FICA client due diligence

Prove every client file.
In seconds, not days.

If the FSCA named a client you onboarded 18 months ago, could you show who verified each document in that file? For most firms the answer is days of digging. Attest, PaperTrail's AML/CDD onboarding workflow, makes it a screen: one record per client, a document checklist built from the entity type, every document verified and signed off by name, and an audit trail the inspector reads for themselves.

Schedule a 30-minute Call Learn More

Live today at a South African private wealth business

How it works

Four stages. One file per client.

Nothing lives in email. Every document, decision and reviewer is on the client record.

Attest / AML-CDD workflowFig. 01

Client record opened

Prospect captured once: individual, company, trust or partnership, with the branch and adviser who introduced them.

Who, when, by whom

Checklist generated

The entity type decides the required documents, including beneficial owners and controllers. Nothing is left to memory.

Entity-driven

Each document verified

The AML team accepts or rejects every document by name and date. Rejections go back to the adviser with the reason.

Per-document sign-off

Risk-rated and approved

Risk rating, EDD where required, and formal approval. The LISP account approval then runs from the same record.

Inspector-ready

Ongoing due diligence, handled

Fifteen trigger events re-open a client file automatically, and a periodic review cycle runs from the risk rating. This is the duty regulators now fine separately, and the one most firms cannot evidence.

High risk · annuallyMedium · 3 yearsLow · 5 years

LISP account approval

Once the client is approved, the investment account application runs the same way: platform-specific forms, mandate checks, sign-off by the right people, and one record that ties the account to the verified client.

The inspection

Six questions an inspector asks. Six answers from one screen.

Show me this client's risk rating and who set it.

On the record, with the user and timestamp.

Who are the beneficial owners and how were they verified?

Listed per client with each document and its verifier.

When was this file last reviewed?

Review date, outcome and the next due date.

Which documents were rejected and why?

Full rejection history, reasons included.

Show me every high-risk client due for review this quarter.

A report, not a spreadsheet exercise.

Who approved this account to open?

Named approvers at each step, with dates.

Why now

The fines are for files you can't prove, not programmes you don't have.

R28m

Capitec Bank · Sep 2026

Split by duty: R10m CDD, R5m EDD, R5m ongoing due diligence, R5m RMCP, R3m training.

R16m

Ashburton Fund Managers

Customer due diligence and record-keeping failures.

R10.6m

Sanlam Collective Investments · Oct 2025

The RMCP existed. The evidence of risk rating, beneficial owners and reviews did not.

R9m

Ninety One · two sanctions

CDD and ongoing monitoring across two separate actions.

South Africa left the FATF grey list in October 2025. The next mutual evaluation runs through 2027, so the FSCA and Prudential Authority have every reason to keep inspecting, and each stage of due diligence is now scored and fined on its own.

Built for

Wealth managers and private client businesses
LISP and investment platforms
Collective investment scheme managers
Stockbrokers and discretionary FSPs
Any FSP remediating after an FSCA or FIC directive

What a project looks like

Discovery call with your compliance officer and head of operations
Demo configured to your entity types, documents and branches
Scoped proposal: configuration, client-master integration, templates, training
Typical go-live measured in weeks, not quarters

Next step

Thirty minutes, your entity types, your questions.

Pick a time

A 30-minute call with Yoav Kissos from Egis Software, the PaperTrail developer. Bring your compliance officer; we'll walk one client and one trigger event end to end and answer the inspector questions live.

Schedule a Call

Prove every client file.In seconds, not days.