The grey list: in, out — and what it means
South Africa spent February 2023 to October 2025 on the FATF’s grey list of jurisdictions under increased monitoring — listed over 22 action items spanning eight strategic deficiencies, many traceable to state-capture-era enforcement weakness. Exit came on 24 October 2025, after the FATF confirmed the action items were substantially addressed — including, pointedly, real customer due diligence supervision and enforcement (National Treasury media statements, 24–25 February 2023 and 24 October 2025). The delisting matters commercially: lower friction on cross-border payments and correspondent banking, and a better investment narrative.
Myth: “off the list, so FICA will relax”
The most common post-delisting misconception. The causality runs the other way: South Africa got off the list because supervisors started inspecting and sanctioning in earnest — and the delisting is conditional on that continuing. The next FATF mutual evaluation begins in 2026 and concludes in 2027 under the fifth-round methodology, which emphasises effectiveness: investigations, prosecutions, inspections and sanctions, not legislation on paper. For accountable institutions the practical message is the opposite of relaxation: the inspection era is the new normal.
Capitec: R56.25 million, anatomised
On 20 December 2024 the SARB’s Prudential Authority announced administrative sanctions against Capitec Bank: seven cautions, a reprimand and financial penalties totalling R56.25 million (R10.5 million conditionally suspended for 36 months), following 2021 and 2022 inspections. The findings read like a checklist of this hub’s institution-side guides:
- customer due diligence and enhanced due diligence failures — including verification of identity, identification of beneficial owners of legal entities, and ongoing due diligence;
- late cash threshold reports and late suspicious transaction reports;
- transaction-monitoring alerts not attended to within 48 hours; and
- RMCP non-adherence.
The lesson for everyone smaller: if the country’s biggest retail bank can be sanctioned for CDD basics, the basics are what inspectors check.
Law firms: the R7.77m penalty and the High Court
In 2024 the FIC’s R7.77 million penalty against an attorneys’ firm was upheld by the FIC Act Appeal Board (FIC media release, 13 November 2024) — the headline components being a failure to screen clients against the targeted financial sanctions list and the absence of a documented, implemented RMCP. A separate firm took its sanction on review and won a partial High Court victory in March 2026, limiting recalculated penalties to the period after 19 December 2022 (when the FIC gained direct supervisory authority over legal practitioners) and requiring remedial steps to be considered. Both threads — and what they mean for a practice’s RMCP — are unpacked in FICA for attorneys.
The quiet killer: the risk and compliance return
The most common sanction across recent FIC enforcement is also the most avoidable: not filing the risk and compliance return (Directives 6 and 7 of 2023; Directive 11 cycle from 1 April 2026). Legal practitioners and estate agencies feature constantly — the estate agency penalties on the FIC’s public sanctions register routinely include a return-related component. Filing the questionnaire is the cheapest compliance win available.
What comes next: the 2026–27 evaluation
The FATF’s next mutual evaluation of South Africa begins in 2026 and concludes in 2027. A draft General Laws (AML/CTF) Amendment Bill was gazetted on 14 January 2026 to close residual deficiencies ahead of it (mainly sanctions, information-sharing — including lifestyle audits — NPO supervision and new-technology provisions); nothing in the draft changes the customer due diligence framework described in this hub. This page is updated as enforcement and FATF milestones land — the “legal position” date above reflects the last review; the timeline carries the dated history.
Frequently asked questions
No — the opposite. South Africa exited the grey list (24 October 2025) precisely because it demonstrated real supervision and enforcement, and the next FATF mutual evaluation (2026–27) assesses effectiveness — investigations, inspections, sanctions — not just laws on paper. Expect supervisory intensity to continue or increase.
Yes — first to the FIC Act Appeal Board, then on review to the High Court. The appeal record is mixed: the R7.77m penalty against one firm was upheld by the Appeal Board, while another firm won a partial High Court victory in March 2026 limiting retrospective penalties for periods before the FIC gained supervisory authority over legal practitioners and requiring remedial steps to be credited.
FIC Act sanctions are compliance penalties, not solvency findings. A CDD or reporting failure says nothing about a bank’s balance sheet — prudential soundness is supervised separately. Customers were not asked to do anything in the Capitec matter.