Your RMCP is now a submission, not a shelf document

For most of the time I have worked in financial crime compliance, a risk management and compliance programme was something an organisation held. You wrote it, the board approved it, it sat on a shared drive, and it came out when somebody asked. Whether it matched the business was a question that only arose during an inspection.

That changed twice inside five weeks.

On 3 August 2026 the Financial Intelligence Centre published Guidance Note 7B with immediate effect, replacing Guidance Notes 7, 7A and Revised 7A. It is not a tidying exercise. Proliferation financing now runs through the whole programme, so what most of us called an AML and CTF programme is properly an AML, CTF and CPF programme. A risk assessment has to be conducted before a new product, service, business practice or delivery channel is implemented rather than afterwards. Read with the Centre’s own statement of May 2025, the business risk assessment comes before the controls rather than being written afterwards to justify them. Approval sits with the board, senior management or whoever exercises the highest level of authority, which is where section 42(2B) of the Act puts it. And the personal exposure is sharper. Section 42A(1) places the duty to ensure compliance with the Act and with the programme on the board, or on senior management where there is no board, and section 61B(1) makes them, not only the institution, non-compliant and subject to an administrative sanction if they fail in it. Under section 45C the ceiling for a natural person is R10 million.

On 4 September 2026, Directive 12 introduced an annual submission requirement. Accountable institutions file a copy of their programme with the Centre through goAML. For legal practitioners, trust and company service providers, gambling institutions and non-bank credit providers the date is 9 October. For estate agents and for high-value goods dealers under item 20, which includes motor vehicle dealers, art dealers and Krugerrand dealers, it is 31 October. An amended programme has to be resubmitted within ten days of approval.

The position is straightforward. You now hand your programme to your supervisor once a year, and the standard it will be read against changed ten weeks before the first of those deadlines.

Submission is not compliance

Filing on time tells the Centre you have a programme. It does not tell them it works, and it creates a dated record of what you claimed to be doing.

I have read a great many of these. The common failure has never been an absent document. It is a document that does not describe the business: bought as a template and renamed, written for a different sector, or written in 2023 for a business that has since opened three branches and started taking card payments. None of that shows on a shared drive.

What an inspection is made of

An inspector is not reading your policy for pleasure. They are testing whether it happened.

Expect them to take your most recent onboardings and test each one against your own programme, not against the Act. Expect them to reconcile your cash threshold report register against your sales ledger, looking for the transaction that should have been reported and was not. Expect them to ask your receptionist and your sales floor rather than your compliance officer, because the compliance officer knows the right answer and the question is whether anyone else does. Expect them to ask for your screening hit disposition log, and then to pick a hit that was cleared and ask why.

If any of those four make you uncomfortable, that is your finding, and you have found it before they did.

Five things I would check before you file

If you are submitting for the first time, I would not rewrite everything. I would check five things.

1. Does the programme describe the business you run today, including branches, products or payment methods added since it was written?
2. Does a business risk assessment exist, and does it come before the controls rather than after?
3. Has it been approved at the level section 42(2B) requires, and is that approval recorded?
4. Does it deal with proliferation financing, or only money laundering and terrorist financing?
5. Could the person on your counter explain what they do when a customer pays R120,000 in cash, without reading the policy?

The last one takes the least time to test. Ask them. If the answer is hesitant, the document is not your problem.

What this is not

Nothing here is legal advice, and the dates above should be checked against the Centre’s own notices before you rely on them. I have set out where each comes from so you can do that.