South Africa's 2026 AML Bill: Company and NPO Changes

Key takeaways

• South Africa's General Laws (Anti-Money Laundering and Combating Terrorism Financing) Amendment Bill (B15–2026) is not yet law. As at 20 July 2026, Parliament recorded the Bill at introduction stage in the National Assembly. Parliament's public-participation page listed 12:00 on 10 August 2026 as the closing time for written submissions.
• Companies, close corporations and nonprofit organisations should continue complying with the law in force. They should not apply the Bill's proposed seven-year FICA record period, new NPO sanctions or direct CIPC fine as if those provisions were operational. A useful readiness exercise is to classify the organisation under each affected Act, fix current gaps, map the Bill's proposed changes to an owner and system, and monitor the final text, assent and commencement.
• The introduced Bill proposes changes to the Close Corporations Act, Nonprofit Organisations Act, Financial Intelligence Centre Act, Companies Act and Financial Sector Regulation Act. The same organisation may fall into more than one category, but the duties do not apply merely because it is a company or NPO.

1. Start with the Bill's actual status

The text may change during the parliamentary process. A compliance plan must therefore record the Bill version it used. Do not configure a deadline, penalty, retention period or reporting workflow from an earlier draft or a summary of the Bill.

The policy context also needs accurate wording. South Africa left the Financial Action Task Force grey list on 24 October 2025. National Treasury and the Presidency describe the continuing work as preparation for the next mutual evaluation, expected to run through October 2027. The Bill is not evidence that South Africa remained grey-listed in 2026.

2. Classify the organisation before assigning a duty

Do not merge these columns. An NPO is not automatically an accountable institution under the FIC Act. A company does not automatically become an “obliged entity” for the Bill's proposed discrepancy reports. The Bill defines an obliged entity as a category of persons to be prescribed by the Minister, so the eventual regulations would matter.

The FICA compliance glossary explains the accountable-institution framework, while the beneficial ownership glossary covers the company transparency concept used in CIPC and due-diligence work.

3. What companies and close corporations should track

Current duties remain the starting point

The Companies Act already requires beneficial-ownership records and filings. Section 56 distinguishes the registers maintained by affected companies and the filings required from companies that are not affected companies. CIPC currently states that companies and close corporations must file beneficial-ownership information within 10 business days after registration, update it when changes occur, and confirm or update it at least annually with the annual return. CIPC also applies a beneficial-ownership filing hard stop before an annual return can proceed.

Use those current requirements to reconcile:

• the CIPC beneficial-ownership record;
• the company's securities register or beneficial-interest register, as applicable;
• shareholder, member, nominee and control information;
• supporting identity and ownership-chain evidence; and
• the annual-return status and filing confirmations.

The company compliance checklist can organise that evidence. It does not replace a decision on which register or filing applies to a particular entity.

The Bill proposes four material company changes

First, clause 28 would require an obliged entity to report a material discrepancy between beneficial-ownership information it holds or must obtain under the FIC Act and the information in CIPC's register. The proposed definition of material focuses on a discrepancy serious enough to prevent establishment or verification of a beneficial owner, or the keeping of that information up to date. Because the obliged categories and reporting mechanics would be prescribed, a company should not invent a reporting threshold or recipient workflow now.

Second, clause 29 would add a deregistration ground. It addresses a company that, on CIPC's demand, has failed to submit its securities register or register of beneficial interest in the prescribed manner and form for two years or more in succession. This is a proposed statutory ground, not a statement that every historic filing defect already triggers automatic deregistration under B15–2026.

Third, clauses 30 and 31 would create a direct CIPC administrative-fine route for failure to comply with a compliance notice issued for failure to submit the relevant register. The proposed ceiling is the greater of 10% of company turnover for the period of noncompliance and the prescribed maximum; the Bill would require that prescribed maximum to be at least R10 million. The current Companies Act already contains a court-based administrative-fine mechanism for failure to comply with a compliance notice. The Bill's direct CIPC route, specified register trigger and increased prescribed floor must not be described as current law.

Fourth, proposed section 175A would allow an affected person to ask the Companies Tribunal to review that direct administrative fine within 15 business days after notice, or a longer period allowed for good cause. Any operational playbook should distinguish a review of the proposed fine from the existing process for objecting to a compliance notice.

For close corporations, clause 1 would extend the Companies Act section 33 regulations to a corporation as if those regulations had been made under the Close Corporations Act. A close corporation should therefore be included in the register and filing workstream, but its records should not be relabelled as company records.

4. What NPO governing bodies should track

The current NPO Act makes an important distinction. Any non-state NPO may apply for registration, but section 12(1)(b) requires registration where an NPO makes donations to individuals or organisations outside South Africa or provides humanitarian, charitable, religious, educational or cultural services outside South Africa. Registered NPOs and NPOs required to register under that provision must comply with the duties that apply to them under the Act.

The Bill would not turn every NPO into an FIC Act accountable institution. Its NPO Act proposals are a separate supervision and enforcement track. Clauses 2 to 5 propose:

• adding monitoring and enforcement of NPOs required to comply to the Directorate's functions;
• compliance notices for an NPO required to register that has not complied with specified section 12 or section 18 duties;
• prescribed administrative sanctions for an NPO required to register;
• an appeal to the Arbitration Tribunal within one month after receipt of the sanction decision, with late filing capable of condonation on good cause; and
• a maximum criminal penalty of R1 million, five years' imprisonment, or both for offences under sections 29(1) and 29(2).

The proposed criminal maximum must be read with the offences it names. Those provisions concern improper disposal of remaining assets on winding-up or dissolution, false representation of registered status, misuse of registration information and material false representations in documents or reports. It should not be presented as the penalty for every late annual report or governance defect.

An NPO readiness review should record its legal form, NPO registration status, cross-border donations or services, constitution, office-bearers, annual reports, beneficial-control information and any FIC Act role it separately performs. A non-profit company may have both Companies Act and NPO Act obligations. It may also be an accountable institution only if its activities place it in a Schedule 1 category.

5. What FIC Act accountable institutions should track

Current FIC Act duties attach to accountable institutions, not to all companies and NPOs. An entity listed in Schedule 1 must address registration, customer due diligence, beneficial ownership, records, regulatory reporting, governance, training and a documented Risk Management and Compliance Programme (RMCP) according to the duties that apply to its business.

Records: five years now, seven years proposed

Current section 23 requires relevant relationship, transaction and section 29 report records to be kept for at least five years from the statutory trigger. Clause 10 would substitute seven years for five in each part of section 23.

Do not change the retention schedule solely because the Bill was introduced. Record which systems, archives, processors and deletion routines would be affected if seven years becomes operative. Any later change should also be reconciled with legal holds, sector-specific rules, contracts, security controls and the Protection of Personal Information Act's retention requirements.

New products, delivery mechanisms and technology

Current section 42 requires an accountable institution to develop, document, maintain and implement an RMCP. Current FIC guidance already expects business-level, client-level and new-product or service risk assessment.

Clause 21 would add express statutory wording requiring the RMCP to address, before a new product or service is made available, the risk arising from new delivery mechanisms and the use of new or developing technologies, and the measures used to manage and mitigate that risk. This could affect digital onboarding, remote verification, automated screening, payment methods, platform distribution and technology-enabled services, but the legal test remains the proposed wording rather than a generic technology checklist.

Prepare a controlled change record containing:

1. the proposed product or service and intended launch date;
2. the delivery mechanism and technology dependencies;
3. the money-laundering, terrorist-financing and proliferation-financing risk assessment;
4. controls, residual risk, testing and approval evidence;
5. the RMCP sections and procedures that would change; and
6. the person authorised to approve release.

This is useful under the current risk-based framework and creates evidence for a later statutory change without pretending that clause 21 is already in force.

6. Financial-sector proposals are a separate workstream

The Financial Sector Regulation Act proposals are directed at financial products, services, institutions, significant owners and beneficial owners. They include technology-neutral treatment of arrangements similar in nature or outcome to financial products or services, possible licensing under the Act despite another licensing requirement, information requests to significant or beneficial owners and clarified investigation powers.

A general company or NPO should not assume that this part applies. A regulated financial institution or a business launching a new financial arrangement should map the proposal with its responsible authority and sector-specific legislation.

7. A controlled readiness plan

Fix current-law gaps now

• Confirm entity types, registrations, Schedule 1 status and regulated activities.
• Reconcile internal and regulator-held beneficial-ownership information.
• Bring current annual returns, NPO reports, registers, RMCP documents and filing evidence up to date.
• Resolve a real discrepancy under the law and regulator process that applies today.

Prepare, but do not activate, proposed changes

• Create a Bill-change register with clause, affected entity, system, policy owner and dependency.
• Model the five-to-seven-year FIC record change without altering live deletion rules prematurely.
• Identify which product and technology approval records already satisfy current FIC guidance.
• Draft configurable workflows for discrepancy reports, compliance notices and appeals, leaving prescribed categories, forms and amounts unset.

Monitor the legal gates

• Track committee amendments and the Bill version.
• Record passage by both Houses where required, presidential assent and Gazette publication.
• Verify the final commencement proclamation rather than assuming assent and operation occur together.
• Review regulations and regulator guidance before activating a filing or penalty workflow.

Escalate decisions with material consequences

Obtain focused legal and compliance review where the organisation cannot determine its Schedule 1 status, has unresolved beneficial-owner discrepancies, receives a compliance notice, faces deregistration, operates cross-border NPO programmes, plans a new financial or technology-enabled service, or needs to change a retention schedule containing personal or privileged information.

FAQs

Related Lexuno paths