Practitioners as accountable institutions
Attorneys have long been in Schedule 1, but two things changed the temperature: the December 2022 amendments brought the sector under the FIC’s direct supervision, and the grey-list remediation made legal-sector inspections a visible deliverable. Trust accounts, conveyancing and company-formation work put law firms at the centre of exactly the flows the Act polices — which is why a property mandate, an incorporation instruction or a deposit into trust all trigger the firm’s due diligence duties.
What the recent penalties teach
- Sanctions screening is not optional. The single largest component of the R7.77 million penalty (R3.9 million) was failing to screen clients against the targeted financial sanctions list — a duty many small firms did not know they had.
- A template RMCP is not an RMCP. R3.8 million attached to the absence of a documented and implemented programme. The FIC called the non-compliance “grossly negligent and wilful”; the Appeal Board upheld it.
- The return is the cheapest win. Across the sector, unfiled risk and compliance returns are the most common sanction trigger.
- Remediation counts — eventually. The March 2026 High Court ruling in a second firm’s review limited retrospective penalties to the period after the FIC gained supervisory authority over practitioners (19 December 2022) and required remedial steps to be credited — a meaningful guardrail, not an escape hatch.
The case detail sits in the enforcement tracker.
A firm’s FICA duty stack
The full stack is the same as any accountable institution’s — registration, RMCP, reporting, returns, training — with three law-firm specifics: client due diligence at matter-opening (not at first invoice); trust-account deposits as the natural home of source-of-funds scrutiny; and privilege mapping, so the RMCP records where section 37(2) genuinely protects communications and where it does not.
What this means for your clients
When a law firm asks a new client for identity documents, company structure information or the source of a deposit, it is discharging the same statutory duties as a bank — and section 21E binds it the same way: no verification, no matter. The client-side guides in this hub (documents, companies, trusts) describe exactly what a firm may and may not be asking for as a matter of law.
How we run it ourselves
MJ Kotze Inc is itself an accountable institution and runs the regime this hub describes — a documented RMCP, client due diligence at matter-opening, sanctions screening and the reporting stack. The firm’s RMCP summary is published here. That operational familiarity — not just the statute — is the basis on which we advise other accountable institutions on their programmes.
Frequently asked questions
Schedule 1 item 1 lists practitioners who practise as defined in the Legal Practice Act — which catches practising attorneys broadly, including every conveyancer. Since 19 December 2022 the FIC has direct supervisory authority over the sector.
The two headline components of the R7.77 million penalty: failing to screen clients against the targeted financial sanctions list, and having no documented, implemented RMCP — plus directive non-compliance. Across the sector, unfiled risk and compliance returns are the most common sanction trigger.
Privilege is preserved where it genuinely applies (s 37(2) protects communications covered by attorney-client privilege), but it is not a blanket exemption from customer due diligence, screening or reporting. A firm needs its RMCP to map where privilege actually operates — this is a point on which specific advice matters.