Discovery Bank's R3m fine highlights FICA compliance vigilance needed after greylisting

Discovery Bank's recent penalty of R3 million for serious failures in compliance with the Financial Intelligence Centre Act (FICA) serves as a stark reminder that South African institutions cannot afford to become complacent following the country's removal from the Financial Action Task Force (FATF) greylist.

This opinion comes from Hawken McEwan, Director of Risk & Compliance at nCino KYC Africa, who warns that regulatory scrutiny is intensifying.

"South Africa’s removal from the greylist was a hard-won victory, but it was not a finish line," McEwan emphasised, underscoring the necessity for ongoing diligence.

"This fine proves that our own regulators are just as vigilant as ever. The era of domestic enforcement is just beginning, and this penalty is a R3 million wake-up call for every accountable institution, not just banks."

The Prudential Authority’s investigation unveiled significant shortcomings in Discovery Bank's FICA compliance framework.

Key findings pointed to issues such as the mismanagement of 2,281 automated transaction alerts and unacceptable delays in reporting suspicious transactions.

Furthermore, gaps were noted in FICA training for both new employees and senior management, raising questions about the adequacy of internal processes.

"What’s revealing is that these are failures of process and operational hygiene," McEwan stated.

"The PA found delayed alerts and a lack of training, which illustrates that simply having a monitoring system in place is not sufficient. Regulators are asking if the system is effective and if the personnel using it are adequately trained. If not, it’s a liability."

This cautionary tale extends beyond the banking sector, with McEwan urging all accountable institutions—including law firms, estate agents, and dealers of high-value goods—to reflect on their own compliance protocols.

"This penalty should serve as a checklist for their operations, specifically regarding documentation, training, and the effective management of automated alerts," he advised.

McEwan further said, "Box-ticking compliance is dead. The new baseline is provable, end-to-end compliance, from the risk management and compliance programme (RMCP) to real-time monitoring and mandatory training for everyone." This evolving landscape demands a proactive approach, reinforcing the need for a robust compliance culture in the wake of increasing regulatory scrutiny.

BUSINESS REPORT