Why the bank account is the critical-path item
On paper, the bank account looks like an administrative afterthought. In practice it is usually the slowest step in a South African market entry — and the one everything else waits for. CIPC (the Companies and Intellectual Property Commission, the company registry) will incorporate a company in days, and SARS (the South African Revenue Service) registers it for income tax automatically. But:
- Capital has to come in through the front door. Share-subscription money should arrive through an Authorised Dealer (a bank licensed by the South African Reserve Bank, SARB, to deal in foreign exchange) against “suitable documentary evidence”, because that paper trail is what later preserves and smooths the path for dividends and sale proceeds to go out again — subject to tax compliance, documentary verification and any Authorised Dealer or FinSurv approval required at the time; see exchange control. No account, no documented inflow.
- SARS pays refunds only into a South African account in the company’s own name. Foreign bank accounts are expressly excluded. Until the account exists and is verified, VAT and income-tax refunds are simply stuck.
- Payroll, suppliers and day-to-day trading are impractical without a local account — and your employer registrations assume one exists.
Why is it slow for foreign-owned companies specifically? Because the bank’s anti-money-laundering due diligence must run up the entire ownership chain — through every offshore holding company — to the natural persons at the top, and every foreign document in that chain has to be reliably verified. A purely local company with two local directors clears this in days; a three-jurisdiction group structure does not. The rest of this page explains exactly what the bank is required to do, so you can prepare for it instead of discovering it one follow-up email at a time.
What FICA actually requires of the bank
FICA is the Financial Intelligence Centre Act 38 of 2001, South Africa’s anti-money-laundering statute, substantially strengthened by the General Laws (AML/CFT) Amendment Act 22 of 2022. Banks are “accountable institutions” under it. Two features surprise international treasury teams:
- There is no statutory list of “FICA documents”. Since 2017 the Act sets outcomes, and each bank’s own board-approved Risk Management and Compliance Programme (RMCP, section 42) sets the methods. That is the legal reason two banks’ document packs differ — and why a relationship manager cannot “waive” an item the RMCP requires.
- The customer is not just the company. Sections 21 to 21H require the bank to identify and verify the company itself, everyone acting for it (directors, authorised signatories), the purpose of the relationship and its source of funds — and, critically, the beneficial owners: the natural persons who ultimately own or control the client, however many corporate layers up they sit.
For a company client, section 21B(2) prescribes a strict three-step cascade for finding those natural persons — ownership first, then control by other means, and only then senior management as a fallback:
If a client contemplated in section 21 is a legal person, an accountable institution must, in addition to the steps required under sections 21 and 21A and in accordance with its Risk Management and Compliance Programme— (a) establish the identity of the beneficial owner of the client by— (i) determining the identity of each natural person who, independently or together with another person, has a controlling ownership interest in the legal person; (ii) if in doubt whether a natural person contemplated in subparagraph (i) is the beneficial owner of the legal person or no natural person has a controlling ownership interest in the legal person, determining the identity of each natural person who exercises control of that legal person through other means, including through his or her ownership or control of other legal persons, partnerships or trusts; or (iii) if a natural person is not identified as contemplated in subparagraph (ii), determining the identity of each natural person who exercises control over the management of the legal person, including in his or her capacity as executive officer, non-executive director, independent non-executive director, director or manager; and (b) take reasonable steps to verify the identity of the beneficial owner of the client, so that the accountable institution is satisfied that it knows who the beneficial owner is.
Section 21B(5) applies this expressly to entities incorporated anywhere — your offshore parent and every intermediate holding company get the same treatment. And the cascade is mandatory in sequence: a bank may only fall back on senior managers (step three) if the ownership and other-control steps genuinely yield no one. Until the bank is “satisfied that it knows who the beneficial owner is”, the law leaves it no discretion:
If an accountable institution is unable to— (a) establish and verify the identity of a client or other relevant person in accordance with section 21 or 21B; (b) obtain the information contemplated in section 21A; or (c) conduct ongoing due diligence as contemplated in section 21C, the institution— (i) may not establish a business relationship or conclude a single transaction with a client; (ii) may not conclude a transaction in the course of a business relationship, or perform any act to give effect to a single transaction; or (iii) must terminate, in accordance with its Risk Management and Compliance Programme, an existing business relationship with a client, as the case may be, and consider making a report under section 29 of this Act.
That obligation cuts both ways after onboarding too: a client that lets its due-diligence file go stale can lawfully — indeed must — be off-boarded. The South African courts have consistently declined to force banks to keep clients:
There is no political route around this either: in the Oakbay litigation [2017] ZAGPPHC 576 the High Court confirmed that the Minister of Finance has no power to intervene in the bank-client relationship or order banks to reopen closed accounts. The only reliable lever a foreign investor has is a clean, complete disclosure pack. (Our firm’s FICA hub covers the framework from the accountable institution’s side.)
The 5% vs 25% threshold story — three different rules
Ask three advisers what shareholding makes someone a “beneficial owner” in South Africa and you may hear three numbers. All three are real — they just belong to different regimes, and conflating them causes real onboarding delays. Precisely (figures last reviewed 16 July 2026):
- The Act itself has no percentage. Neither FICA’s definition of “beneficial owner” nor that in the Companies Act 71 of 2008 contains any threshold — both turn on ultimate ownership or effective control, tested through the section 21B(2) cascade above.
- FIC guidance now says 5%. The Financial Intelligence Centre’s Public Compliance Communication 59 (PCC 59, 8 August 2024) strongly recommends that banks identify everyone holding 5% or more, combined with an overall control assessment (the “hybrid approach”). The FIC’s consolidated implementation guidance (Revised Guidance Note 7A, September 2025) cross-refers to PCC 59 on this point rather than restating it.
- Legacy bank practice often says 25%. Many banks’ RMCPs still carry the older 25% convention, inherited from pre-2017 guidance and the FATF’s example threshold. Commentators trace its lineage to the former rules-based regime; no current South African instrument prescribes it. It is practice, not law — and a bank using 25% must still resolve doubt through the statutory cascade.
- Company law separately says “5% or more” — to CIPC. Since 2023 every company must file its beneficial owners holding 5% or more (or exercising effective control at any percentage) on CIPC’s beneficial-ownership register — a company-law duty owed by the company itself, legally distinct from the bank’s FICA duty. A new company files within 10 business days of incorporation, and CIPC blocks annual-return filing until it is done.
2.18. ... In this context the Centre is of the view that holding five percent or more of ownership interest in a legal person is usually sufficient to exercise a controlling ownership interest in the legal person. The Centre strongly recommends that accountable institutions identify the persons who hold five percent or more of ownership interest in a legal person, which persons can be regarded as beneficial owners for purposes of section 21B(2) of the FIC Act.
| Regime | Instrument | Threshold | Who owes the duty |
|---|---|---|---|
| Bank due diligence — the statute | FIC Act, s 21B | No percentage; the ownership → control → management cascade | The bank |
| Bank due diligence — FIC guidance | PCC 59 (8 August 2024) | 5% or more, strongly recommended | The bank, via its RMCP |
| Bank due diligence — legacy practice | Older RMCPs (pre-PCC 59 convention) | Often 25% — practice, not law | Individual banks |
| Company-law register | Companies Act 71 of 2008 + Companies Amendment Regulations, 2023 | More than 5% must be filed with CIPC | The company itself |
The practical rule for a foreign group: build your disclosure to 5%. It satisfies PCC 59, it covers any bank still working at 25%, and it matches the CIPC filing your company must make anyway — one organogram, used consistently in both. Note that effective percentages multiply down a chain (PCC 59’s worked method): a 60% shareholder of a 40% shareholder holds 24% effectively, and control can make someone a beneficial owner at any percentage.
Enhanced due diligence — foreign PEPs and sanctions screening
Two screening layers sit on top of ordinary due diligence, and both regularly touch foreign-owned applicants.
Foreign politically exposed persons
If any prospective client or its beneficial owner is a foreign politically exposed person as defined in Schedule 3B to the Act, enhanced due diligence is mandatory — not risk-based, mandatory:
If an accountable institution determines in accordance with its Risk Management and Compliance Programme that a prospective client with whom it engages to establish a business relationship, or the beneficial owner of that prospective client, is a foreign politically exposed person, the institution must— (a) obtain senior management approval for establishing the business relationship; (b) take reasonable measures to establish the source of wealth and source of funds of the client; and (c) conduct enhanced ongoing monitoring of the business relationship.
A foreign politically exposed person is an individual who holds, or has held, in any foreign country a prominent public function including that of a— (a) Head of State or head of a country or government; (b) member of a foreign royal family; (c) government minister or equivalent senior politician or leader of a political party; (d) senior judicial official; (e) senior executive of a state owned corporation; or (f) high-ranking member of the military.
Section 21H extends the same treatment to immediate family members and known close associates. A PEP connection is not a bar — it means senior-management sign-off at the bank plus evidence of source of wealth and source of funds, so budget extra weeks. Disclose it upfront: screening databases will find it anyway, and volunteered PEP status with a clean source-of-wealth file is routinely bankable, while non-disclosure reads as concealment.
Sanctions screening
Every party is also screened against the United Nations Security Council’s targeted financial sanctions list; dealing with listed persons is prohibited (FICA ss 26A–26C). The FIC hosts a searchable version of the list which, per the FIC, “is updated within 24 hours of changes made by the UNSC”. For ordinary commercial groups this is a formality — but it is run on every director, signatory and beneficial owner, which is another reason the full ownership chain must be disclosed.
The document pack banks actually ask for
Because each bank’s RMCP sets its own methods, no two packs are identical — but for a foreign-owned company the core is near-universal:
| Document | Why the bank asks |
|---|---|
| CIPC registration certificate (CoR 14.3) and current disclosure certificate | Proves the South African entity exists and who its registered directors are |
| Memorandum of Incorporation (MOI) | The company’s constitution — confirms capacity and authority rules |
| Board resolutions (SA company, plus the parent where a signatory acts for the group) | Verifies the person acting for the client and their authority (s 21) |
| Certified — and, where required, apostilled — passports of every foreign director, signatory and beneficial owner | Reliable identity verification for persons the bank cannot check locally |
| Group structure chart (organogram) to the ultimate natural persons, with percentages | The s 21B(2) cascade — the bank must know who ultimately owns and controls |
| Parent-company corporate documents (certificate of incorporation, registers of directors and members) | Verifies each layer of the chain (s 21B(5) reaches foreign entities) |
| Source-of-funds and intended-purpose narrative | s 21A — what the account is for, where the money originates, expected flows |
| Sworn English translations of anything not in English | The verifier must be able to read what it is verifying |
On legalisation: an apostille is issued under the Hague Apostille Convention by the competent authority in the country where the document was issued — so foreign passports and parent-company documents are apostilled at home, not in South Africa, while South African documents going the other way are typically handled through DIRCO (the Department of International Relations and Cooperation). Documents from countries outside the Convention need consular legalisation via the South African embassy — slower, so start those first. Nothing in FICA prescribes certification formats or the 3-month “freshness” window many banks apply — those are RMCP policies — but resisting them only costs time.
One consistency warning: the organogram you give the bank and the beneficial-ownership filing your company makes at CIPC should tell exactly the same story. Banks increasingly check; a mismatch triggers precisely the follow-up round you are trying to avoid.
How long it really takes — and how to make it faster
There is no statutory service standard, so treat every number here as practice observation, not law. Market experience in 2026 suggests a foreign-owned company with a clean two-layer structure and a complete pack gets a transactional account in roughly 3–6 weeks (8+ weeks for complex multi-jurisdiction structures). Response latency to the bank’s follow-up queries is the single biggest driver of total time.
What reliably shortens it:
- Start the bank workstream on day one, in parallel with incorporation — the foreign-document legalisation is the long pole, and it can run while CIPC processes.
- Engage the bank before you incorporate. A pre-screen conversation surfaces that bank’s specific RMCP asks (in-person verification? local signatory preference?) while you can still plan around them.
- Prepare the organogram properly: one page, every layer named with jurisdiction and registration number, effective percentages multiplied down to the natural persons at 5%.
- Apostille early, translate early — in the issuing country, before anyone asks.
- Write the source-of-funds narrative down: initial capital amount, funding source, expected monthly flows, counterparties and currencies.
- Answer follow-ups same-day. Every idle week in the queue is usually waiting on the applicant, not the bank.
One structural point: no South African law requires a resident director, but some banks’ policies favour at least one authorised signatory or representative contactable in South Africa for full transactional banking. That is bank policy, and it varies — see resident directors and local requirements for what the law actually demands.
Resident accounts, non-resident accounts and CFC accounts
Exchange control decides what kind of account you get, and the classification follows registration, not shareholding. Under SARB’s Currency and Exchanges Manual for Authorised Dealers, a “resident” includes any entity registered in South Africa — so a locally incorporated subsidiary is a resident even if 100% foreign-owned, and it banks on ordinary resident accounts. A “non-resident” is an entity whose registration is outside the Common Monetary Area (South Africa, Namibia, Lesotho and Eswatini). For genuinely non-resident entities the manual is categorical:
Rand accounts opened by non-residents must be designated and conducted as Non-resident Rand accounts.
Non-resident Rand accounts are freely convertible and transferable abroad — that designation is what evidences the funds’ non-resident status. Three practical notes for foreign groups:
- Branches are the grey case. A foreign company that registers as an external company remains incorporated abroad — the definition of a non-resident — yet its South African branch operations are, practitioners report, commonly banked as resident by Authorised Dealers. The manual has no single square rule on the point, so confirm the designation with your bank’s exchange-control desk at onboarding rather than assuming either way.
- CFC accounts. A resident subsidiary that earns or holds foreign currency (importers, exporters, service businesses invoicing offshore) can hold Customer Foreign Currency accounts with its Authorised Dealer, keeping permitted flows in foreign currency.
- Offshore accounts need approval. A South African company may open a foreign bank account only with Authorised Dealer approval and a bona fide foreign income source — holding working capital offshore “by default” is not permitted.
The account also has an exchange-control job to do on funding day: the inward SWIFT for share capital should reference the subscription so the Authorised Dealer can view the required documentary evidence, shareholder loans need prior Financial Surveillance approval and registration before funds flow, and certificated shares held by the non-resident parent must be endorsed “non-resident”. Those mechanics — and getting dividends and exit proceeds out again — are covered in the exchange-control guide.
Routine reporting you should know about — and the FATF grey-list exit
Once the account is running, the bank files certain reports with the Financial Intelligence Centre automatically. The account holder does nothing, and a report is not an accusation — but boards like to know what gets reported:
- Cash threshold reports (CTRs): cash transactions above R49 999.99 — in effect R50 000 and more — are reported within three days (FICA s 28, regulation 22B of the Money Laundering and Terrorist Financing Control Regulations).
- International funds transfer reports (IFTRs): cross-border transfers above R19 999.99 are reported within three days (s 31, regulation 23D) — routine for every intercompany flow you will run.
- Suspicious transaction reports (STRs): filed within fifteen days where warranted (s 29); the reporter is prohibited from telling the client.
Country-risk context has also improved: South Africa exited the FATF (Financial Action Task Force) grey list on 24 October 2025, and is “no longer subject to increased monitoring”. Overseas correspondent banks have accordingly eased jurisdiction-level friction on South African payments. Do not expect softer onboarding, though — the 2022–2025 reforms (beneficial-ownership registers, sanctions enforcement, RMCP supervision) are permanent statutory features, and the next FATF mutual evaluation is expected to run from the first half of 2026 to October 2027.
SARS, refunds and bank-detail verification
The last leg is wiring the account into SARS. Refunds — income tax and VAT — are paid only into a valid South African account in the taxpayer’s own name:
[A valid account is] a cheque, savings, or transmission account ... registered in the name of the taxpayer(s) ... not a credit card, bond, or foreign bank account.
Note — The bracketed words are ours; the ellipses mark omitted text. SARS states separately: “SARS will verify your bank account before accepting changes to your banking details.” and “We will pay tax refunds due only once we have confirmed your details.”
Only the company’s registered representative — in practice its public officer, who since 24 December 2024 must be in place from formation — or a registered tax practitioner can submit or change the bank details on eFiling, and SARS verifies the account with the bank before paying anything. Slot this into the same critical path: account opened → details captured and verified → refunds flow. The full post-incorporation stack — the public officer, the employer payroll registrations and VAT — is walked through in tax and employer registrations.
Frequently asked questions
No. The account is opened for the South African legal entity, so the CIPC registration certificate comes first. But you can — and should — run the two workstreams in parallel: many banks will pre-screen the FICA pack while incorporation is pending, and the foreign-document legalisation (apostilles, sworn translations) is the true long pole. Starting the bank pack on day one is the single best way to shorten the overall timeline.
No law requires face-to-face onboarding — FIC guidance expressly treats non-face-to-face identification as a risk factor a bank may manage in its own compliance programme. Individual banks may still ask for in-person verification, or prefer at least one signatory or representative contactable in South Africa, as a matter of their own policy — practice varies between banks, so ask the specific bank early. South African company law does not require a resident director at all.
It rarely works, and it creates real legal problems. SARS pays tax refunds (income tax and VAT) only into a valid South African bank account in the taxpayer’s own name — expressly not a foreign bank account. Share capital should arrive through an Authorised Dealer against documentary evidence to preserve your right to repatriate dividends and sale proceeds. And funding the business informally through the parent’s or a director’s account creates a resident/non-resident loan account, which needs prior written approval from the Reserve Bank’s Financial Surveillance Department — see exchange control. Without it you have an exchange-control contravention and a contaminated source-of-funds trail.
FICA requires the bank to verify identity reliably; for a foreign director or shareholder whose documents the bank cannot check locally, certification and apostille are how its compliance programme achieves that. An apostille is a certificate issued under the Hague Apostille Convention by the competent authority in the country where the document was issued, authenticating it for use abroad — South Africa has been a party since 1995. Documents from non-Convention countries need consular legalisation instead, which is slower. Neither certification nor a freshness period is prescribed by the Act itself — they are bank compliance-programme policies — but resisting them only delays the account.
There is no statutory timeline — this is practice observation, not law. For a foreign-owned company with a clean two-layer structure and a complete pack, market experience suggests 3–6 weeks (8+ weeks for complex multi-jurisdiction structures). The biggest accelerators are a complete ownership organogram down to natural persons, pre-apostilled passports, a written source-of-funds narrative and same-day responses to the bank’s follow-up queries.
Both numbers are real, but neither is in the Act. FICA itself contains no percentage — it defines beneficial owners through a cascade of ownership, control and management tests. The FIC’s PCC 59 (August 2024) strongly recommends that banks identify everyone holding 5% or more; many banks’ legacy compliance programmes still use the older 25% convention. Separately, company law requires the company itself to file its beneficial owners above 5% with CIPC’s beneficial-ownership register. Safest course: build your disclosure pack to 5% — it satisfies every version and matches your CIPC filing.
Generally no. The banker-client relationship is contractual: in Bredenkamp v Standard Bank (2010) the Supreme Court of Appeal held a bank may close accounts on reasonable notice under its contractual termination rights. FICA goes further — section 21E obliges a bank to refuse or terminate where due diligence cannot be completed. And in the Oakbay litigation (2017) the High Court confirmed that not even the Minister of Finance can instruct a bank to keep or reopen an account. The practical remedy is fixing the disclosure — completing the ownership chain, updating stale documents, evidencing source of funds — not fighting the bank.