NPO Anti-Money Laundering Compliance in South Africa

Key takeaways

• A South African nonprofit organisation is not automatically an accountable institution under the Financial Intelligence Centre Act merely because it is an NPO. Its current compliance duties depend on several separate facts: whether it must or chooses to register under the Nonprofit Organisations Act, whether it is formed as a non-profit company, trust or voluntary association, whether its activities fall within Schedule 1 to the FIC Act, whether it has SARS public-benefit approvals, and whether it deals with a person or property affected by targeted financial sanctions.
• The board should therefore build one compliance map rather than adopt a generic “NPO AML policy”. Record the organisation's legal form, every registration and approval, where it raises and spends funds, who controls it, the activities it actually performs, and which regulator receives each filing. Then match each obligation to the correct entity, office-bearer, evidence and review date.
• Over-classification can restrict legitimate work; treating nonprofit status as an exemption can leave real duties unmet.

The compliance layers at a glance

An organisation can occupy several rows at once. DSD registration does not replace CIPC, the Master, FIC or SARS compliance, and a filing with one authority is not proof that another register is current.

1. Start with legal form, not the public label

“NPO” describes a nonprofit organisation, but it does not identify a single legal vehicle. The government registration service recognises organisations formed as trusts, companies and voluntary associations. Each vehicle has its own founding instrument and governing law before NPO Act registration is considered.

The board's first record should identify:

1. the exact registered or constitutional name;
2. the legal form and formation number;
3. the NPO registration number, if any;
4. the income-tax number and every SARS approval;
5. the bank accounts and fundraising platforms used;
6. every country in which funds, goods or services move; and
7. each activity that could fall within a regulated FIC category.

The NPO certificate does not replace the NPC registration record, trust letters of authority or voluntary-association constitution. The beneficial ownership glossary separates formal ownership from ultimate natural-person control.

2. Decide whether NPO Act registration is voluntary or compulsory

Section 12 of the NPO Act, as amended by the General Laws (Anti-Money Laundering and Combating Terrorism Financing) Amendment Act, distinguishes two positions. An NPO that is not an organ of state may apply for registration. Registration is compulsory where the organisation:

• makes donations to individuals or organisations outside South Africa; or
• provides humanitarian, charitable, religious, educational or cultural services outside South Africa.

A registered NPO, and an organisation in those compulsory categories whether or not it has completed registration, must comply with the Act. A board conducting cross-border work should not assume that local incorporation, donor registration or tax approval resolves this question.

Record the recipient, country, payment or delivery route, service, value and decision-maker. Obtain source/legal review where a transfer or programme does not fit the statutory wording clearly.

3. Keep the NPO Directorate record current

Registration under the NPO Act brings continuing duties. The official registration service says a registered NPO must submit an annual report within nine months after the end of its financial year. The report comprises a narrative report and a financial report. Its founding document must also contain the matters required by section 12 unless the organisation's incorporating law already provides for them.

The 2022 amendments added prescribed information about office-bearers, control structure, governance, management, administration and operations to the statutory framework. Registered NPOs must keep the information required for the director up to date. The Act also contains disqualification and removal rules for office-bearers.

The compliance owner should reconcile:

• the current constitution, trust instrument or memorandum of incorporation;
• the office-bearers shown in board records and regulator records;
• appointment, resignation and removal resolutions;
• physical, postal and electronic contact details;
• the financial year-end and annual-report submission evidence; and
• any notice from the Directorate and the response deadline.

The Department of Social Development has publicly confirmed that non-submission of required reports and failure to respond to a compliance notice can lead to cancellation and removal from the register. Keep acknowledgements, not only copies of what was sent.

4. Add the legal-form branch

If the NPO is a non-profit company

An NPC remains a company under the Companies Act. CIPC states that all companies, including non-profit companies, must file annual returns and beneficial-ownership declarations. CIPC also links annual-return filing to an up-to-date beneficial-ownership declaration.

An NPC has no ordinary profit-distributing shareholders, but its control analysis can depend on membership, appointment rights, voting arrangements or another means of effective control. Test its memorandum and actual governance rather than copying a profit-company answer.

Use the company compliance checklist for the company layer, then reconcile it with the NPO register. A change should not appear in board minutes while remaining stale at CIPC or DSD.

If the NPO is a trust

Trustees must establish and record the trust's beneficial ownership, keep the prescribed information, lodge the register with the Master and keep it up to date. The Department of Justice makes clear that reporting beneficial ownership to SARS does not satisfy the duty to report it to the Master.

The record is wider than a list of trustees. Depending on the instrument and facts, it can involve the founder, trustees, named beneficiaries and natural persons who ultimately own or exercise effective control.

The beneficial owner of a trust glossary explains the control concept at a high level. Trustees should use the Master's current template and online system rather than relying on an old spreadsheet or a once-off filing.

If the NPO is a voluntary association

A voluntary association is not converted into a company or trust merely by registering under the NPO Act. Its constitution remains central to membership, office-bearer authority, meetings, control of funds and dissolution, alongside the NPO Act where registration is held or compulsory.

Do not manufacture a CIPC or trust beneficial-ownership filing for this form. Instead, keep the association's constitutional control and office-bearer information complete, current and reconcilable with its NPO record, bank mandates and actual decision-making. If another legal arrangement sits above or below the association, classify that arrangement separately.

5. Test actual activities against the FIC Act

FIC obligations attach by statutory category and activity, not by the words “nonprofit” or “charity”. Schedule 1 includes different types of accountable institutions. Depending on what an organisation actually does, potentially relevant categories can include trust or company services, credit provision, money or value transfer, high-value goods dealing, legal services or crypto-asset services.

If an NPO performs a Schedule 1 activity, obtain a written classification that identifies:

1. the exact activity and Schedule 1 item;
2. the entity or operational unit performing it;
3. whether an exclusion or threshold applies;
4. the FIC registration and supervisory position;
5. the required risk management and compliance programme;
6. customer due-diligence, recordkeeping and reporting duties; and
7. the accountable person responsible for implementation.

Where the classification is positive, the organisation should implement the full applicable framework rather than treating a donor-screening checklist as sufficient. Where it is negative, record the facts and review the answer when services, payment routes or business models change.

FIC reporting provisions can also reach persons beyond registered accountable institutions in defined circumstances. Because the meaning of “business”, the report type and the facts matter, escalate a specific transaction promptly instead of relying on a generic NPO rule.

6. Treat targeted financial sanctions as a separate control

The FIC's targeted-financial-sanctions guidance says South African persons and entities have responsibilities under sections 26A to 26C of the FIC Act. Dealing with property owned or controlled by a listed person or entity is prohibited, and reporting can be required when sanctioned property is held or controlled.

Because the consolidated list changes, use the FIC's current search facility at the relevant decision point. Apply proportionate screening to relevant donors, recipients, partners, controllers and counterparties. A possible match needs controlled escalation before funds move or an accusation is made.

7. Build proportionate safeguards around how funds move

FATF's revised Recommendation 8 does not treat the whole not-for-profit sector as uniformly high risk. Its best-practices guidance calls for focused, proportionate and risk-based measures and warns against unnecessarily disrupting legitimate charitable activity.

An NPO can apply that principle operationally without mislabelling every safeguard as a statutory FIC duty. The board can approve controls suited to its programme, geography, funding and delivery model, such as:

• documented acceptance and rejection criteria for material donations;
• verification of bank-account ownership before a first payment or change;
• two-person approval for specified transfers;
• separation of fundraising, payment and reconciliation roles;
• due diligence on high-risk delivery partners and intermediaries;
• conflict-of-interest declarations and procurement records;
• restricted-fund tracking and variance review;
• escalation of unusual payment instructions or unexplained refunds; and
• testing control records against bank and programme evidence.

These are governance practices, not a claim that every NPO must adopt an accountable institution's programme. The controls should be strong enough for the actual risk, workable for the organisation and recorded in board-approved responsibility lines.

8. Keep NPO, PBO and section 18A status separate

Registration with the NPO Directorate does not automatically create income-tax exemption. SARS says an organisation must register for income tax and separately apply for approval as a public benefit organisation. Only an organisation with the relevant section 18A approval may issue receipts that support qualifying donor deductions.

Maintain a status schedule recording:

• the DSD NPO registration and reporting date;
• the legal-form registration and filing dates;
• the SARS income-tax and PBO approval position;
• whether section 18A approval exists and its scope;
• the activities and funds covered; and
• receipt wording and sequence control.

Do not describe a donation as tax-deductible because the recipient has an NPO number. Verify the SARS approval letter, permitted public-benefit activities and current receipt requirements.

9. Create one board evidence pack

A practical compliance pack should allow a new treasurer, auditor or adviser to trace each conclusion without reconstructing the organisation from email. Include:

1. a legal-form and regulator map;
2. current founding documents;
3. office-bearer and control records;
4. approval letters and filing acknowledgements;
5. the annual compliance calendar;
6. bank mandates and authority limits;
7. a programme, country and funds-flow map;
8. Schedule 1 and sanctions decisions; and
9. board review, remediation owners and due dates.

The commercial law checklist can help organise wider governance dependencies. Use the commercial lawyer route when the legal-form, control, contract or FIC classification needs advice.

Warning signs for board escalation

Escalate rather than regularise informally where:

• cross-border donations or services exist but NPO Act registration has not been tested;
• the organisation's bank signatories do not match current office-bearers;
• an NPC's annual return is blocked by beneficial-ownership filing;
• a trust's record with the Master is incomplete or stale;
• a new service could fall within Schedule 1;
• a donor, beneficiary or partner produces a possible sanctions match;
• payments are split, rerouted or refunded without a documented programme reason;
• section 18A receipts are issued without confirmed approval; or
• DSD, CIPC, the Master, SARS and internal records identify different controllers.

The response should preserve records, stop unauthorised changes, identify the governing authority and assign a dated corrective action. It should not conceal a missed filing or create backdated evidence.

Questions to put to an adviser or compliance reviewer

1. What is the organisation's exact legal form, and which registrations are additional rather than substitutive?
2. Is NPO Act registration compulsory because of cross-border donations or services?
3. Which office-bearer, control and operational information must be current with DSD?
4. Who are the relevant natural persons for the NPC or trust beneficial-ownership record?
5. Does any current or planned activity fall within a Schedule 1 category?
6. Which FIC reports could arise on these facts, and who may decide and submit them?
7. Which counterparties and transactions justify current sanctions screening?
8. What corrective filing, resolution, control or legal opinion is required, and by when?

Sources and review note

This article was checked on 21 July 2026 against the Nonprofit Organisations Act and its 2022 amendments, the government's NPO registration service, Department of Social Development compliance notices, CIPC beneficial-ownership guidance, the Department of Justice trust register guidance, current FIC accountable-institution, reporting and targeted-financial-sanctions material, SARS PBO guidance and FATF Recommendation 8 best practices. NPO registration scope, prescribed information, legal-form control tests, Schedule 1 classification, reporting, sanctions matches, tax approvals and corrective steps require source/legal review on the organisation's facts before reliance.

FAQs

Related Lexuno paths