An overseas bank pauses a supplier payment and asks who owns the exporter and why three invoices were sent in one week. The goods are real and the supplier is known, but the finance lead still needs to assemble evidence before the payment can proceed. That pause shows how anti money laundering rules can affect ordinary trade: checks and records help prevent criminal proceeds from moving through the financial system disguised as legitimate payments.
South Africa's main anti-money-laundering law is the Financial Intelligence Centre Act 38 of 2001, which established the Financial Intelligence Centre. The Prevention of Organised Crime Act makes money laundering a crime. These laws form part of the rules businesses must understand when handling payments and keeping financial records.
The sections ahead explain business duties, grey-list progress, how KYB and KYC differ, why some export payments may look unusual, and how to prepare a compliance file. For exporters, the practical test is whether the payment purpose, invoices and supporting trade documents tell a consistent story. A clear, documented explanation is more useful than raising alerts to increase reporting volumes.
What Anti Money Laundering Asks of a Business
A South African exporter receives a payment from overseas. The amount matches the invoice, but the buyer's ownership is unclear and the payment reference says little about its purpose. The finance team needs a clear account of who is involved and how the money relates to the trade.
That is the practical aim of anti money laundering (AML): make business payments traceable to real parties and legitimate activity. It applies across a company's work with customers, suppliers and financial providers, not only inside banks.
For SMEs, good controls are proportionate. Keep a documented reason for a payment and evidence that supports it; sending more alerts or reports does not, on its own, improve detection. Firms trading internationally may also need to address GDPR, HIPAA, CCPA and SOX requirements when overseas partners ask about privacy and financial reporting.
Duties Under the Financial Intelligence Centre Act
| Duty | Legal home | What the business does | When it bites |
|---|---|---|---|
| Customer due diligence | FICA | Identify the customer and the natural persons who own or control it | Onboarding and when ownership, products or corridors change |
| Record keeping | FICA | Retain identity and transaction evidence | For the statutory period after the relationship or transaction |
| Registration | FICA | Register with the Financial Intelligence Centre | Before carrying on a listed activity |
| Cash threshold reporting | FICA | Report cash at or above the prescribed threshold | When the cash transaction reaches that threshold |
| Suspicious transaction reporting | FICA | Report suspicion and do not tip off the customer | As soon as suspicion is formed |
| Risk management and compliance programme | FICA | Document controls matched to customers, products and corridors | Before go-live and at each scheduled review |
Walk the rows in order
Customer due diligence means you identify the company and the natural persons who own or control it. You refresh that picture when a director changes, a product is added, or a new country enters the payment route. A file from last year's onboarding isn't enough if the share register has moved.
Record keeping means you hold identity and transaction evidence for the statutory period after the relationship or the transaction. When a bank writes six months later, you answer from the file, not from memory.
Registration means an accountable institution is on the Centre's database before it carries on a listed activity. You don't start the activity and register afterwards.
Reporting and the written method
Cash threshold reporting covers cash at or above the prescribed threshold, filed when the cash transaction reaches that line. Suspicious transaction reporting covers transactions that look unusual, plus terror-property matches. You file as soon as suspicion is formed, and you don't tell the customer that a suspicion report went in. Tipping off is its own problem.
The risk management and compliance programme is a short written method matched to your real customers and payment types, reviewed on a set calendar. It should say who checks ownership, who clears a payment, and who escalates.
Pin this up: If you can't show the row, you don't yet have the duty.
Not every company is an accountable institution. Any firm that banks or pays across borders will still be asked for the same evidence by a bank or platform that is. These duties are operational because the framework has already been examined from outside. The National Treasury statement on the mutual evaluation records assessments in 2003, 2009, and between April 2019 and May 2021. The 2021 assessment found deficiencies in 20 of the FATF's 40 recommendations, and on 24 February 2023 FATF placed South Africa under increased monitoring, commonly called the grey list. Customer checks, beneficial ownership, monitoring and suspicious reporting became part of keeping access to the international system.
Grey List Progress Is Not an All Clear
National clean-up doesn't retire the questions an overseas bank still asks a South African CFO. A timeline is the useful way to brief that bank, and the milestone panels below are the version you can put on one page.
The country has since moved through its action plan. That progress is real, and it is still not a private all-clear for any one firm.
What June 2025 changed, and what it didn't
By June 2025, South Africa had substantially completed all 22 FATF action-plan items, as the Financial Intelligence Centre's 2024/25 annual report frames the operational shift after that work. Supervisors didn't step back in the same year. During 2024/25, the Centre imposed R2.228 million in sanctions and recovered close to R144 million in criminal proceeds using its financial intelligence. That intelligence included 2,151 reports concerning money-laundering-related offences, including self-money laundering, third-party laundering, professional laundering networks, and individual professional launderers.
Improved country standing doesn't stop a foreign bank, a customer or a payment counterparty from asking for enhanced due diligence. Expect onboarding friction, requests for ownership and transaction evidence, and questions about a corridor you use every month.
Three public roles stay distinct. The Centre receives reports and supervises many accountable institutions. The FSCA authorises and oversees financial services providers. POCA is the criminal-law backbone that makes laundering an offence, not a paperwork slip.
De-listing, or progress toward it, isn't a compliance all-clear you can quote to a correspondent bank.
The short video below is a useful briefing clip when a board asks why the file still matters after the national headlines improved.
The business response is a portable file: current beneficial owners, a plain explanation of recurring payment patterns, named counterparties, and documents you can send without holding a legitimate shipment. National progress helps the country. Readiness is what moves your invoice.
How KYB and KYC Work in Practice
KYC is knowing the natural person in front of you. KYB is knowing the company. Say a small exporter has two directors and a silent shareholder who holds 30 percent. KYC covers the director who signs the form. KYB covers the registration, who may bind the company, and that silent owner behind the shares. If you only file the signatory, you've missed the person who can direct the funds.
Refresh the snapshot
Onboarding is a snapshot. The FATF and ESAAMLG executive summary identified weaknesses in risk-based approaches and in beneficial-ownership availability, so KYB has to be refreshed when directors, shareholding, products or countries change. Treat a stale owner register as an open control, not a finished task.
A single rand threshold is a poor net. That assessment classifies prevalent cash use as high risk for money laundering and terrorist financing, and it notes that detecting, recovering and confiscating illicit or undeclared currency at the border remains materially difficult. Most SME trade is electronic anyway, so a value line alone misses the pattern.
A combined model, not one line
A stronger model combines customer and beneficial-owner risk, expected activity, source of funds, destination-country risk, payment purpose, counterparty links, velocity, and breaks from history.
- Rapid pass-through: Funds arrive and leave before the trade they claim to fund could have happened.
- Near-threshold repeats: The same amount sits just under a reporting line, with no pricing reason.
- Unrelated payers: Someone with no recorded link to the buyer sends the money.
- Cash-intensive industries: The sector itself raises the risk, even when the invoice looks tidy.
- Document mismatch: The invoice, the goods or services, and the payment purpose don't tell the same story.
Enhanced due diligence is for higher risk, not for every foreign payment. A routine shipment to a known buyer, with owners already on file, doesn't need a fresh deep dive each week.
What the firm and the provider each keep
We are FIC registered and we meet FICA requirements for anti money laundering and know-your-customer compliance. Our services are available to businesses that pass KYB and compliance checks, and the user must be authorised to bind the organisation. We are an authorised financial services provider registered with the FSCA, FSP number 55133. A firm using that rail should still keep its own pack: owner records, authority to bind the company, source-of-funds notes, and the reason a payment was cleared or escalated.
Export Payments That Look Unusual
Three patterns show up constantly, and only one of them is automatically a problem.
A fruit exporter pays one packing supplier every month. Three similar amounts are normal when the invoices, the shipment dates and the contract line up. A BPO receives weekly dollar fees from one overseas client. The velocity looks high to a rules engine, and it is still routine if the service agreement and the timesheets match. A new buyer's parent company pays the invoice. That is legitimate only when the group-treasury or factoring link is already on file.
Where the ordinary explanation fails
| Pattern | Often legitimate when | Escalate when |
|---|---|---|
| Repeat payments to one supplier | Invoices match a schedule or milestones | Amounts do not match invoices or goods never arrive |
| Third-party payer | Group treasury or confirmed factoring is documented | The payer has no recorded link to the buyer |
| Amounts just under a reporting line | Pricing genuinely lands there | The same near-threshold amount repeats with no pricing reason |
| Fast in-and-out of funds | A contracted marketplace or agent pass-through | Funds leave within hours to unrelated parties |
| Higher-risk corridor | Known customer and a clear payment purpose | New counterparty, vague purpose, or a cash-intensive industry |
| Documents do not line up at first glance | An amended order has an email trail | Invoice, goods and payment purpose contradict each other |
Enhanced due diligence is justified when the owner is unclear, the payer is unrelated, the country or industry is higher risk, or the invoice, the goods and the purpose contradict each other. For a clean supplier payment, a small exporter should be able to show the invoice, the contract or purchase order, proof of delivery or service, the beneficial owners, and a one-line note of why the payment matches expected trade.
Filing every foreign payment as suspicious creates noise, not detection.
The FIC media release on the 2024/25 annual report shows the scale. 55,262 registered institutions submitted more than 13.4 million regulatory reports, including over 570,000 suspicious and unusual transaction reports. The Centre conducted 556 inspections, and 330 institutions received remedial-action reports for non-compliance. Volume isn't the same as a defensible decision. Recurring export and BPO payments can look odd to a rules engine while remaining commercially ordinary, so the written reason matters more than another alert.
Why More Reports Do Not Mean Better Controls
A busy reporting year isn't a successful compliance year. The chart below is the registration jump, and the filing numbers behind it tell a sharper story.
Read the ratio, not the flood
By 31 March 2024, 51,020 accountable institutions were registered on the FIC database, up from 45,392 in 2022/23, according to the Financial Intelligence Centre's 2023/24 annual report. Those institutions submitted approximately 7.4 million regulatory reports during 2023/24, including 414,984 suspicious and unusual transaction reports. From that intake the Centre produced 3,924 financial-intelligence reports that directly contributed to the recovery of R98.5 million in criminal proceeds.
The published breakdown also recorded 751 reports concerning money laundering, 568 involving self-money laundering, 255 involving third-party money laundering, and 88 involving professional money-laundering networks. Supervision was narrower than the filing flood. The Centre conducted 558 inspections, and 245 institutions were found non-compliant and received reports requiring remedial action.
Millions of submissions and a few thousand intelligence products mean most reports are raw material, not proof that crime was found. Being registered and filing isn't the same as running a programme an inspector will accept.
What an exporter should do instead
- Owner checks: Keep beneficial owners current, with a date on the record.
- Purpose: Write the payment purpose in wording a bank can read.
- Audit trail: Hold the invoice, the contract and the delivery note together.
- Reasoned escalation: Escalate the case you can explain, and don't add an alert nobody can defend.
The mistake to retire is treating every international payment as suspicious. Accurate checks and a written reason beat another filing that only adds noise.
Prepare a Portable Compliance File
Build this pack this week, before the next transfer is queried. The checklist is the same pack in visual form.
- Company registration, plus the names of the people authorised to bind it.
- Beneficial owners, with the date the record was last checked.
- The contract, the invoice, and proof that goods or services moved.
- Source of funds and the payment purpose in wording a bank can read, including the likely Balance of Payments category.
- Counterparty identity, and, if a third party pays, the document that links that payer.
- The sanctions-screening result, with a one-paragraph note of why the payment was cleared, queried or escalated.
- A diary date to refresh the file when owners, corridors or products change.
Why the pack travels
This is what an overseas partner, a bank or an inspector is really asking for after grey-list progress. A complete file keeps a legitimate shipment from waiting while someone hunts through inboxes. If item 4 or item 5 is missing, don't send the payment yet.
Once that file exists, the payment rail is a separate step. Businesses in South Africa complete KYB, then move funds. Our free Balance of Payments code checker suggests the likely category for an export receipt or import payment, copies bank-ready wording, and shows which documents to have ready. Our free USD to ZAR converter shows the live mid-market rate against the FX spread and SWIFT fees a bank may take. We offer low FX spreads, fast settlement, no SWIFT fees and bank-grade security, and we disclose the actual quote before you confirm.
Don't send the next foreign payment until those seven items can travel with it.
If your export or BPO payments keep stalling on ownership and purpose questions, we help South African businesses complete KYB and then send and receive cross-border funds with the quote shown before you confirm. Pair that rail with the seven-item file so a routine supplier payment isn't held for missing proof. Visit Zaro when the file is ready and you want the transfer to move.