What a template RMCP cannot do for you

There is a market in risk management and compliance programmes. You can buy one for a few thousand rand, or download the framework the Financial Intelligence Centre itself published in 2022 and put your letterhead on it. I understand why people do. The document is long, the Act is unfriendly, and there is a real deadline attached.

From this year the deadline is also annual. Directive 12, gazetted on 4 September 2026, requires accountable institutions in the listed categories to file a copy of their programme with the Centre through goAML. For estate agents, and for dealers in high-value goods under Schedule 1 item 20, the date is 31 October, every year. That changes the economics of a template, because a document you file is a document somebody reads.

The Act asks for four things and a template gives one

Section 42(1) requires an accountable institution to develop, document, maintain and implement the programme. Four verbs. A purchased document satisfies the second one. Whether it satisfies the other three depends on what you do next, and the document cannot help you there.

Then there is section 42(2A). It requires the institution to state, in the programme, which paragraphs of section 42(2) do not apply to it, and the reason why. Section 42(2) runs from (a) to (s) with an inserted (qA), and several of those paragraphs deal with foreign branches and group structures. A single-branch dealership in Somerset West has no foreign subsidiary. It still has to say so, in the document, with reasons. A template either carries those paragraphs as though they applied to you, or drops them silently. Neither complies. Section 61(a) names that failure by cross-reference and makes it non-compliance subject to an administrative sanction.

Your programme is the standard your files are measured against

This is the part that does the damage, and it sits in one clause of section 21(1). Identifying and verifying a client must be done in the course of the transaction “and in accordance with its Risk Management and Compliance Programme”.

Read that again. The Act does not tell you how to verify a client. It tells you to do it the way your own programme says. So a programme written for a different business does not merely fail to describe you. It sets a standard your business was never built to meet, and every file you open is then measured against it and found short. You have not bought protection. You have written the charge sheet.

Inspection feedback from the Financial Sector Conduct Authority, reported in March 2026, records exactly this: the programme prescribes specific steps, but the client files and the interviews with staff do not demonstrate that those steps were taken. The same feedback notes that the file sample is typically fifty, and that performing the work after an inspection does not cure the original failure.

What the Centre finds most often is the thing underneath the document

The Centre’s 2024/25 annual report lists its most common inspection findings. First on the list is undertaking and conducting a business risk assessment. Second is developing or implementing a programme. That order is the point. The most common failure is not an absent document but an absent assessment of the business the document is meant to describe.

In May 2025 the Centre said this directly, describing widespread failure to develop or implement programmes, compounded by the absence of a prior completed and documented business risk assessment. It also said the quieter thing: submitting a programme is not evidence that it complies, and it will be tested against the legislative requirements through inspection.

The Centre has been candid about templates too, although not where people look for it. Public Compliance Communication 53, of August 2022, sets out a programme framework in an annexure, and alongside it the sentence: “The Centre strongly cautions against accountable institutions copying this document as is without changes.” The regulator published a template and told you not to use it as one.

When a short programme is the right answer

Here is the part I would want to read if I were paying for this advice.

A small business may legitimately run a short programme. Guidance Note 7B, in force since 3 August 2026, requires the risk assessment process to be proportionate to the size and complexity of the institution, and says it might be quite simple or very sophisticated depending on that. The Financial Action Task Force works the same way in its interpretive note to Recommendation 1, and its explanatory material on group programmes says expressly that the clarifications are not intended to affect sole traders or other independently operating businesses. The Act itself exempts a sole practitioner from the duty to appoint someone to assist the compliance function, in section 42A(4).

So the honest position is this. Length is governed by proportionality. Specificity is governed by nothing. If you sell one category of item, take payment two ways, work from one address, have no politically exposed clients and no group above you, your programme can be short, and a decent framework plus a serious fortnight of your own attention may get you there. Some of the businesses reading this do not need a consultant. They need somebody to tell them which paragraphs to think about.

What none of them can file is a document about somebody else.

What it costs when it goes wrong

I would rather be accurate than alarming, so two things.

Most published sanctions against small institutions are procedural and cheap. The Centre’s own notices show R25,000, reduced to R10,000 on early compliance, for failing to register or failing to file the risk and compliance return. That is the common case and it is worth saying so, because the sector is sold a great deal of fear.

The expensive cases are about a programme that turned out to be hollow. In November 2024 the Centre imposed a penalty of R7.77 million on an attorney firm, and the two lead findings were failure to document, maintain and implement the programme, and failure to screen clients against the targeted financial sanctions list. The firm appealed, and the appeal board, upholding the penalty, found that it knew its obligations and had acted with gross negligence.

Note also who is exposed. Section 42A(1) puts the duty to ensure compliance with the Act and with the programme on the board, or on senior management where there is no board. Section 61B(1) then makes the board or senior management, or both, non-compliant and subject to an administrative sanction if they fail in it. Under section 45C the ceiling for a natural person is R10 million. Approving a document you have never tested is not a defence, because ensuring it is followed is the duty itself.

What this is not

Nothing here is legal advice, and the section numbers and dates above should be checked against the Act and the Centre’s own notices before you rely on them.