Important information on submission of RMCP submissions, 9 October 2026

For South African financial services firms, this signals a shift from merely maintaining an RMCP to actively evidencing its adequacy and operational effectiveness to the regulator. Compliance teams should treat the directive as a priority governance matter: confirm whether your entity falls within the specified scope, validate that your RMCP is board-approved and reflects current AML/CFT risk assessments, and prepare for a formal submission process. Executives should expect increased scrutiny of risk governance, customer due diligence, transaction monitoring, and record-keeping arrangements.

The directive also reinforces the need for demonstrable senior management oversight and documentation of control testing. Action items include designating an accountable owner, mapping existing policies against Directive 12 expectations, closing identified gaps, and securing board sign-off before submission. Firms that have already invested in robust compliance frameworks may find the submission process smoother, but those with legacy or fragmented programmes should anticipate remediation costs and potential supervisory follow-up.

Given the FIC’s focus on risk-based supervision, timely and accurate submission is critical. Non-compliance can attract administrative sanctions, reputational damage, and enhanced monitoring. Conversely, a well-prepared submission can strengthen regulatory trust and support market access.

RegCanary recommends that compliance and legal teams obtain the full directive text, assess applicability, and build a submission timeline with clear internal milestones.