FICA for Small Business: When You're an "Accountable Institution", and What That Actually Requires

FICA — the Financial Intelligence Centre Act — is one of those compliance words small business owners hear often and understand precisely rarely. Most businesses are never touched by it directly. But a defined, specific list of business types are, and one category in particular has quietly pulled in businesses that never expected to be caught by anti-money-laundering law at all: anyone selling something expensive enough.

Who is actually an "accountable institution"

Schedule 1 of the FIC Act lists the specific categories of business caught by FICA's obligations. It is not every business — it is a defined list, including (among others):

• Banks, insurers, and other traditional financial services providers
• Estate agents
• Legal practitioners (attorneys)
• Trust and company service providers
• Casinos and crypto asset service providers
• High-value goods dealers — added to Schedule 1 with effect from December 2022, and the category that catches the widest range of small businesses nobody expects to be affected

If your business isn't on this list in some form, FICA's accountable-institution obligations simply don't apply to you — this is not a "better safe than sorry, register anyway" situation.

The category that surprises people: high-value goods dealers

Since December 2022, any business that sells a single physical item priced at R100,000 or more is a high-value goods dealer, and therefore an accountable institution — regardless of what the business actually is. This catches motor vehicle dealers, jewellers and dealers in precious metals or stones (including Kruger Rand dealers), and genuinely any retailer or wholesaler where a single item crosses that R100,000 line — furniture, equipment, art, whatever the business happens to sell. The threshold applies per item, and the FIC has specifically flagged that deliberately splitting a single high-value sale into smaller payments to duck under R100,000 is exactly the kind of structuring the rule is designed to catch, not a legitimate workaround.

This means a business that has never thought of itself as being anywhere near financial services — a boat dealer, a fine jewellery store, an art gallery — can find itself with genuine FICA obligations purely because of what it sells and at what price, not because of anything resembling a bank.

What an accountable institution actually has to do

Once a business falls under Schedule 1, several concrete obligations apply:

• Register with the Financial Intelligence Centre — free, done through the FIC's goAML system, within 90 days of starting the activity that makes the business an accountable institution.
• Develop a Risk Management and Compliance Programme (RMCP) — a documented programme identifying the business's money-laundering and terrorist-financing risks and setting out how it addresses them, covering customer due diligence, record-keeping and reporting.
• Verify customer identities — proper customer due diligence, including establishing beneficial ownership where a customer is itself a company or trust rather than an individual, scaled to the risk the transaction presents.
• Monitor transactions on an ongoing basis for consistency with what's known about the customer, not only at the point of the initial sale.
• Keep records for five years from the end of the client relationship or the transaction, whichever is relevant.
• Report to the FIC — Cash Threshold Reports for large cash transactions, and Suspicious Transaction Reports where something about a transaction genuinely doesn't add up, regardless of its size.

For a small, genuinely low-risk business (a single vehicle dealership selling to ordinary retail customers, for instance), this is a real but manageable compliance programme — not the scale of infrastructure a bank runs, but a genuine documented process, not an informal one.

What happens if you're an accountable institution and don't comply

Failing to register, or failing to keep registration details up to date, can carry a fine of up to R10 million — a genuinely serious number for a small business, and a clear signal that this isn't a low-stakes formality to postpone indefinitely once it applies to you. Beyond the registration fine, failures in the underlying compliance programme (inadequate customer due diligence, failing to report a genuinely suspicious transaction) carry their own separate consequences under the Act.

Getting this right without over-building it

• Work out honestly whether you're actually caught — most small businesses aren't, and assuming you need a full compliance programme when Schedule 1 genuinely doesn't apply to you is wasted effort. If in doubt because you occasionally sell above R100,000, get this confirmed properly rather than guessing.
• Register within the 90-day window once the obligation genuinely applies — this is free and shouldn't be delayed once you know you're caught.
• Build the RMCP to match your actual risk — a single small dealership's compliance programme looks very different from a bank's, and should, provided it genuinely covers the required elements.
• Appoint someone responsible — a compliance officer, which for a small business is often the owner themselves, formally designated as the person responsible for FICA compliance.

How this connects to the rest of your compliance obligations

If your business is an accountable institution, the customer due diligence and beneficial-ownership verification FICA requires overlaps meaningfully with the beneficial-ownership filing your own company already has to make to CIPC, and with the general POPIA obligations around how personal information is handled — three separate legal requirements that, done properly, reinforce rather than duplicate each other, since all three ultimately depend on knowing who you're actually dealing with and handling that information responsibly.

Sources: the Financial Intelligence Centre's published compliance guidance (accountable institution registration via goAML, free, within 90 days of commencing the relevant activity; the RMCP, customer due diligence, five-year record-keeping and reporting obligations; the R10 million fine for registration failures) and the FIC's Public Compliance Communication on high-value goods dealers (R100,000 per-item threshold, effective December 2022, and the anti-structuring guidance on split transactions). This is general information, not legal advice — a business unsure whether it qualifies as an accountable institution, or building its first RMCP, should get advice from a FICA compliance specialist or attorney.

A worked example

A small independent jeweller has, for years, occasionally sold engagement rings priced above R100,000 without ever considering FICA relevant to their business — they think of themselves as a retailer, not a financial institution. Once they cross that threshold on even one sale, they are a high-value goods dealer and an accountable institution from that point, with the 90-day registration clock running from when the qualifying activity began. A customer later structures a R150,000 purchase as three separate R50,000 payments over consecutive days specifically to avoid the paperwork — exactly the structuring pattern the FIC has publicly flagged, and precisely the kind of transaction a properly built RMCP and attentive staff should catch and report rather than simply process as three ordinary sales.

Frequently asked

Does the R100,000 threshold apply to the total value of everything a customer buys, or per item? Per item — a single physical item priced at R100,000 or more triggers the obligation, not a customer's cumulative spend across multiple separate, genuinely unrelated purchases.

Do I need to register if I've only sold one item above R100,000 once? The obligation is triggered by engaging in the qualifying activity, not by a minimum number of transactions — a single qualifying sale is generally enough to bring a business within Schedule 1, which is exactly why businesses that occasionally sell high-value items should check their position rather than assume infrequency exempts them.

Is there a FICA compliance officer requirement for a one-person business? Yes — even a sole proprietor accountable institution needs someone formally responsible for compliance, which for a one-person business is simply the owner formally taking on that designated role rather than leaving it undefined.

Do cash and EFT payments get treated differently under FICA? Cash transactions above a specified threshold trigger Cash Threshold Reporting specifically, while suspicious-transaction reporting applies regardless of payment method — a suspicious EFT payment is just as reportable as a suspicious cash one if something about it doesn't add up.

If my business is an accountable institution, do all my customers need to provide FICA documents even for small purchases? Customer due diligence should be risk-based and proportionate — a small, low-risk transaction generally doesn't require the same depth of verification as a large or higher-risk one, which is exactly what a properly built RMCP is meant to define for your specific business rather than applying maximum scrutiny to every transaction regardless of size.