South Africa Prudential Authority Sanctions Three Financial Firms for FIC Act Failures

South Africa’s Prudential Authority has announced administrative sanctions against Capitec Bank Limited, Ninety One Assurance Limited and Albaraka Bank Limited for failures under the Financial Intelligence Centre Act 38 of 2001 (FIC Act).

The three enforcement actions were published on 11 September 2026 and cover separate inspections and compliance deficiencies. Together, they highlight supervisory attention to customer due diligence, enhanced and ongoing due diligence, regulatory reporting, employee training, sanctions controls and the design and implementation of risk management and compliance programmes.

Capitec fined R28 million

The Prudential Authority imposed five cautions and a financial penalty totalling R28 million on Capitec following a 2023 inspection. Of the total penalty, R5.5 million is conditionally suspended for 36 months from 13 October 2025.

The regulator found deficiencies in customer due diligence, enhanced due diligence and ongoing due diligence on sampled client files. It also found that Capitec had failed to provide ongoing training to sampled employees.

Further findings concerned Capitec’s Risk Management and Compliance Programme. The Prudential Authority said the bank had not obtained management approval for certain anti-money laundering name-screening and payment-screening investigation manuals before implementation, had not evidenced documented and approved end-to-end terrorist property reporting processes before receiving the inspection notification, and had inadequately developed or documented controls relating to terrorist property reporting and financial sanctions.

Capitec cooperated with the regulator to remediate the identified deficiencies and control weaknesses.

Ninety One sanctioned over EDD and compliance-programme weaknesses

Ninety One Assurance received two cautions, two reprimands and a R6 million financial penalty, of which R2.5 million is conditionally suspended for 36 months from 19 June 2025.

The Prudential Authority found that Ninety One had not adequately conducted enhanced due diligence on some sampled client files. It also identified weaknesses in the firm’s Risk Management and Compliance Programme, including controls for sanctions screening, prominent influential person screening, business and client risk, and the documentation and implementation of relevant policies and procedures.

Ninety One told the regulator that it had undertaken remedial action to address the identified deficiencies.

Albaraka penalised for late regulatory reports and RMCP failures

Albaraka Bank received three cautions and a R1.6 million financial penalty, of which R440,000 is conditionally suspended for 36 months from 10 June 2024.

The regulator found that Albaraka had failed to report 232 cash threshold or aggregated cash threshold reports on time and had also failed to submit 144 suspicious transaction reports or suspicious activity reports within the required period.

Its Risk Management and Compliance Programme was also found deficient in areas including documented risk factors and weightings, trigger events for customer risk-rating reviews, prohibited industries and activities, geographic risk, governance and implementation of customer due diligence and reporting obligations.

The Prudential Authority separately noted that an earlier R2 million sanction against Albaraka for customer due diligence deficiencies involving sampled trade-finance clients had been set aside by the Appeal Board after the bank appealed. Albaraka has remediated the remaining identified compliance deficiencies and control weaknesses.

Why it matters

The three actions show that AML supervision is extending beyond whether a financial institution has policies on paper. The findings focus on evidence that customer risk controls are actually performed, approvals are documented, screening and reporting processes operate within required timelines, staff receive ongoing training, and the institution’s compliance programme reflects its real risk exposure.

For compliance teams, the recurring theme is operational effectiveness: documented controls need to be approved, implemented, evidenced and consistently applied across client files and reporting processes.

Sources

• South African Reserve Bank — Prudential Authority imposes administrative sanctions on Capitec Bank Limited, 11 September 2026
• South African Reserve Bank — Prudential Authority imposes administrative sanctions on Ninety One Assurance Limited, 11 September 2026
• South African Reserve Bank — Prudential Authority imposes administrative sanctions on Albaraka Bank Limited, 11 September 2026