Sanctions and PEP Screening in South Africa

Sanctions and PEP screening in South Africa starts with two different questions: could the business be dealing with restricted property or a designated party, and does a customer's public role or relationship require particular due-diligence measures? A sanctions candidate and a PEP candidate need different investigations and decisions.

For a South African compliance team, the practical job is to check the right people and companies, investigate possible matches and decide what happens next. Start with the duties that apply to your business under the Financial Intelligence Centre Act (FIC Act), then describe the checks and responsibilities in your Risk Management and Compliance Programme (RMCP).

Establish the institution's scope first

An accountable institution is identified by the activities in Schedule 1 of the FIC Act. The schedule covers defined categories, rather than every business that happens to handle money. Check the actual activity and any qualifications in the relevant item instead of relying on a broad label such as “insurer”, “adviser” or “property business”.¹

Accountable institutions have customer due-diligence, recordkeeping and other duties under the Act. Section 42 requires an RMCP. The programme should describe the firm's processes and accountability; it cannot waive a statutory minimum. Section 26B's sanctions prohibitions are framed more broadly and must not be treated as obligations only for Schedule 1 businesses.¹

Separate three things in the control design: the legal requirement, the supervisor's guidance and any additional company policy. A company may screen a wider set of supplied business partners, but that does not make every partner a statutory PEP or subject every business to identical due-diligence duties.

Use the South African sanctions framework and official lists

Section 26A gives qualifying UN Security Council resolutions adopted under Chapter VII immediate effect for FIC Act purposes and provides for publication. The provision concerns resolutions imposing the specified financial sanctions; it does not turn every UN measure into an identical screening obligation. Section 26B sets out prohibitions concerning designated parties and property; section 26C provides for permitted financial services and dealings in specified circumstances.¹

Use the FIC's Targeted Financial Sanctions portal to search or download the list, read notices, subscribe to updates and apply for permitted financial services.² Read the relevant notice and legal provisions alongside a possible match. The search result alone will not answer every terrorism-related prohibition or designation question.

Foreign regimes may also matter because of the parties, geography, contracts or other connections involved. Establish that connection separately. OFAC, UK or EU tests do not become South African law simply because the screening platform supports those sources.

FIC's PCC 44A addresses scrutinising client information, relevant links to designated parties, freezing and reporting. Targeted-financial-sanctions controls are distinct from the risk-based assessment of money-laundering, terrorist-financing and proliferation-financing exposure.³ An institution should not skip applicable sanctions checks because a customer is rated low risk or a payment is small.

Decide who to screen

Start with the people and companies identified during due diligence. Check the company, its beneficial owners and its representatives as separate subjects, and record each person's role so the analyst can understand the result.

Use this table to organise the checks. Set the precise scope from your legal duties and documented procedures.

The UBO and related-party guide explains how to screen the owners and connected people identified during due diligence. Establishing who owns or controls the company requires separate work; another company-name search will not uncover an undisclosed owner.

Investigate a possible sanctions match promptly

Start with the input record and original source entry. Compare available names, aliases, dates of birth, identification or registration details, addresses and other relevant context. A nationality difference or missing identifier alone may not establish that two records concern different people.

Section 26B includes circumstances in which a person knows, or ought reasonably to have known or suspected, that the relevant property, service or support will benefit, be on behalf of, be directed by or be under the control of a designated person or entity. The legal test is broader than an analyst having marked a candidate as confirmed.¹

Assign unresolved candidates to someone who can obtain further information and control the next affected action. An internal payment hold supports investigation; it is not the same as a legal asset freeze. PCC 44A says an institution must not process a transaction if it cannot determine accurately whether doing so would breach targeted-financial-sanctions obligations. Where a freeze is required, apply it immediately without waiting to report or receive instructions from the FIC.³

If a company director or owner is designated, assess the designated person's property, ownership, control and the relevant dealing or benefit. Do not automatically freeze every company account, block every associated customer or terminate the relationship from the name result alone. Equally, a clear company-name search does not settle indirect ownership or control.¹

Assess ownership and control under the applicable South African provisions and current FIC guidance, rather than importing a percentage from another jurisdiction. Record what is affected, who has authority to act and which questions need legal escalation.

Keep sanctions reports separate from suspicious-activity reports

Section 28A concerns an accountable institution's reporting of specified property linked to terrorism or designated persons and entities. Section 29 addresses suspicious and unusual transactions and activities under its own conditions.¹ A terrorist property report (TPR) and a suspicious transaction or activity report are not interchangeable.

Use the applicable report, statutory threshold and prescribed timing. FIC's targeted-financial-sanctions manual explains the reporting and freezing process.⁴ The reporting deadline is not permission to continue a prohibited dealing or postpone a required freeze.

Maintain a procedure for obtaining instructions on affected property, permitted services and any applicable authorisation. Returning money, paying an alternative recipient or closing the account does not by itself resolve a restriction. For the technical reporting handoff, see the goAML integration guide; it does not determine whether a report is legally required.

Distinguish South Africa's PEP and influential-person categories

The Act separates the categories below. A commercial database can help identify a person or role, but its label does not replace the statutory assessment.¹

A domestic PEP does not automatically fall outside Schedule 3A twelve months after leaving office. Schedule 3B also uses “holds, or has held”. Schedule 3C has its own preceding-twelve-month language and qualifying conditions; do not transfer that period to every public official.¹

Paragraph 147 of Guidance Note 7B says a delay to Schedule 3C was envisaged because the necessary information was not readily available. Before applying the category, check the current commencement notices and Ministerial determination: the note alone does not settle whether it is operational, and an executive title alone is not enough.⁵ Immediate family members and known close associates are assessed through their relationship to the person concerned; they are not assumed to hold that person’s role themselves.

Apply the measures that follow from status and risk

Section 21F addresses a prospective customer, or that customer's beneficial owner, identified as a foreign PEP. It requires senior-management approval, reasonable measures to establish source of wealth and source of funds, and enhanced ongoing monitoring.¹

Section 21G addresses domestic PEPs and prominent influential persons where the prospective business relationship entails higher risk under the institution's RMCP. The Act sets out the same types of measures in that circumstance. Section 21H extends the relevant provisions to immediate family members and known close associates.¹

Record both the person's status and why the relationship presents the assessed level of risk. Holding public office does not by itself show wrongdoing, and a domestic role does not automatically make every relationship higher risk. Explain the measures, approval and follow-up required. Company policy may add controls, but it cannot remove legal requirements.

The PEP screening guide provides the general review framework. Apply South African law here rather than copying another country's domestic-PEP treatment.

Respond to changed data and relationships

Section 21C addresses ongoing due diligence. Section 28A(3) also requires accountable institutions to scrutinise information concerning existing clients when the Director gives the relevant notice under section 26A(3).¹ Keep relevant customer information current and respond when a maintained relationship changes: a new owner, representative, public role or relevant designation may create a different screening question.

Risk-based periodic review does not replace response to a relevant sanctions update. Set controls for receiving updates, identifying affected records and ensuring candidates are investigated; do not present an annual search as sufficient for every relationship.

Three fictional screening scenarios

A common name at onboarding

An applicant produces a sanctions candidate with a similar name. The analyst compares reliable identifiers and source information, obtains proportionate additional information and establishes that the entry concerns someone else.

The file records the specific evidence supporting dismissal. The candidate clearance does not authenticate every customer document, settle overall customer risk or permanently clear everyone sharing the name.

A company's supplied owner has held public office

A corporate customer supplies an owner whose name resembles that of a former office-holder. The analyst establishes identity, the precise role and relevant dates before deciding whether Schedule 3A applies. A broad title such as “government official” is not the whole assessment.

The team then assesses the applicable section 21G higher-risk condition and any required measures. A small company or absence of a government contract does not alone answer the owner's public-role status. Approval records the reasoning rather than treating the PEP label as an automatic rejection.

An existing customer's director is designated

An update identifies a director of an existing company customer as a designated person. The responsible team investigates identity, the person's interests and control, relevant property and any affected dealings without delaying required action.

It determines which assets or services are restricted and which reports or authorisations apply. The director's name is not an automatic instruction to freeze every company account; nor is replacing the director a guaranteed workaround. The file records the assessment, action and authority for any further dealing.

Retain the decision and protect the information

Keep enough detail for another analyst to follow the decision: who was checked, when and why, which sources and settings were used, what evidence was compared, what was decided and who reviewed and approved it. Name the person responsible for any unanswered question.

Sections 22, 22A and 23 address records and retention. Relationship-related due-diligence records and transaction records have different retention triggers; do not describe all screening material as having one five-year clock beginning on the search date.¹ Distinguish these statutory retention triggers from any additional preservation needed for an investigation or other applicable requirement.

POPIA also matters. Sections 10, 11, 14 and 19 address minimality, processing justification, retention and security safeguards. Determine the necessary data, purpose, access and retention requirements for the actual processing.⁶ Consent is not the only possible justification, but a screening purpose does not grant unrestricted permission to collect or keep all personal information. Assess special information and other applicable conditions where relevant.

Evaluate Checklynx against the South African process

Checklynx supports screening supplied people and companies through portal, API and CSV/batch workflows against supported, configured sources. Grouped profiles bring related source records together; available enriched identifiers, public roles, relationships and source context help analysts compare the intended subject with candidates.

That context can reduce avoidable false positives by helping distinguish similarly named people. It is not a guaranteed reduction or proof that every South African role, source or designation is covered. Test the required source coverage, update handling, representative names and review evidence before relying on a configuration. Guidance Note 7B also makes clear that commercial PEP information is not necessarily comprehensive and does not transfer the institution’s responsibility to the provider.⁵

Use sanctions screening, PEP screening, configured ongoing screening and case management as parts of one process. The institution still establishes legal scope, verifies identity and ownership, assesses source of funds or wealth where required and makes authorised freezing, reporting and relationship decisions.

Frequently asked questions

Does a low-risk customer still need sanctions controls?

A low risk rating does not remove applicable targeted-financial-sanctions obligations. Keep the mandatory controls separate from the risk-based extent of other due-diligence measures.³

Does a former domestic PEP automatically cease to count after twelve months?

Do not apply that blanket cut-off. Read the current Schedule 3A wording, actual role and relevant guidance. Schedule 3C has different wording for a separate category.¹

Is a PEP result the same as a sanctions designation?

No. Establish identity and the relevant status, then assess the correct measures. PEP due diligence and sanctions restrictions have different legal purposes and consequences.