KYC Onboarding Process: A Step-by-Step Guide for South African Accountable Institutions

Identify the customer before establishing a business relationship. For individual customers, this means obtaining the full name, ID number, date of birth, and residential address. For legal entities, this means obtaining the registered name, registration number, registered address, and the identity of directors and beneficial owners.

• Full name (as per ID document)
• South African ID number or passport number
• Date of birth
• Residential address (not a PO Box)
• Contact details (email and phone)

Collect the documents required to verify the customer's identity and address. Documents must be current and, where required, certified. The FIC accepts electronic copies of original documents for digital onboarding, provided the institution has a documented process for verifying the authenticity of electronic copies.

• Certified copy of valid SA ID or passport
• Proof of residential address (utility bill, bank statement, or lease agreement — not older than 3 months)
• For non-residents: certified copy of passport and proof of foreign address

Verify the information provided by the customer against independent, reliable sources. Verification is not the same as collection — the institution must confirm that the identity document is genuine, that the address is current, and that the beneficial ownership declaration is accurate.

• Verify SA ID number against the Department of Home Affairs (DHA) database or an accredited verification bureau
• Verify address against a third-party address verification service or by reviewing an original utility bill or bank statement
• For non-residents: verify passport against the issuing country's database where possible

Identify all natural persons who ultimately own or control the legal entity customer. The FIC's Public Compliance Communication 59 (August 2024) confirmed that the beneficial ownership threshold under FICA is 5% — any natural person holding 5% or more of the equity, voting rights, or economic interest in the entity must be identified and verified.

• Not applicable for individual customers (the customer is the beneficial owner)

Assign a risk rating to the customer based on the institution's risk-based approach. The risk rating determines the level of due diligence applied and the frequency of ongoing monitoring. Risk ratings must be documented and must reflect the institution's actual assessment of the customer's ML/TF/PF risk.

• Low risk: SA resident, standard employment income, no PEP indicators, no high-risk jurisdiction connections
• Medium risk: non-resident, cash-intensive business, limited verifiable income
• High risk: PEP or PEP associate, customer from FATF grey-listed jurisdiction, complex ownership, adverse media

Screen the customer against the FIC-designated list, the UN Security Council consolidated list, and (for USD transactions) the OFAC SDN list before establishing the business relationship. Screening must be completed before approval — not after. Document the screening outcome and retain records for 5 years.

• Screen full name and date of birth against FIC-designated list
• Screen against UN Security Council consolidated list
• Screen against OFAC SDN list for USD transactions
• Document screening date, lists screened, and outcome

Apply enhanced due diligence for customers rated as high risk. EDD requires additional documentation, a source of funds or source of wealth declaration, and senior management approval before the business relationship is established. EDD customers must be subject to more frequent ongoing monitoring.

• Obtain source of funds declaration (salary slips, tax returns, investment statements)
• Obtain source of wealth declaration for high-net-worth individuals
• Conduct adverse media screening
• Obtain senior management approval before onboarding
• Set enhanced ongoing monitoring frequency (quarterly or more frequent)

Obtain the required approval for the business relationship and create the customer record. The approval authority depends on the customer's risk rating: standard CDD customers can be approved by a relationship manager or equivalent; high-risk customers requiring EDD must be approved by senior management or the compliance officer. All onboarding records must be retained for a minimum of 5 years.

• Low/medium risk: relationship manager approval
• High risk: senior management or compliance officer approval
• Create customer record with all CDD documentation
• Retain records for minimum 5 years
• Set ongoing monitoring triggers and review dates