Directive 11 Now in Force: What Compliance Officers Need to Know

On 31 March 2026, the Financial Intelligence Centre (FIC) officially issued Directive 11 of 2026, mandating specified accountable institutions to submit their 2026 Risk and Compliance Return (RCR) electronically within set deadlines. Directive 11 came into effect on 1 April 2026. It is no longer in draft form. The obligation to submit your RCR as per Directive 11 is now legally binding.

What is this about?

Similar to the previous Directive 6/7, the Financial Intelligence Centre (FIC) has issued a new formal Directive requiring businesses under certain Schedule Items to submit an online questionnaire called a Risk and Compliance Return (RCR).

The questionnaire aims to provide the FIC with an understanding of how Accountable Institutions understand and manage money laundering, terrorist financing, and proliferation financing risks in various sectors within South Africa.

They are looking to test your AI to see if you understand the risk your business faces, how you measure and it, do you know your clients, do you know how to identify something suspicious and do you act – and how.

This should all be documented in your RMCP, so it is a short cut for them to see that all the requirements of FICA are documented, and, to an extent, assess your effectiveness.

Think of it as a regulatory check-in where you report on the real-life state of your compliance programme.

Compliance with Directives is mandatory, and has the same significance and weight as if they were part of the FIC Act itself.

Who does this Directive impact?

• Item 1 – Legal practitioners (attorneys)
• Item 2 – Trust and company service providers
• Item 3 – Estate agents
• Item 9 – Casinos and gambling/gaming institutions (both casino and non-casino)
• Item 11 – Credit providers (but NOT banks, mutual banks, or co-operative banks that act as credit providers — these are specifically excluded)
• Item 14 – The Postbank
• Item 20 – High-value goods dealers (HVGDs), including dealers in precious stones, precious metals, and Krugerrands
• Item 21 – The South African Mint Company
• Item 22 – Crypto Asset Service Providers (CASPs)

IMPORTANT:

• Where an institution has branches falling within their legal structure, the RCR response should be consolidated into a single response by the Head Office.
• Where an institution has branches or subsidiaries that are separate legal entities in their own right, from the associate institution (e.g. franchises), they constitute a separate accountable institution, which should be registered separately with the Centre and submit their own RCR response.
• Where an institution conducts business activities across more than one FIC Act Schedule 1 item, they must submit a separate RCR to the Centre, for each schedule item. For example, a high-value goods dealer that is also a credit provider.

When is it due?

When you must submit the RCR and what period you must cover depends on the category/categories you are registered under.

How can we prepare?

The FIC has provided a template sample questionnaire that mirrors the questions that will be in the online RCR.

This can be accessed here

It is highly recommended that you review the questionnaire and begin gathering the required information, data and analysis in advance.

Where are we seeing weaknesses

Staff, and more importantly, leaders being unable to explain FICA, risk or the processes in the business

Not risk assessing every client

No sanction screening up front, or ongoing when list changes.

Not taking a risk-based approach to ongoing due diligence

Unable to show that the information provided is accurate and based on true information (the FIC can come back and ask for evidence)

What if I am an nCino KYC customer?

We are working to provide a bespoke report of relevant available data you hold in nCino KYC to contribute to the information you may need to complete your report. We are planning to make this available via your Officer Portal in the coming weeks.

Where do I submit my response?

The submission will be through the FIC goAML platform by logging into your account. Remember to never share your GoAML login with anyone.

Once submitted, the RCRs may not be retracted or edited. Where an accountable institution finds that its submission is inaccurate, it must submit a written compliance query to the FIC, advising that it has submitted an incorrect 2026 RCR here

Upon completion, you will be able to download a copy of the completed RCR for record keeping purposes (5 years) and to evidence your compliance with the requirement.

It is important to note that the FIC will only make the RCR submission available from Monday, 4 May 2026.

Where can I get more information?

The FIC have provided the notice of the Directive here and Public Compliance Communication (PCC125) gives guidance around the completion of the RCR here.

nCino KYC will continue to keep you updated on any further developments. If you need assistance with your FICA compliance, contact us or request a demo to see how we can help you stay on top of your obligations.