Risk Management and Compliance Programme

MJ Kotze Inc. has appointed a Risk Officer in terms of section 42(3) of the Act.

3.1 Responsibilities

The Risk Officer is responsible for:

• Overseeing compliance with the Act and Regulations
• Implementing and maintaining this RMCP
• Ensuring that all employees are aware of their obligations under the Act
• Arranging training for employees on money laundering and terrorist financing matters
• Monitoring compliance with this RMCP
• Reporting suspicious and unusual transactions to the Financial Intelligence Centre (FIC)
• Maintaining records as required by the Act
• Liaising with the FIC and other regulatory authorities
• Reviewing and updating this RMCP on a regular basis

3.2 Contact Details

4.1 Business-Level Risk Assessment

4.2 Binary Risk Approach for Clients

For client-level risk assessment, the Firm's approach is not to seek to quantify the metrics used to measure risk. Rather, a binary approach is adopted, which distinguishes between high risk and low risk, doing so on a qualitative basis.

4.3 High-Risk Client

A high-risk Client is any Client:

4.4 Low-Risk Client

A low-risk Client is any Client who is not mentioned under paragraph 4.3.

4.5 Proliferation Financing Risk Factors

4.6 New Products and Services Risk Assessment

MJ Kotze Inc. conducts client due diligence in accordance with the Act and Regulations. The level of CDD applied depends on the assessed risk level of the client and business relationship.

5.1 When CDD is Required

CDD must be conducted:

• When establishing a business relationship
• When conducting a single transaction above the threshold of R100,000
• When there is a suspicion of money laundering or terrorist financing
• When there are doubts about the veracity of previously obtained identification data

5.2 CDD Measures

5.3 CDD Documentation Requirements

The following table sets out the documentation required for different types of clients:

5.4 Anonymous or Fictitious Clients

The Firm is strictly prohibited from dealing with anonymous persons, or persons who have fictitious names.

The Firm must, by adhering to the provisions of this RMCP, ward against the risk of:

• dealing with an anonymous person by refusing to on-board as a Client anybody who appears to desire or expresses a desire to transact with the Firm anonymously;
• dealing with a fictitiously named person by subjecting all Prospective Clients to the CDD procedures described in this RMCP, which procedures are aimed at ensuring, amongst other things, that the Firm only deals with persons who exist.

5.5 Abbreviated CDD Procedures

The abbreviated CDD procedures detailed in this section apply (subject to an assessment that a Prospective Client is of low risk as per section 4.3) only if at least 1 (one) of the circumstances described below are present, failing which the full CDD procedures detailed in the tables above will be applicable.

5.5.1 Co-operation with other Accountable Institutions

Where the Firm has a Client in common with a Secondary Accountable Institution that agrees to furnish the Firm with a compliance letter and copies of the relevant CDD documents, the Firm may rely on those instead of applying the full CDD provisions. The term "Secondary Accountable Institution" includes analogous institutions based outside South Africa in FATF Member States.

5.5.2 Listed Companies

When dealing with a listed company, verification may be dispensed with if proof of listing, a copy of the Representative's ID, and a copy of the authorising letter or resolution are provided instead.

5.5.3 Professional Partnerships

If all partners are attorneys, public accountants, auditors, professional engineers, quantity surveyors, pharmacists, stockbrokers or practitioners in the medical professions, the Firm may elect to establish and verify only the managing partner's identity.

5.5.4 Single Transactions of Low Value

The CDD procedures do not apply to a once-off transaction in which the Firm will receive less than R10,000.00. However, the prohibition against anonymous persons applies, and the Firm must still record the full name, identity number and contact number of the person.

5.6 Ongoing CDD for Business Relationships

The Firm must compare each Transaction under a Business Relationship against the information provided by the Client in the Questionnaire pertaining to the nature, purpose, and source of funds of the Business Relationship, and must update such information and any other documents originally forming part of the CDD where necessary.

5.7 Doubts About the Accuracy of Existing Information

Where an Employee has doubts about information previously obtained from an existing Client, it must take reasonable steps to satisfy itself as to that information's accuracy, which may include requesting original documents, more recently certified copies, or documents from a Governmental Authority or other independent person.

5.8 Terminating a Business Relationship

The Risk Officer must terminate a Business Relationship with a Client in respect of whom a CDD or ongoing CDD cannot be conducted. The Risk Officer must advise the Client of the termination and the reason, and shall, where practically possible, do so in writing.

5.9 Business Relationship with a Client who is an FPPO or DPIP

If the Client is an FPPO, or a high-risk DPIP looking to establish a Business Relationship, in addition to the prescribed CDD procedures, the Employee must only on-board the Client with the approval of the Risk Officer, establish the Client's source of wealth, and monitor the Business Relationship more closely.

7.1 CDD Records

In respect of each Client, the Firm must keep CDD records that reflect the following information:

• the name of the Client; and
• the means through which the Client's name was established; and
• the documents by which the Client's name was verified; and
• the Employee who established and verified the Client's name.

7.2 Transaction Records

In respect of each Transaction, the Employee must keep records of the:

• amount and currency involved; and
• date; and
• parties involved; and
• nature of the Transaction; and
• underlying Firm correspondence.

7.3 Storage and Retention Requirements

The Risk Officer must ensure that all records kept in terms of this RMCP are stored for at least 5 (five) years following the conclusion of a single Transaction or the termination of a Business Relationship, in such a manner that:

• they are readily retrievable should they be requested by the FIC or any other person legally entitled to them; and
• they are protected, through physical and other controls, against unauthorised access thereto; and
• back-up records / copies of the records are stored separately from the original records.

All employees and associates of MJ Kotze Inc. receive comprehensive training on anti-money laundering, counter-terrorist financing, and counter-proliferation financing (AML/CTF/CPF) matters in accordance with section 42(2)(s) and section 43 of FICA.

8.1 Training Schedule and Intervals

8.2 Training Content and Curriculum

Training covers the following topics:

8.3 Training Delivery and Facilitation

Training is facilitated by:

• The Risk Officer (MJ Kotze)
• External compliance consultants or legal professionals (where appropriate)
• FIC-hosted webinars and training sessions
• Law Society of South Africa (LSSA) CPD accredited courses

8.4 Training Assessment and Competency

8.5 Training Records and Evidence

The following training records are maintained:

• Training Attendance Registers: Signed attendance registers for all training sessions
• Training Materials: Copies of presentations, handouts, and training manuals
• Assessment Results: Copies of completed tests and assessments
• FIC Event Confirmations: Certificates of attendance for FIC webinars and events
• CPD Certificates: LSSA CPD certificates for compliance training
• Training Schedule: Annual training calendar and completion tracking

All training records are maintained for a minimum of 5 years and are available for inspection by the FIC or supervisory body.

MJ Kotze Inc. maintains a formal process for identifying, escalating, and remediating any breaches or deficiencies in compliance with this RMCP or FICA obligations.

9.1 Identification of Non-Compliance

Non-compliance may be identified through:

• Self-reporting: Employees who become aware of potential breaches
• Internal monitoring: Risk Officer file reviews and compliance checks
• Client complaints: Complaints relating to FICA procedures
• FIC inspections: Findings from FIC compliance inspections
• LSSA inspections: Findings from Law Society inspections
• External audits: Audit findings relating to FICA compliance

9.2 Immediate Escalation Requirements

9.3 Breach Reporting and Documentation Process

9.4 Remediation Measures

9.5 Breach Register

9.6 No Retaliation Policy

MJ Kotze Inc. conducts ongoing monitoring of business relationships to ensure that transactions are consistent with knowledge of the client, the source of funds is legitimate, client information remains current, and the risk assessment remains appropriate.

12.1 Monitoring Activities

• Scrutiny of transactions to ensure they are consistent with knowledge of the client
• Regular reviews of client information and documentation
• Updating client information when circumstances change
• Conducting periodic reviews of higher-risk clients

12.2 Review Frequency

• Low risk: Review every 3-5 years or when circumstances change
• Medium risk: Review every 2-3 years or when circumstances change
• High risk: Review annually or more frequently if warranted

12.3 Complex, Unusual, or Suspiciously Large Transactions

12.4 Examination Process for Complex Transactions

12.5 Documentation of Monitoring Activities

All ongoing monitoring activities must be properly documented and retained for at least 5 years, including periodic review records, transaction monitoring records, complex transaction assessments, and enhanced monitoring logs for high-risk clients.

13.1 Responsibilities

All employees are responsible for:

• Complying with this RMCP
• Conducting appropriate client due diligence
• Identifying and reporting suspicious transactions
• Maintaining accurate records
• Attending training on AML/CFT matters

13.2 Compliance Monitoring

The Risk Officer monitors compliance with this RMCP by conducting periodic reviews of client files, testing compliance with CDD procedures, reviewing transaction records, and identifying areas for improvement.

13.3 Consequences of Non-Compliance

Non-compliance with this RMCP may result in:

• Disciplinary action against employees
• Administrative sanctions by the FIC
• Criminal prosecution
• Reputational damage to the firm

MJ Kotze Inc. complies with South Africa's targeted financial sanctions framework to combat money laundering, terrorist financing, and proliferation financing in accordance with sections 26A, 26B, and 26C of the Act.

14.1 What are Targeted Financial Sanctions?

Targeted Financial Sanctions are measures imposed by the United Nations Security Council to prevent terrorist financing, prevent proliferation financing, and restrict designated persons and entities from accessing financial services.

14.2 Screening Procedures

MJ Kotze Inc. screens all clients and parties to transactions against UN sanctions lists when establishing a business relationship, before conducting any transaction, periodically for existing clients, and when there are changes to UN sanctions lists.

14.3 Freezing Actions

14.4 Reporting Requirements

If a true positive match is confirmed, the Risk Officer must immediately report to the Financial Intelligence Centre (FIC) via goAML, and to the South African Police Service (SAPS).

14.5 Record Keeping

MJ Kotze Inc. maintains comprehensive records of all TFS compliance activities, including screening results, match verification processes, asset freezing actions, and reports submitted. All TFS records are retained for at least 5 years.

This RMCP is reviewed and updated regularly to ensure it remains effective and compliant with current legislation.

15.1 Annual Review Schedule

15.2 Additional Review Triggers

In addition to the scheduled annual review, this RMCP must be reviewed whenever:

• Legislative changes: When there are amendments to FICA, regulations, or FIC directives
• Business changes: When MJ Kotze Inc. introduces new services, enters new markets, or significantly changes its business model
• Risk profile changes: When the firm's ML/TF/PF risk assessment identifies material changes in risk exposure
• Deficiencies identified: When internal audits, external inspections, or incidents reveal gaps or weaknesses
• FIC guidance: When the FIC issues new Public Compliance Communications or guidance affecting DNFBPs

15.3 Review Process