Capitec fined R28m over compliance gaps

Capitec fined R28m over compliance gaps after the Prudential Authority (PA) imposed financial penalties on the bank following an inspection that identified shortcomings in its compliance with the Financial Intelligence Centre Act (FICA).

The South African banking regulator imposed a total of R28 million in financial penalties on Capitec Bank after identifying deficiencies across several areas of its financial crime compliance framework.

The findings relate to an inspection conducted in 2023 and include shortcomings involving customer due diligence, enhanced due diligence, ongoing due diligence, employee training and the bank’s broader risk management and compliance programme.

The development places renewed attention on the importance of effective anti-money laundering systems within South Africa’s financial sector.

Capitec Bank faces Prudential Authority sanctions

The latest action against Capitec Bank follows an inspection by the Prudential Authority into the bank’s compliance with FICA requirements.

The PA found that the bank did not adequately perform certain customer due diligence procedures on sampled client files. Customer due diligence is an important part of banking compliance because financial institutions are required to understand who their customers are and assess potential financial crime risks.

The regulator also identified weaknesses in enhanced and ongoing due diligence.

Enhanced due diligence involves additional checks where customers, transactions or relationships may present higher risks. Ongoing due diligence requires banks to keep customer information and risk assessments updated as circumstances change.

The findings therefore covered several stages of the customer relationship rather than being limited to one isolated compliance process.

R28 million fine breakdown

The R28 million fine consists of five separate financial penalties imposed by the Prudential Authority.

The largest penalty is R10 million for inadequate customer due diligence.

A further R5 million penalty relates to inadequate enhanced due diligence, while another R5 million was imposed over shortcomings in ongoing customer due diligence.

Capitec was also fined R3 million for employee training deficiencies.

The final R5 million penalty relates to weaknesses in the bank’s risk management and compliance programme.

Together, these penalties amount to R28 million.

However, the full amount is not immediately payable under the conditions attached to the sanctions.

Of the R28 million, R5.5 million has been conditionally suspended for 36 months from 13 October 2025. The suspended portion is linked to the relevant contraventions and the bank’s compliance with the conditions imposed by the regulator.

The structure means Capitec faces a significant financial penalty while also being given a regulatory incentive to ensure that the identified shortcomings are not repeated.

Prudential Authority highlights FICA compliance breaches

The Prudential Authority identified several areas of concern involving FICA compliance breaches.

Among the findings were weaknesses in the bank’s risk management and compliance programme, including controls relating to terrorist property reporting and financial sanctions.

The regulator also found shortcomings involving sanctions screening and the screening of prominent influential persons.

In addition, Capitec had not obtained the necessary management approval for certain anti-money laundering name-screening and payment-screening investigation manuals before they were implemented, according to reporting on the PA findings.

The regulator also found that the bank could not provide evidence that it had properly documented and approved end-to-end processes for terrorist property reporting before receiving notification of the inspection.

These findings demonstrate why financial institutions are required to maintain detailed compliance systems capable of identifying and managing financial crime risks.

Anti-money laundering controls under scrutiny

The latest action has placed anti-money laundering controls at the centre of the regulatory response.

Banks are expected to have systems that can identify suspicious activity, screen customers and transactions against relevant sanctions and manage risks associated with money laundering and terrorist financing.

In Capitec’s case, the PA identified shortcomings in several of these areas.

The regulator’s findings included deficiencies in name screening, payment screening, terrorist property reporting and financial sanctions controls.

These controls are particularly important because banks form a major part of the financial system and can potentially be exposed to transactions involving proceeds of crime or other unlawful financial activity.

Effective compliance therefore requires more than simply opening accounts and processing transactions. Financial institutions must continuously monitor risks and ensure that employees understand their regulatory responsibilities.

Capitec says it cooperated with regulator

Capitec has cooperated with the Prudential Authority during the regulatory process and has taken steps to address the deficiencies identified during the inspection.

The bank’s cooperation is important because the sanctions do not represent a finding that Capitec itself was involved in money laundering or other criminal activity.

Rather, the penalties relate to shortcomings in the systems and processes required to comply with FICA.

The distinction is significant.

Regulatory compliance failures can occur when an institution does not meet prescribed requirements for customer checks, monitoring, reporting, staff training or risk management, even where there is no finding that the institution itself participated in criminal conduct.

The PA’s action is intended to reinforce the importance of maintaining effective controls and ensuring that identified weaknesses are corrected.

Capitec Bank faces renewed compliance pressure

The latest Capitec Bank penalty is also notable because it follows an earlier regulatory sanction.

According to reporting on the latest case, Capitec received a separate R56.25 million FICA-related penalty in 2024 following inspections conducted in 2021 and 2022. Those earlier findings involved compliance failures across parts of the bank’s retail and business banking operations.

The latest R28 million sanction therefore adds to the regulatory scrutiny facing one of South Africa’s largest retail banking groups.

For customers, the development does not mean that their deposits or everyday banking services have been declared unsafe.

Instead, it highlights the importance of banks continuously strengthening their compliance infrastructure as financial crime risks evolve.

What the R28 million penalty means

The R28 million fine illustrates how seriously regulators view weaknesses in FICA compliance.

The penalties cover customer due diligence, enhanced due diligence, ongoing due diligence, employee training and broader compliance controls.

The five separate penalties also demonstrate that effective financial crime compliance depends on multiple interconnected processes.

A bank may have strong systems in one area but still face regulatory action if other elements of its compliance framework are inadequate.

The conditional suspension of R5.5 million provides another important element of the sanction. Capitec will need to maintain compliance with the conditions attached to the suspended amount during the 36-month period.

YOU MAY LIKE:

Ramaphosa orders SIU probe into Suliman Carrim

DA wants SIU probe into PIC’s investment in Daybreak Foods

FICA compliance remains critical for South African banks

The case involving Capitec fined R28m over compliance gaps comes as South African financial institutions remain under significant pressure to strengthen their anti-money laundering and financial crime controls.

The Financial Intelligence Centre Act provides a framework for preventing and detecting financial crimes, while the Prudential Authority supervises compliance within the banking sector.

The latest Capitec sanction shows that regulators continue to examine whether banks have appropriate procedures, employee training and risk management systems in place.

For Capitec, the focus now turns to remediation and ensuring that the shortcomings identified during the 2023 inspection are fully addressed.

The bank says it has already taken steps to correct the deficiencies.

The Prudential Authority’s action serves as a reminder that compliance is an ongoing responsibility for financial institutions and that weaknesses in customer due diligence, reporting, screening or risk management can result in significant financial and regulatory consequences.

As South Africa continues strengthening its financial crime controls, banks will remain under pressure to ensure that their systems meet regulatory requirements and that employees are properly trained to identify and manage potential risks.

For customers and the wider financial sector, the Capitec case highlights the importance of strong safeguards designed to protect the integrity of South Africa’s banking system.