Directive 12 of the FIC Act What Directive 12 requires, when to submit, and the common RMCP mistakes. Plus a first look at something new from eFICA built to take the heavy lifting out of building your RMCP. Submission Deadlines by Accountable Institution
Is Your
RMCP Ready?
Somewhere out there is an RMCP sitting quietly on a shared drive, untouched since the day it got signed off. Well, its retirement has just been cancelled.
On 4 September 2026 the FIC published Directive 12, and it comes with an instruction accountable institutions can’t file-and-forget: your RMCP now has a standing annual date with the FIC. Not a once-off submission. Annual. As in, forever, until further notice.
What Directive 12 actually requires
In plain terms, this covers legal practitioners, trust and company service providers, estate agents, licensed gambling operators, credit providers under the National Credit Act, the South African Postbank, high-value goods dealers, the South African Mint, and crypto asset service providers — all of whom must submit a copy of their RMCP documentation to the FIC every year. The FIC has even given us a calendar to work off:
| Submit by | Who |
|---|---|
| 9 October annually | Legal practitioners; trust and company service providers; licensed gambling operators; credit providers under the National Credit Act (excluding banks, mutual banks and co-operative bank credit providers) |
| 31 October annually | Estate agents; the South African Postbank; high-value goods dealers; the South African Mint; crypto asset service providers |
Translation: your RMCP isn’t a “set it and forget it” document anymore. It’s an annual performance, and the FIC has front-row seats.
Why this is bigger than a date on a calendar
Here’s where people go wrong. Getting a document to the FIC by the deadline isn’t the win condition — getting the right document there is. An RMCP that hasn’t kept pace with the FIC’s latest instruments isn’t a compliance programme anymore.
And a quick correction, because it comes up a lot: Directives, Guidance Notes and Public Compliance Communications (PCCs) aren’t optional reading. The FIC confirmed that this guidance is authoritative in nature. Institutions are expected to take it into account, and if you decide to go a different route, you’d better be able to show that you’re achieving an equivalent level of compliance. “We thought it was just guidance” doesn’t hold up well in front of an inspector.
Which is really the point here. Keeping your RMCP current can’t be a project you did back in 2023 and never revisited. It has to be a live workstream. Every new Directive, Guidance Note or PCC the FIC issues effectively rewrites a line in the script your RMCP is supposed to be performing.
What actually changed in Guidance Note 7B
The FIC issued Guidance Note 7B on 3 August 2026, and it retires Guidance Note 7, Guidance Note 7A, and the Revised Guidance Note 7A in one go. One authoritative note to rule them all, at least until the next one lands.
A few of the changes we think you actually need to know about:
- PF risk stops being the quiet third wheel. Every risk indicator category in GN 7B — products and services, delivery channels, geographic locations, clients — now consistently reads “ML, TF and PF” risk. Not ML and TF with PF added as an afterthought in a footnote. If your risk matrices and BRAs are still only formally scoring ML and TF, you’re a step behind where the FIC now expects you to be.
- New products and services trigger a mandatory pre-launch risk assessment. This is new paragraph 37A, and it’s specific: institutions must identify and assess the ML, TF and PF risk of new products, new services, new business practices, new delivery channels, and new or developing technologies, before the thing launches, and again whenever material changes happen down the line. It has to show up in your risk assessment process and in your RMCP.
- Board approval accountability can’t be delegated, full stop. The board, senior management, or whoever holds the highest authority in the institution must personally approve the RMCP, and must be able to show they actually understood it. A subcommittee can advise all day. It cannot sign on the board’s behalf.
- “It’s referenced somewhere else” no longer counts. GN 7B is pretty blunt about this one — documentation that isn’t substantively included, or at least properly referenced, in the RMCP is not considered part of the RMCP. Even if it technically exists in your policy library somewhere.
- Escalation triggers now need to be visible in the document itself. New products, new client onboarding, ongoing monitoring, changes to your entity-wide risk profile — each one needs a documented path up to the right level of seniority.
- Structure matters more than it used to. The FIC recommends building RMCP documentation around three clear parts: identifying the risk, mitigating it through controls, and monitoring whether those controls are actually working. And the entity-wide AML/CFT/CFP risk assessment has to come first, before you start bolting on controls.
Beneficial ownership guidance still points to PCC 59, and DNFBPs are directed to PCC 53 for RMCP documentation guidance and templates. Worth remembering that PCCs sit alongside Guidance Notes as authoritative reference points, not as footnotes you can skip.
If your RMCP still cites GN 7A anywhere, it’s quoting a document that technically no longer exists.
The upshot
Directive 12 and GN 7B are two sides of the same coin. One tells the FIC when they’ll be checking your homework. The other tells you what the homework is actually supposed to look like, and increasingly, how closely your day-to-day practice needs to match what’s written down.
That last bit is worth sitting with for a second. One of the most common red flags in an FIC inspection isn’t a missing policy. It’s a mismatch — the RMCP says one thing, and the institution, in practice, does another. Beautifully worded risk-based approach on paper, a process nobody actually follows in reality. GN 7B leans right into this: the board has to demonstrate it genuinely applied its mind to the RMCP, and documentation that doesn’t reflect what’s actually happening on the ground can be found inadequate, with administrative fines to follow.
Institutions that treat the RMCP as a living document — reviewed and updated every time the FIC changes its guidance, and regularly checked against what’s actually happening day-to-day — will get through submission season without drama. Institutions that don’t will be doing a very stressful rewrite in early October, hoping nobody asks too many follow-up questions.
We’d like to unpack all of this properly: the submission mechanics, what GN 7B changes in practice, and what “keeping your RMCP current” should look like operationally rather than just on paper. We’ll also be showing off some new functionality that takes a lot of this heavy lifting off your plate, built to keep your documented RMCP and your real-world process locked in at 100%, so there’s no gap left for an inspection to find.
