Processing FICA onboarding documents in South Africa: IDs, proof of address and who decides

FICA documents such as identity documents and proof of address can be processed for you by verification software, an outsourced onboarding team or a managed service, but the accountable institution still decides what to collect, how to verify it and whether to accept the client. Processing means receiving the documents, reading names and identity numbers, checking the documents against each other and against reliable sources, screening names against sanctions lists, and keeping the record.

The obligation cannot be handed over. The institution sets its method in its own Risk Management and Compliance Programme, decides whether what was collected is acceptable, and remains liable for any failure. A provider does the processing; your compliance staff make the calls.

On proof of address in particular: the regulations that once prescribed how identities had to be verified have largely been repealed. What you ask for now is what your programme says, based on your assessment of risk.

This guide covers clients who are natural persons. Companies, trusts and partnerships, and their beneficial owners, carry additional due diligence duties: establishing the nature of the client's business, its ownership and control structure and its beneficial ownership, and taking reasonable steps to verify the identity of the beneficial owners. Those are not covered here.

The Financial Intelligence Centre's guidance on these duties is Guidance Note 7B, issued on 3 August 2026, which replaces the Revised Guidance Note 7A, Guidance Note 7A and Guidance Note 7. Every point below from the Centre's guidance is taken from that note. The paragraphs we rely on read the same in the revised note it replaced.

FICA's customer due diligence duties apply to accountable institutions, listed in a schedule to the Act. The list includes a person who carries on the business of a bank, mutual banks and co-operative banks; a person who carries on a life insurance business, excluding reinsurance business; and a financial services provider authorised under the FAIS Act to provide advice or intermediary services in respect of the investment of any financial product, excluding a non-life insurance policy, reinsurance business and the business of a medical scheme.

The schedule did not list short-term insurance business when it was checked on 12 October 2026. Confirm your own status with your compliance officer or the Financial Intelligence Centre.

Firms outside the list may run similar checks for their own reasons. This guide is about the duties of those on it.

Section 21(1) of the FIC Act requires an accountable institution, in the course of concluding a single transaction or establishing a business relationship, and in accordance with its Risk Management and Compliance Programme, to establish and verify the identity of the client. If it cannot complete customer due diligence, section 21E says it may not establish the relationship or conclude the single transaction, must terminate an existing relationship in accordance with its programme, and must consider making a report.

The Centre's guidance explains how this works now. Large parts of the regulations that described how identities had to be established and verified have been repealed. Institutions choose the information they use and the means of verification, the nature and extent of verification must take the assessed risks of the relationship or transaction into account, and those decisions must be described in the programme. The Act itself requires the programme to provide for the manner and processes by which identities are established and verified, and the board, senior management or highest authority approves it.

For a capture process, the programme is the specification. Before you brief a provider, take from it the list of documents and information required for each type of client and each risk rating.

The guidance describes a natural person's basic identity attributes as full names, date of birth and, in most cases, a government-issued identifying number, such as a South African identity number or a passport or permit number, and expects these always to be used.

On verifying them, it says verification should use a reliable and independent third-party source and, as far as possible, the original source. Government issued or controlled sources, such as identity documents and the underlying electronic databases where the information in them is kept, should be used as far as practicable for the basic attributes. Other sources should be used only in exceptional cases, such as where the original source is not available, and only where the institution is confident it can adequately manage the risks. Information sources created or generated by the client are not reliable and independent third-party sources.

What document processing adds here:

• reading the name, identity number and date of birth from the document, whether a smart card, a green identity book, a passport or a permit;
• checking that the identity number agrees with the date of birth printed beside it;
• comparing the names and number on the identity document with those on the application and every other document;
• flagging a document that is unreadable, cut off, expired where it carries an expiry date, or a photo of a screen;
• passing the extracted details to the electronic verification your programme specifies, and recording the result.

The guidance lists residential address among the attributes that may supplement the basic ones, together with contact particulars, tax numbers and others; the nature and amount of those applied depends on how far the institution relies on verification to mitigate risk in that case. Whether you ask for proof of address, for which clients, and what you accept as proof, is therefore a decision for your programme.

If your programme does ask for it, the capture work is checking the document against the programme's own rules: that the document type is on your accepted list, that it is in the client's name or explained by a document linking the two, that its date falls within the age your programme allows, and that the address matches the application. Keep in mind the guidance's test that information sources created or generated by the client are not reliable and independent third-party sources.

The guidance says corroboration can be documentary or electronic, and encourages institutions to corroborate a prospective client's information against multiple third-party data sources. It adds two warnings. An institution using electronic data sources remains responsible and accountable and gets no automatic indemnity from regulatory action, so the choice of service is itself a due diligence decision. And solutions that allow prospective clients to manipulate source information in any manner should not be considered credible.

An onboarding flow can combine both: the client uploads documents, software reads them, and the details are checked against electronic sources, with mismatches sent to a person.

The guidance says an institution may start the processes of entering a business relationship while it is verifying identities, but must complete verification before it concludes a transaction in the course of the resultant business relationship or performs any act to give effect to the resultant single transaction. It must take care, for example, not to receive funds that may have to be returned, or to make funds available, before verification is complete.

That sets the turnaround a provider has to meet. A backlog of unchecked files is a backlog of clients who cannot yet transact.

The Centre's guidance on outsourcing, Public Compliance Communication 12A, draws the line:

• The institution cannot outsource its customer due diligence obligation. A provider may help with operational functions such as the collection and processing of documentation and information, to a limited extent. The institution must have sufficient controls to ensure its obligations are met, and must decide whether what was collected is acceptable under the Act and its programme.
• The institution remains fully accountable, responsible and liable for compliance failures resulting from an outsourcing arrangement, and that liability cannot be transferred, even to a provider that is itself an accountable institution.
• Reporting and registration, senior management approval of politically exposed persons, and the final approval of the risk assessment cannot be outsourced. Sanctions screening of client information can be, provided the provider passes any match to the institution for reporting.
• The arrangement should be in a formal agreement, clearly indicated in the institution's Risk Management and Compliance Programme.

One way to divide the work: the provider receives documents, reads them, checks them against your programme's list, runs the electronic checks and screening you specify, and marks each file complete or not. Your own staff accept or decline the client, handle every sanctions match and every politically exposed person, and review a sample of the provider's completed files.

Our guide on outsourcing by insurers and banks covers the wider outsourcing rules for those institutions.

An accountable institution keeps records of a business relationship for at least five years from the date on which the business relationship is terminated, and records of a transaction for at least five years from the date on which it is concluded. The records may be kept in electronic form and must be capable of being reproduced in a legible format.

If a provider keeps them, section 24 requires that you have free and easy access to them and that they are readily available to the Centre and your supervisory body. You remain liable if the provider fails, and you must give the Centre and your supervisory body the provider's prescribed particulars: under the regulations as the Centre sets them out, its name, the person controlling access to the records, the address where they are kept and from which they are controlled, and your liaison person.

Onboarding files hold identity numbers, addresses and sometimes photographs and selfies. A provider that processes them for you is an operator, and section 21(1) of POPIA requires you, in terms of a written contract, to ensure that it establishes and maintains the security measures in section 19.

If the flow matches a selfie to the identity photo, that is biometrics, which POPIA defines as a technique of personal identification based on physical, physiological or behavioural characterisation. Biometric information is special personal information: section 26 prohibits processing it, subject to section 27. Take advice on the basis for that processing before you switch it on.

• Will you work from our programme's document list for each client type and risk rating, and show us where each rule is applied?
• Which identity documents can you read, and how do you handle a photo of a screen, a cut-off image or an unreadable number?
• Which electronic sources do you check against, how reliable and independent are they, and can a client manipulate what they return?
• What do you do with a sanctions match or a possible politically exposed person? The answer should be: stop and pass it to us.
• How long does a complete file take, and what happens to incomplete ones?
• Where are the documents processed and stored, can we reach every file at any time, and what do we get back if we leave?
• Will you sign our operator agreement and the record-keeping terms section 24 requires?

Client onboarding, due diligence and sanctions screening are part of IAMX's Document processing and data capture service, automation built first for insurers, brokers and financial services firms. Documents are taken in, the fields that matter are read, each item is checked against your other systems, and anything unusual is passed to a person for a decision. Every job, step and decision is recorded, so any outcome can be traced. IAMX does not decide whether to accept a client: that decision, and every report to the Centre, stays with your institution. IAMX works as one accountable front door to a vetted network of specialist partners.

• Which companies process FICA documents like IDs and proof of address?

  FICA documents in South Africa are processed by three kinds of provider: identity verification software that reads documents and checks them against electronic sources, outsourced onboarding and data capture teams, and managed services that combine the two. None of them takes over the obligation. Give each candidate your programme's document list, and test them on a sample of real files with your compliance staff checking the results.

• Does FICA still require proof of address?

  FICA no longer prescribes proof of address as a fixed document for every client. The regulations that prescribed how identities had to be verified have largely been repealed, and whether you collect and verify an address is now a risk-based decision recorded in your Risk Management and Compliance Programme. The Centre's guidance lists residential address among the attributes that may supplement the basic ones. If your programme requires it, the requirement binds you.

• Can FICA verification be done electronically?

  Yes. The Financial Intelligence Centre says corroboration can be documentary or electronic and encourages checks against multiple third-party data sources. The institution remains responsible for the result, and sources that a client could manipulate should not be considered credible.

• Can we outsource FICA document checks?

  The work, yes; the obligation, no. A provider may help with the collection and processing of documentation and information, to a limited extent. You must still decide whether what was collected is acceptable, and you remain fully accountable, responsible and liable for any failure.

• Does FICA apply to short-term insurers?

  The schedule of accountable institutions did not list short-term insurance business when it was checked on 12 October 2026, while a person who carries on a life insurance business, excluding reinsurance, is listed. Confirm your own status with your compliance officer or the Financial Intelligence Centre. The Act's separate duty to report suspicious and unusual transactions applies to a person who carries on, manages or is employed by any business.

• How long must FICA onboarding documents be kept?

  Records of a business relationship are kept for at least five years from the date on which the business relationship is terminated. A provider may keep them for you if you have free and easy access to the records and they are readily available to the Centre and your supervisory body; you remain liable if the provider fails.