Why law firms are the most-scrutinised accountable institution and what FICA compliant practice actually requires
Published on FICACompliant.co.za | FICA compliance | Law Firms | AML | Accountable Institutions | South Africa
Being FICA compliant is not optional for South African law firms and the Financial Intelligence Centre is no longer waiting for firms to self-correct. Under the FIC Act, legal practitioners are Schedule 1 accountable institutions carrying the same obligations as banks and financial services providers: FICA registration, an operational risk management and compliance programme (RMCP), mandatory staff training, customer due diligence, and suspicious transaction reporting through goAML. The difference is that most law firms are still managing these requirements manually and that gap is exactly where the FIC is finding its most significant non-compliance findings.
What a R7.7 million fine reveals about the sector
The penalty levied against Kunene Ramapala Inc. is the clearest illustration of how seriously regulators are treating legal sector failures. The Johannesburg-based firm was fined R7.7 million after investigators found it had failed to screen clients against the Targeted Financial Sanctions list and had not developed a functioning RMCP. The firm appealed. It lost. The reputational and financial consequences were compounded by the delay.
What makes this case particularly instructive is that neither failure requires exotic compliance infrastructure to prevent. Screening against sanctions lists is a basic customer due diligence requirement. An RMCP is the foundational document any accountable institution must maintain under the FIC Act. These are not advanced compliance functions they are bare minimum. The firm's exposure was not the result of sophisticated criminal infiltration; it was the result of a compliance programme that simply did not exist in a working form.
South Africa lost an estimated R3.3 billion to financial crime in 2023, and legal practitioners remain among money launderers' preferred channels. Trust accounts, complex entity structures, and high-value property transactions provide convenient cover. The FIC's targeting of the sector reflects that reality and it is not easing off. With South Africa's removal from the FATF greylist achieved and domestic enforcement now the primary mechanism, FICA inspections of law firms will continue at pace.
Five red flags every law firm must be able to detect
Vague or evasive funding: clients who cannot clearly explain the origin of funds or whose payments arrive from unrelated third parties with no documented explanation.
Cash-only transactions: insistence on cash payments, or patterns of depositing and quickly withdrawing large amounts from the firm's trust account.
Complex entity structures: requests to establish intricate legal entities — companies, trusts, foundations — where the stated commercial purpose does not justify the structural complexity.
Suspicious documentation: presentation of documents that appear altered, inconsistent, or difficult to authenticate through standard verification channels.
Economically illogical asset transactions: involvement in the purchase or sale of high-value assets — property, vehicles, luxury goods — where the transaction logic is unclear, or where beneficial ownership is being obscured through third-party titling.
Three compliance failures that keep appearing in FICA inspections of law firms
An RMCP that exists on paper but not in practice. Many firms have a compliance document, usually a generic template downloaded at the point of FICA registration and not revisited since. An RMCP must reflect the firm's actual risk profile: the types of matters it handles, the client categories it serves, and the specific money laundering risks those categories present. A conveyancing firm serving foreign buyers carries a different risk profile from a commercial litigation practice. The FIC looks for evidence that the RMCP has been applied, reviewed, and updated... not just filed.
Training that is documented as completed but cannot be verified. The FIC Act requires that all staff with compliance responsibilities receive adequate training. In inspections, investigators ask for records, dates, attendees, content covered. Firms that run informal briefings without documentation are exposed in the same way as firms that run no training at all. Senior partners and principals are not exempt; the Kunene Ramapala findings and similar cases make clear that management-level accountability is a central part of the FIC's assessment framework.
goAML submissions that are late, incomplete, or missing entirely. Suspicious transaction reports must be submitted within prescribed timeframes. Delays, even where the underlying suspicion is genuine and documented constitute non-compliance. Firms relying on manual processes to identify, assess, and submit reports are disproportionately exposed to this failure mode. A client risk profile that changes post-onboarding will not trigger a review unless the monitoring process is designed to catch it.
Practical actions to take now
Pull your current RMCP and check when it was last reviewed. If it predates your current practice areas or client base, it is not fit for purpose.
Audit your FICA documents for every active client matter involving trust account funds, high-value assets, or complex entity structures. Are source-of-funds records complete and current?
Check your goAML submission history. Are there matters where a suspicious transaction report should have been filed but was not? Voluntary disclosure is always preferable to a finding during inspection.
Verify that your firm has an appointed compliance officer with documented responsibilities and that the appointment is reflected in your RMCP.
Review your client onboarding process against the five red flags above. Is there a documented decision trail for each flag that was assessed and cleared?
Conclusion
The FIC's focus on legal practitioners is not a temporary enforcement blitz, it reflects a structural assessment that the sector carries elevated money laundering risk and has historically under-invested in compliance infrastructure. Being FICA compliant as a law firm means more than holding a registration number. It means a live, documented, staff-trained, regularly reviewed compliance programme that you can open in front of an inspector and defend line by line.
If your firm does not have that today, visit FICACompliant.co.za to get your free tailored RMCP and use it as the foundation for a compliance programme that will hold up under scrutiny.
