Which FICA obligation each verification helps you evidence
One row for each customer due diligence, record-keeping and reporting duty under the Financial Intelligence Centre Act that a verification might be expected to touch: the obligation, the section it comes from, the verification that produces evidence towards it, and what that record shows, including the duties no verification can evidence.
How to read this
The duty is yours, and it is anchored to your own Risk Management and Compliance Programme, not to any product. Section 21 requires you to establish and verify identity in accordance with your RMCP, which means the Act does not prescribe a tool, and no tool can satisfy the Act on your behalf. Veriflow performs an operational verification step that your programme may adopt as its means of verification.
6 of the 14 rows below say that no verification evidences the obligation. The table marks them so your programme can cover them. Source of funds is elicited, not looked up. A politically exposed person determination is yours to make under your programme. Forming a suspicion and filing the report to the Financial Intelligence Centre are yours, and the Centre does not let a vendor file on your goAML profile.
Whether you are an accountable institution at all is a determination you make against Schedule 1 of the Act. Nothing on this page is legal advice, and the glossary defines the terms used here.
The mapping table
| What the Act requires of you | Section | What Veriflow supplies towards it | What the record shows |
|---|---|---|---|
| Establish and verify the identity of a natural person you are onboarding, for a single transaction or a business relationship. | s21(1) | ID Verification. Add Facial Match (and the Liveness Test with it) where you must satisfy yourself that the person presenting the identity is its holder. | The record the Department of Home Affairs holds against the ID number; where Facial Match ran, a probability that the selfie matches the latest photograph Home Affairs holds for that number, read against the probability you accept; and where the Liveness Test ran with it, a pass or fail result. Timestamped. |
| Establish and verify the identity of a legal person you are onboarding. | s21(1) | CIPC Company Verification | The report CIPC holds on the entity: registration number, registered address, directors and their active status, business history, auditors, tax number, enterprise type, and in-business or liquidated status. Timestamped. |
| Establish and verify the identity and the authority of a person acting on behalf of a client, and of any person on whose behalf the client is acting. | s21(1) | ID Verification for the individual; Director Search where the authority claimed is a directorship. | The Home Affairs record for the individual, and the directorships CIPC records against that identity with each one’s active status. Neither evidences a mandate or a resolution. That document is yours to obtain. |
| No verification evidences this Establish the nature and intended purpose of the business relationship, and obtain information on the source of funds. | s21A | Elicited from your customer and recorded by you. It is not derived from a database, by Veriflow or by anyone else. | Nothing. This is the clearest line between identity verification and full customer due diligence, and it is a standalone item under the Act. |
| Establish the nature of the business and its ownership and control structure, and establish who ultimately owns or controls it: the beneficial owner. | s21B | CIPC Company Verification and Director Search, as an input to the question rather than an answer to it. | Registered particulars and directorships. A director is not a beneficial owner, and the result does not include beneficial ownership filings. Establishing a controlling ownership interest needs evidence this verification does not return. |
| Conduct ongoing due diligence, and keep the identity information you obtained up to date. | s21C | Any identity verification, re-run on the cycle your own programme sets. | Each result carries the date and time it ran, so your file shows when the information was last confirmed. Ongoing due diligence has a second limb, monitoring transactions through the relationship, and no verification addresses it. |
| Where you cannot establish and verify identity (including a beneficial owner’s), cannot obtain the section 21A information, or cannot conduct ongoing due diligence, the Act sets what follows. | s21E | A verification that comes back without confirming the identity is the record of having tried. | A result that does not confirm the identity (no record found, a Facial Match probability below the level you accept, or a Liveness Test fail), timestamped. What follows is set by the Act: you may not establish the relationship or give effect to the transaction, you must terminate an existing one in accordance with your programme, and you must consider a section 29 report. Your programme governs how each is done, not whether. |
| No verification evidences this Determine whether a prospective client for a business relationship, its beneficial owner, or an immediate family member or known close associate of either, is a foreign politically exposed person. Where they are, the enhanced measures follow automatically, on status alone. | s21F, s21H | The determination is yours. AML & PEP Screening screens against politically exposed persons (PEP), sanctions and money-laundering watchlists in one verification. Whatever it returns is an input to this determination. Veriflow does not make the determination and does not output it. Senior-management approval, establishing source of wealth and source of funds, and enhanced ongoing monitoring are not verification outputs. | Nothing that amounts to a determination. Section 21H lists who counts as immediate family without closing the list, and leaves “known close associates” undefined, so where either line falls is a judgement your programme has to make and record. |
| No verification evidences this Determine whether a prospective client for a business relationship, its beneficial owner, or an immediate family member or known close associate of either, is a domestic politically exposed person or a prominent influential person. Here the enhanced measures follow only where your own programme determines the relationship entails higher risk. Status alone is not enough. | s21G, s21H | This determination is not one Veriflow can supply. The trigger is a risk determination made under your Risk Management and Compliance Programme, which is yours and not ours. AML & PEP Screening screens against politically exposed persons (PEP), sanctions and money-laundering watchlists in one verification. Whatever it returns is an input to this determination. Veriflow does not make the determination and does not output it. | Nothing that amounts to a determination. Reading any result as “enhanced due diligence required” asserts a conclusion the Act reserves to your own risk assessment, and getting it wrong in either direction is the exposure. |
| On notice of a designation, scrutinise your client information to establish whether any client is a listed person or entity, and report property you hold. | s26A, s28A | AML & PEP Screening produces a screening record against the sanctions and money-laundering watchlists screened. For this duty the list is set by the notice the Centre’s Director publishes under section 26A(3). | A screening outcome against the list data screened, as that data stood when the screening ran, and a timestamped screening record for your file. Each screening is a point-in-time result. A match is the start of an enquiry, not a finding. The report itself is filed by you. |
| No verification evidences this Do not provide or make available any financial or other service or economic support, or deal with property, where you intend, know or reasonably suspect, or ought reasonably to have known or suspected, that it is for the benefit of, on behalf of, at the direction of or under the control of a person or entity designated under a Security Council resolution. | s26B | A prohibition on what you may do, not a record you produce. Screening is how you find out that it applies to you. | Nothing. The prohibition operates on you directly, and it reaches any person, not only accountable institutions. |
| Keep a record of all the information you obtained under sections 21 to 21H, not only the identity information. | s22(1) | Every verification. | A timestamped record of what was submitted, what came back, and when, for each verification you ran. What you keep, where, and in what form is your decision. |
| No verification evidences this Keep those records for at least five years: from the end of the business relationship, from the date a single transaction concluded, or from the date a section 29 report was submitted, as the case may be. | s23, s24 | The retention duty is yours. If a third party keeps records for you, section 24 conditions apply, the liability stays with you, and section 24(3) requires you to notify the Centre and your supervisory body. Ask us on the demo how results are kept for your file. | Nothing Veriflow can discharge for you. Veriflow returns the record; keeping it for the statutory period is a decision you make and remain answerable for. |
| No verification evidences this Report suspicious and unusual transactions and activity to the Financial Intelligence Centre, and do not disclose the report or anything about its contents to anyone, the customer included, whether you have filed it or must still file it. | s29 | Forming the suspicion and filing the report are yours. A verification or screening result is an input to your decision, and the Centre does not let a vendor file on your goAML profile. | Nothing. By design, Veriflow has no report-filing or report-archive feature: the report is filed and kept by you. |
How current an upstream source is (an official register, a credit bureau, CIPC) is not something Veriflow controls or warrants.
What a verification record is, and what it is not
A verification result is an input to your own assessment. Veriflow does not decide whether any person or entity is onboarded, declined, priced, offboarded, employed, granted credit or reported, and makes no recommendation as to any of those. Those decisions are made solely by you, on your own criteria and under your own legal obligations, and you must not use a result as the sole basis for any adverse outcome affecting a person.
Veriflow holds no registration, licence, accreditation, authorisation, certification or approval from any regulator or standards body in respect of the services, and does not hold itself out as holding any. Nothing in the services, and no result, constitutes legal or compliance advice or a determination that you have met any obligation under FICA, the NCA, POPIA or any other law. A result is not a certificate.
Each verification has its own page setting out what you get and where it stops. Some answer credit, collection, contact or employment questions rather than a FICA duty, so they do not appear in the table.
Work out which of these you need
Book a demo and we will run the platform against your own onboarding and show you the record each verification produces.
Last updated . Section references are to the Financial Intelligence Centre Act 38 of 2001 as amended, read against the Financial Intelligence Centre’s own consolidated FIC Act booklet.