17:00):
31 July 2026 (by 17:00):
We are a financial service provider — we provide advice on pension funds, medical aid, and financial planning. When is our deadline?
As noted above, FSPs (unless operating as a FAIS-licensed crypto firm) do not appear to be included in the Directive. Please check PCC 125 to confirm your position.
Where do I submit the RCR?
The RCR must be submitted electronically via at https://rcr.fic.gov.za/ or via the FIC's goAML platform. You will need to be registered on the platform and have an Org ID to access the submission portal.
I don't see the option to submit the RCR on the goAML website, even though I'm appointed as the FIC officer for my firm. What should I do?
At the time of the webinar, the RCR portal was still being made available by the FIC. It was expected to be accessible from 4 May 2026. If you are still unable to see the submission option, contact the FIC Helpdesk on 012 641 6000 for assistance.
Can I edit or withdraw my RCR after I've submitted it?
No. Once an RCR has been submitted, it cannot be edited or withdrawn. If you discover an error after submission, you will need to report it through the FIC's formal query process. This makes accuracy and thorough internal review before submission absolutely essential.
Where should I source the information to complete the RCR?
Accountable institutions should draw on their Risk Management and Compliance Programme (RMCP), customer due diligence documents, financial records, records of regulatory reports filed with the FIC, and other relevant operational records. The RCR is a self-assessment — you are responsible for ensuring the information you provide is correct.
Can I use data from my financial records to answer questions about past client activity?
Yes. You are responsible for completing the questionnaire with accurate information, so use any reliable sources available to you — including your financial records, internal systems, and client databases.
Some of the industry-specific questions are vague. For instance, they ask about cash in the business. Do I answer those, or mark them as not applicable?
If you genuinely cannot answer a question, you could use "N/A" or note that you need more information to respond or that it does not apply to you. Alternatively, contact the FIC Helpdesk on 012 641 6000 for clarity on how to approach specific questions.
We only registered with the FIC last year. How do we answer the questions that cover the previous two years?
You can only answer questions for the period during which you were an operating accountable institution. If you have been registered for less than three years, you would not have data for the full reporting period. In those cases, you could enter "N/A" for the periods before your registration.
What do we do about customers we onboarded before we registered with the FIC?
This is a nuanced area. We recommend reaching out to the FIC directly on 012 641 6000 to confirm the correct approach for your circumstances.
If we submitted our RCR for Directive 6, are we compliant with Directive 11?
No. Directive 6 and Directive 7 were earlier submissions that covered different time periods. If you complied with Directive 6 or 7, you met that obligation at the time, but Directive 11 is a new and separate submission. You will need to complete the 2026 RCR covering all three reporting years, even if you previously submitted under Directive 6.
What is the difference between Directive 6, Directive 7, and Directive 11?
Directives 6 and 7 required essentially the same exercise — submitting an RCR — but applied to different sectors with different deadlines. Directive 11 is the latest iteration, covering a three-year reporting period (2023–2026) and incorporating updated questionnaires and more structured submission requirements. All specified accountable institutions must submit afresh under Directive 11.
Do I need to update my RMCP to reflect Directive 11?
Yes. A Directive issued by the FIC carries the same legal weight as a provision of the Act itself. We recommend acknowledging the existence of Directive 11 in your RMCP and confirming its completion once your RCR has been submitted. You can then update the RMCP version you have stored on the GoAML platform.
What happens if I don't submit my RCR by the deadline?
Failure to submit the RCR by the applicable deadline constitutes non-compliance with the FIC Act and may result in administrative sanctions under section 62E. The FIC has already issued fines and sanctions to accountable institutions that failed to submit their Directive 6 and Directive 7 returns, and the same enforcement approach is expected for Directive 11.
To put this in perspective: during the 2023/24 reporting period, the FIC conducted 269 inspections focused specifically on RCR non-submission, identified 191 non-compliant institutions, and issued 186 notices of intention to sanction — each carrying a financial penalty of R10,000 or greater, along with remedial directives. There is every reason to expect the FIC will apply at least the same rigor to Directive 11.
Will nCino KYC provide reports to help us answer the RCR questions?
Yes. We will help you answer as many of the RCR questions as possible using the data in your nCino KYC system. However, not all questions can be answered from your system alone — some are business-specific and will require input from your team.
Does nCino identify synthetic ID risk?
Yes. nCino KYC offers a biometric identification solution that significantly reduces the risk of synthetic identities. If you'd like to learn more about how this works, reach out to our team and we'll walk you through a demonstration.
If your question wasn't covered here, the following resources can help:
Directive 11 is not just a regulatory checkbox — it reflects the FIC's ongoing shift toward proactive, data-driven compliance supervision. Preparing early, gathering your data, and understanding your obligations now will save your business time, money, and unnecessary regulatory scrutiny down the line.
This article is for informational purposes only and does not constitute legal advice. Accountable institutions should consult the Directive, PCC 125, and where necessary for more clarification consult with, a qualified compliance professional for guidance specific to their circumstances. Alternatively as mentioned above, for specific guidance or technical assistance reach out to the FIC.