Last updated: 27 October 2026. Written by Ritesh Kanjee, director of Augmented AI Automations.
FICA verification is how an accountable institution establishes who a new client is and confirms it against reliable, independent sources before taking them on. South African firms automate it by collecting documents through one secure link, extracting the details with AI, matching them to trusted sources and sanctions lists, and sending only exceptions to a compliance officer.
This guide is for attorneys, accountants who act as trust and company service providers, and financial services teams who still chase FICA documents by email. It draws on the document workflows we build at Augmented AI Automations, including a forms pipeline for Momentum. It explains the workflow, not the law, so your own compliance programme and supervisory body have the final say.
What is FICA verification, and who has to do it?
FICA verification is the customer due diligence step of the Financial Intelligence Centre Act, 2001 (Act 38 of 2001). Section 21 requires an accountable institution to establish and verify the identity of a client, and of anyone acting for the client, when it starts a business relationship or a single transaction (FIC, Revised Guidance Note 7A, 1 September 2025).
Accountable institutions are listed in Schedule 1 of the Act. The list was widened with effect from 19 December 2022, and attorneys, conveyancers and notaries practising for their own account are on it (Government Gazette amendment of Schedules 1, 2 and 3). Accountants, and any other professional, are covered when they act as trust and company service providers, for example by registering companies or managing trusts for clients (FIC, PCC 6A on trust and company service providers). Banks, insurers, financial advisers and estate agents are listed too.
The pressure has not eased since South Africa left the FATF grey list on 24 October 2025. National Treasury says the next FATF mutual evaluation is expected to run from 2026 to October 2027 and will test whether controls actually work (National Treasury statement, 24 October 2025).
Which FICA verification documents do firms ask for?
There is no single fixed list in law. Most of the old regulations that prescribed identification methods were repealed, so each institution now chooses what information it collects and how it verifies it, based on risk, and describes that in its risk management and compliance programme, or RMCP (FIC, Guidance Note 7A, paragraph 84). That is why two firms can ask the same client for different documents.
The Centre's guidance still sets a clear baseline. The table shows what it describes for the two most common client types.
| Client type | Basic identity details | Typical sources used to verify them |
|---|---|---|
| South African individual | Full names, date of birth and identity number | Green ID book or smart ID card, driver's licence, or the government databases behind them |
| Foreign individual | Full names, date of birth and passport or permit number | Passport, asylum seeker or refugee permit, work permit or visa |
| Company or close corporation | Registered name, form, registration number, registered address, directors and senior management | Registry records and company documents, plus the people who own or control it |
| Extra details, if your risk rules need them | Residential address, tax number, employer, contact details | Utility bill, bank statement or electronic data sources, as set in your RMCP |
Two points matter for automation. Information created by the client is not an independent source, and government sources give the highest confidence for basic identity details (Guidance Note 7A, paragraphs 87 and 88). If you are a client being asked for documents, the firm's own RMCP decides the list, so ask them which items they need.
Why does manual FICA onboarding slow firms down?
Manual onboarding turns every new client into a chain of emails, follow-ups and retyping. A paralegal or junior accountant requests documents, waits, finds a blurred ID copy or an old statement, asks again, then keys the details into a file and a register. The work is repetitive, and the risky part is that a gap in the file can sit unnoticed until an inspection.
The FIC's own guidance shows how much each file has to hold. Beyond identity, the institution must assess client-level risk before the relationship starts, screen every prospective client against targeted financial sanctions lists, identify politically exposed persons and keep the records for at least five years after the relationship ends (FIC, Reference guide for all accountable institutions, December 2022, and FIC on drafting an RMCP, 8 July 2025). Sanctions screening under section 28A is not risk-based, so it applies to every client.
In the document projects we run, the time goes on the same three things: chasing missing items, reading the same fields off different layouts, and copying them between systems. Those are exactly the steps software handles well.
How do you automate FICA document checks step by step?
Automate the collecting, reading and matching, and keep every judgement call with a person. A workable flow has six steps, and each one leaves a record in the client file.
- Collect: the client receives one secure upload link with a checklist built from your RMCP, and the system sends polite reminders until every item is in.
- Read: AI document extraction pulls names, ID numbers, registration numbers, dates and addresses from scans and photos, and flags blurred or expired documents.
- Verify: extracted details are compared with the independent sources your RMCP approves, such as identity verification services or company registry records.
- Screen: every new client and related party is checked against the targeted financial sanctions lists, and possible matches are held for review.
- Rate risk: the system applies your client risk matrix to suggest a rating, and anything high-risk goes to the compliance officer for enhanced due diligence.
- Record: documents, results and approvals are filed together with dates, so the file can be reproduced on request.
This is the same pattern we used for Momentum, where staff had been reading scanned forms and typing the data into legacy systems. The pipeline captures each document, extracts the fields with AI, validates them against business rules and existing records, and sends anything uncertain to a person (read the Momentum case study). That project was forms processing, not FICA, but the capture, extract, validate and exception steps carry straight over.
What should a person still check?
A person should own every decision that the law or your RMCP treats as judgement. The Centre is explicit that using electronic verification does not move responsibility away from the institution, and that it must apply due diligence when it chooses an electronic solution (Guidance Note 7A, paragraph 90).
| Task | Automate it? | Why |
|---|---|---|
| Requesting and chasing documents | Yes | Pure follow-up with a fixed checklist |
| Reading fields from IDs and company documents | Yes, with review of low-confidence reads | AI extraction is fast but not perfect on poor scans |
| Matching details to independent sources | Yes | Rule-based comparison that leaves a clear trail |
| Clearing a possible sanctions or politically exposed person match | No | Needs a trained person to confirm or escalate |
| Approving high-risk clients and enhanced due diligence | No | Senior sign-off and context the system does not have |
| Deciding whether to file a suspicious transaction report | No | A legal judgement that stays with your compliance function |
Keep personal information access-limited and stored in South Africa where your policies require it. Anyone you outsource part of the process to still leaves the compliance obligation with you, according to the FIC reference guide.
How do you measure whether FICA automation is working?
Measure how long onboarding takes and how complete the files are, starting the week before you switch anything on. If clients are onboarded faster and fewer files need rework, the workflow is doing its job.
| Metric | How to calculate it | What good looks like |
|---|---|---|
| Days to complete onboarding | Date the file is approved minus the date documents were first requested | Falling month on month |
| Files complete first time | Files with no missing or rejected items / all new files | Rising month on month |
| Staff minutes per file | Time logged on a sample of 10 files | Spent mostly on exceptions and high-risk clients |
| Exceptions rate | Files sent to a person / all new files | Stable, and every exception has a recorded outcome |
The baseline matters more than the tool. Without it, nobody can show whether the automation saved time, and that number is what justifies extending it to ongoing monitoring and periodic reviews.
What to do next
Pull your last 10 new client files and note, for each one, how many days it took and how many times you had to ask for a document. Then check which steps your RMCP already defines clearly, because those are the ones you can automate first. For related workflows, read our guides to AI for South African law firms, tasks accountants can automate and turning bank statement PDFs into Excel.
If you want FICA onboarding scoped for your firm, see how we deliver AI automation in Johannesburg and across South Africa, then book a call with Augmented AI Automations.
