The Next Greylist Exam your Business Will Have to Pass
Imagine this request arriving at your office tomorrow morning.
A regulator asks for the file on a customer your company has dealt with for four years. You must show how you identified the people who ultimately own or control the customer, who approved the relationship, when it was approved, and what you did when the ownership structure changed.
If your team can produce a complete, current file quickly, that is a good sign. If it cannot, the problem may be more than an administrative delay. It may reveal a weakness in how your business understands and manages risk.
South Africa was removed from the Financial Action Task Force (FATF) greylist on 24 October 2025, after completing all 22 items on its action plan. National Treasury said those actions would help form the basis of the country’s next mutual evaluation. It also said the country needed to sustain its progress and demonstrate that its systems were working effectively. [1]
The next evaluation is under way. The Financial Intelligence Centre (FIC) states in its 2025/26 annual report that the joint FATF and Eastern and Southern Africa Anti-Money Laundering Group evaluation commenced in June 2026 and is expected to continue until October 2027. [2]
What delisting settled
Delisting answered a specific question: had South Africa addressed the deficiencies identified when FATF placed the country under increased monitoring in February 2023? Treasury said the process took 32 months and included an on-site assessment at the end of July 2025. [1]
It did not establish that every part of the country’s anti-money-laundering and counter-terrorist-financing system now works as intended. The previous mutual evaluation followed an on-site visit in November 2019 and was published in October 2021. Treasury said the assessment identified weaknesses across all 11 effectiveness outcomes. [3]
The legal framework has since changed. At a briefing to Parliament’s Standing Committee on Finance on 10 June 2026, Treasury officials reportedly said South Africa was largely compliant with 38 of FATF’s 40 Recommendations. That is an important measure of technical compliance, but it is not the same as proving that controls work in practice. [4]
The test has changed
According to reporting on the June parliamentary briefing, Treasury Deputy Director-General Chris Axelson described the new evaluation as different in emphasis. The central question is whether the rules are being implemented and whether they produce results. He linked Immediate Outcome 5, which concerns legal persons and arrangements, to the accuracy of beneficial ownership information. He also said investigations, prosecutions and confiscations would be assessed through statistics, trends and case studies over several years. [4]
Ismail Momoniat, who leads South Africa’s FATF delegation, reportedly identified law enforcement as a major challenge in avoiding another greylisting. The evaluation will examine how many cases have been investigated, prosecuted and concluded with convictions. [5]
As at 12 October 2026, I could not verify the date of the next on-site visit in a primary source. Secondary reports have referred to March and April 2027. Neither date should be treated as confirmed unless Treasury, FATF or ESAAMLG publishes confirmation.
What a regulator may ask your business to show
The country is being assessed, but much of the evidence needed to judge the system sits inside individual institutions. The FIC’s 2025/26 annual report identifies recurring inspection findings, including inadequate or missing Risk Management and Compliance Programmes, customer due diligence failures involving legal entities and politically exposed persons, late registration, and missing evidence of screening against targeted financial sanctions lists. The FIC cautions that its inspections focused mainly on higher-risk institutions, so these findings should not be treated as representative of every institution. [2]
The following areas are a practical starting point for executives. The legal duties described below apply according to the relevant legislation and the type of organisation. Where a step is presented as a control to test, rather than an express statutory requirement, treat it as a governance recommendation and confirm the details with your legal or compliance adviser.
Customer due diligence
Accountable institutions must identify and verify customers and monitor business relationships in line with the Financial Intelligence Centre Act (FICA) and their risk-based controls. A reviewer may ask for the customer file, the risk assessment and reasons for the rating, the date of the last review, and evidence that any required approvals took place. For higher-risk relationships, executives should be able to explain who approved the relationship, what risks were identified, and how those risks are being managed.
Beneficial ownership
Section 21B of FICA requires accountable institutions to establish the ownership and control structure of relevant legal persons, partnerships and trusts, and to identify the natural persons who ultimately own or control them. The FIC’s Public Compliance Communication 59 says an ownership interest of five percent or more will usually indicate a controlling ownership interest. This is guidance, not a blanket rule that replaces an assessment of actual control. [6]
A file that stops at an intermediary company may not answer the question. Keep the records used to establish ownership and control, document reasonable verification steps, and record how uncertainty or changes in the structure were addressed.
Suspicious transaction reporting
Section 29 of FICA creates reporting duties for people who carry on, manage or are employed by a business. The FIC’s Guidance Note 4 interprets “business” in this context as a commercial undertaking, rather than a charity or public-sector institution. The scope of the duty is therefore broader than the list of accountable institutions, but the guidance should not be read as extending section 29 to every public entity. [7]
Separately, section 34 of the Prevention and Combating of Corrupt Activities Act requires people in positions of authority to report specified corruption offences and certain offences involving theft, fraud, extortion, forgery or uttering where the value reaches R100,000 or more. Reports must be made to the police. The exact application should be confirmed against the Act and the facts of the matter. [8]
Your business should have a clear route for raising concerns, deciding whether a report is required, meeting the applicable deadline, and retaining a record of the decision. The process should make it possible for employees to raise concerns without first having to decide the legal classification themselves.
Programme and governance
Accountable institutions must maintain a written Risk Management and Compliance Programme (RMCP). FICA places responsibility for implementing the programme on the highest authority in the business. Executives should know who owns the programme, when it was last reviewed, what training has been completed, how the controls are tested, and what happens when a control fails.
FICA provides for administrative sanctions of up to R10 million for a natural person and R50 million for a legal person in relevant cases. These are maximum amounts, not automatic penalties for every breach. [9]
“We are not an accountable institution”
For some businesses, that statement is correct. It does not mean there is nothing to do. Banks, law firms, estate agents and other accountable institutions must understand their customers and manage risk. They may ask your company for ownership information, details of the people who control it, and supporting documents before accepting or continuing a relationship.
Section 29 reporting duties may also apply to people working in commercial businesses that are not accountable institutions. The FIC’s 2025/26 annual report records 1,553 such entities registered with the Centre as at 31 March 2026. [2]
The General Laws (Anti-Money Laundering and Combating Terrorism Financing) Amendment Bill, B15–2026, proposes changes affecting beneficial ownership information and administrative penalties. As at 12 October 2026, Parliament’s bill page records the Bill as having been sent for assent. I could not verify from an official publication that it had been assented to and commenced. Any proposed increase in penalties should therefore not be described as current law until the final Act and commencement provisions have been checked. [10]
Which obligations apply to your organisation depends on its activities, legal form and the legislation governing it. Ask your legal adviser to confirm the position rather than relying on the phrase “we are not an accountable institution”.
What the enforcement figures show
The FIC’s 2025/26 annual report, released on 30 September 2026, records 549 inspection reports against a target of 550. It also records 361 admission-of-non-compliance notices: 209 relating to failure to submit risk and compliance returns and 152 relating to failure to register. Of those notices, 149 were finalised with penalties totalling R1.49 million, while 212 were referred to the FIC’s Adjudication Panel. Separately, the FIC imposed 28 sanctions on non-financial institutions. Nineteen were finalised, totalling R635,000, and nine were appealed. [2]
Financial-sector supervisors reported separate sanctions. According to secondary reporting on the FIC annual report, the Prudential Authority imposed sanctions totalling R37 million against three institutions, of which R28 million was payable after conditionally suspended portions were excluded. This figure should be checked against the Prudential Authority’s own reporting before publication. [11]
The figures for funds blocked and recovered fell in 2025/26. The FIC reported that it blocked R34.2 million as suspected proceeds of crime and that its intelligence contributed to the recovery of about R37.5 million. The corresponding figures reported for 2024/25 were R157.5 million blocked and about R144 million recovered. These figures should be read in context. The FIC does not control the outcome of every criminal matter, and recovery depends on the circumstances of each case. [2, 12]
Filing figures published in July also indicated a supervisory challenge. The FIC reported that 2,038 of the 5,636 institutions in the first filing group had submitted their 2026 returns by the 30 June deadline, a rate of 36.1 percent. The rate had reached 48.1 percent by 15 July. The group included trust and company service providers, crypto asset service providers, non-bank credit providers and casinos. The latest figures available to the author at the time of review did not establish the final position after the 31 July deadline. [13]
What the public record does not show
In the public material checked for this article, I did not locate a complete published series linking suspicious transaction reports from businesses to investigations, prosecutions and convictions. Treasury has said that FATF will examine outcomes through statistics, trends and case studies. This is a limited finding from the material reviewed, not proof that no such data exists. The FIC and the National Prosecuting Authority would need to confirm whether a suitable linked series is available.
A test you can run before the evaluators do
Choose five corporate customers, including at least one your business rates as high risk. Ask your finance or compliance team to produce, for each customer, the ownership chain traced to the relevant natural persons, the evidence used to verify it, the record of approval, the risk rating and the date of the latest review. Time the exercise and record anything that cannot be found.
Next, ask for the concerns raised internally about potentially suspicious transactions during the past 12 months. For each concern, establish who received it, what decision was made, the reasons for that decision, and whether a report was filed where required. If the list is empty, do not assume that this proves the controls are working. Ask how employees recognise a concern and where they are expected to raise it.
Finally, check the date of your RMCP, the most recent approval or review, the training records, the results of control testing, and the board or committee minutes showing how significant weaknesses were addressed. A policy document alone does not demonstrate that the programme works.
South Africa’s return to the grey list remains a risk
National Treasury has explicitly warned that avoiding renewed greylisting depends on demonstrating sustained, measurable results during the next evaluation. The principal concerns are whether law enforcement agencies can turn financial intelligence into successful investigations, prosecutions and convictions; whether criminal proceeds are consistently identified, seized and recovered; whether authorities have timely access to accurate beneficial ownership information; and whether supervisors enforce compliance effectively. These are tests of implementation, not simply legislation or policies on paper. If the evaluation finds that South Africa’s controls are not producing sufficient results against money laundering and terrorist financing, the country could face renewed increased monitoring. The outcome will depend on the evidence presented to FATF and the effectiveness of the system as a whole.
The question to ask this week
South Africa’s next FATF evaluation will examine whether controls work in practice. Your business may face similar questions from a bank, auditor, regulator or business partner before the evaluators arrive.
If the request in the opening paragraph reached your office tomorrow, who would be responsible for producing the file, how long would it take, and what would the file prove?
Sources and verification notes
Source list for the numbered references in the article. Checked on 12 October 2026. Secondary reporting is identified where primary records were not located. Recheck the live legal status and any later releases immediately before publication.
[1] National Treasury, “South Africa exits the FATF greylist”, 24 October 2025; FATF, “Jurisdictions under Increased Monitoring”, 24 October 2025. National Treasury | FATF statements
[2] Financial Intelligence Centre, Annual Report 2025/26, tabled in Parliament on 25 September 2026; media release dated 30 September 2026. Annual report PDF | FIC media release
[3] National Treasury and Parliamentary Monitoring Group records relating to South Africa’s 2021 FATF mutual evaluation, including the November 2019 on-site visit and October 2021 report. Parliamentary Monitoring Group
[4] Moonstone reporting, 11 June 2026, on the Standing Committee on Finance briefing of 10 June 2026. Secondary source. Confirm statements and figures against committee minutes or a recording. Moonstone
[5] Business Day reporting on Ismail Momoniat’s comments at the June 2026 parliamentary briefing. Secondary source. Confirm attribution and title against the committee record. Business Day
[6] Financial Intelligence Centre, Public Compliance Communication 59, guidance on beneficial ownership under section 21B of FICA, 8 August 2024. FIC notice
[7] Financial Intelligence Centre, Guidance Note 4 on suspicious transaction reporting. Check that this guidance remains current at publication. FIC website
[8] Prevention and Combating of Corrupt Activities Act 12 of 2004, section 34, current wording to be checked before publication. Act PDF
[9] Financial Intelligence Centre Act 38 of 2001, section 45C, read with applicable amendments. FICA Act PDF
[10] Parliament of South Africa, General Laws (Anti-Money Laundering and Combating Terrorism Financing) Amendment Bill, B15–2026. Parliament’s page shows “Sent for Assent”. Check the Presidency and Government Gazette for assent and commencement. Parliament bill page
[11] Prudential Authority sanctions figure reported secondarily in coverage of the FIC annual report. The article itself flags the R37 million total and R28 million payable figure for confirmation against the PA’s primary records. PA 2025/26 annual report
[12] FIC Annual Report 2024/25 and Annual Report 2025/26. Verify comparative blocked-funds and recovery figures against both original reports. FIC 2024/25 report | FIC 2025/26 report
[13] FIC public reporting on 2026 risk and compliance returns, as reported in July 2026. The 36.1% and 48.1% figures are secondary-reported and should be checked for later updates before publication. FIC website