Working MVP · IFWG Regulatory Sandbox applicant

Prove your FICA
programme works,
on demand.

Fintegris is being built to link every requirement in your RMCP to the controls that run it and the evidence they produce, across all your compliance providers. When the FIC, the FSCA or your bank asks, you answer in hours, not weeks.

Register Interest → See the Platform

Built on

AWS af-south-1 (Cape Town) Client identifiers never sent to AI POPIA-aligned by design Aligned to FIC GN 7B (Aug 2026)
IFWG Sandbox Applicant
Platform Overview
Six Compliance Modules
AI-Native
Module 01
RMCP Management
AI-drafted, GN 7B–structured, officer-reviewed and board-approved
Module 02
Regulatory Reporting
FSCA and FIC returns tracked, pre-populated and authorised
Module 03
CDD & Onboarding
Identity, beneficial ownership, PEPs and risk rating
Module 04
Screening & Monitoring
TFS, PEP and adverse-media screening; STR, CTR and TPR preparation
Module 05
Compliance Operations
Calendar, incidents, representatives, debarment, fit-and-proper, suitability records
Module 06
Regulatory Intelligence
Cited source library grounding every AI draft
6
Integrated modules
af-south-1
Platform hosting
0
Client identifiers sent to AI
1
Evidence trail across providers
The enforcement reality

The FSCA is not waiting.

Administrative penalties rose from R119.8 million in 2024/25 to R2.89 billion in 2025/26. A handful of major cases drove most of that increase, but FAIS, market-abuse and FIC Act contraventions made up the bulk of the year's penalties.

Source: FSCA Regulatory Actions Report 2025/26 (31 July 2026)

R2.89bn
Administrative penalties across 62 cases in 2025/26
R20.05m
Penalties for FIC Act contraventions
31 Oct 2026
CASPs' first RMCP submission to the FIC (Directive 12)
What inspectors find

Written is not implemented.

Every FIC Act sanction the FSCA listed for 2025/26 cited a failure to develop, document, maintain and implement an RMCP. The FIC's own 549 inspections most often found RMCP gaps, weak CDD on legal entities and PEPs, and no evidence of sanctions screening. Sanctioned firms are published by name.

Source: FIC Annual Report 2025/26 (sanctions tables and inspection findings)

10 of 10
FSCA FIC Act sanctions and appeals listed that cite the RMCP, including how it is implemented
5 of 10
Cite failure to screen clients against the targeted financial sanctions lists
R37m
Prudential Authority FIC Act sanctions on two banks and a life insurer, including late attention to monitoring alerts
The problem

Most compliance tools help you do the work. Few help you prove it.

Crypto asset service providers, credit providers, investment platforms and asset managers run identity checks, screening, wallet analytics and transaction monitoring through several specialist providers. Each keeps its own records. When an inspector or a bank asks for evidence, the compliance team rebuilds the story by hand, and the RMCP written for the licence application has often drifted from what the business actually does.

⚖️
RMCP deficiencies keep attracting sanctions
FIC Guidance Note 7B (3 August 2026) requires an entity-wide ML/TF/PF risk assessment before controls are set, and a detailed, firm-specific RMCP approved by the board or senior management (FIC Act s.42, s.42A). Generic templates do not meet this standard, and an RMCP that is not linked to running controls drifts from practice.
On 9 September 2026 the FSCA sanctioned three FSPs for FIC Act failures — including deficient RMCPs, CDD and sanctions screening — with penalties of R100 000 – R450 000.
📋
Statutory returns are multiplying
FSPs file compliance reports and audited financial statements with the FSCA (FAIS Act ss.17, 19), and the FSCA is consulting on a new, more detailed OMNI-Risk Return. CASPs and some other accountable institutions also file the FIC Risk and Compliance Return (Directive 11) and now submit their RMCPs to the FIC annually (Directive 12).
Directive 12: CASPs' first RMCP submission is due 31 October 2026 (FIC, 4 September 2026)
🔍
Evidence is scattered across providers
There is no retrospective compliance: CDD, beneficial-ownership verification (s.21B, PCC 59), PEP measures (ss.21F–21H) and sanctions screening (ss.26A–26C) must be completed and evidenced at the required stage. Institutions using automated monitoring must also attend to every alert within 48 hours and show oversight of their rules (Directive 5).
FIC inspections keep finding a lack of evidence of client screening against the targeted financial sanctions list (FIC Annual Report 2025/26)
The platform

Six modules. One evidence trail. Built to sit above the tools you already use.

Fintegris is being built as a cloud-native compliance platform for South African accountable institutions with real onboarding and transaction volumes. It keeps your RMCP current and links each requirement to the control that runs it, the provider that performs it and the evidence it produces, in auditable workflows mapped to specific statutory provisions. It is designed to complement your identity, screening, monitoring and Travel Rule providers, not replace them. All six modules run today in a demonstration environment on synthetic data. Simulated in demo marks steps shown end to end that do not yet connect to a live regulator system; Planned marks the few capabilities not yet in the demo.

AI-Assisted
Module 01
RMCP Management
AI drafts an institution-specific Risk Management and Compliance Programme from its business profile: its Schedule 1 category and licence or registration, products and services, clients, delivery channels and geographic exposure. It follows the GN 7B sequence: risk assessment first, then mitigation, then governance. Each section cites its sources, and the compliance officer reviews every section before it goes to the board or senior management for approval (FIC Act s.42A). When new guidance is published, Module 06 flags the RMCP sections it affects for review and re-approval. Each RMCP control is linked to the module, provider and evidence that implement it, so drift shows up before an inspection does Planned.
Built againstFIC Act s.42, s.42A · GN 7B · PCC 53 · PCC 54 (proliferation financing) · Directive 12 (RMCP submission, where applicable)
Prevents: generic or undocumented RMCPs and programmes that don't match actual practice
Module 02
Regulatory Reporting
Tracks each institution's statutory returns and deadlines and pre-populates them from platform data for authorisation by the responsible officer. For FSPs that means the FAIS compliance report and audited financial statements, with the FSCA's OMNI-Risk Return to follow once it is finalised. For CASPs and other applicable institutions it adds the FIC Risk and Compliance Return and the annual RMCP submission. Filing to the FSCA ePortal and the FIC reporting platform is demonstrated end to end; the live submission method will be confirmed with each regulator Simulated in demo.
Built againstFAIS Act ss.17, 19 · FSCA OMNI-Risk Return (in consultation) · FIC Directives 10, 11 & 12 · PCC 60
Prevents: late, missing or inconsistent statutory returns
AI-Assisted
Module 03
CDD & Onboarding
Risk-based customer due diligence. Identity is verified through a South African identity provider (Home Affairs, face-match, liveness and bank-account verification), and for companies CIPC registration and directors are checked and the natural persons behind the entity are mapped as beneficial owners Simulated in demo. PEPs, close associates and high-risk clients go to enhanced due diligence with senior-management approval. A transparent rules engine rates risk today; an explainable XGBoost model with SHAP attributions is coming Planned. A named officer makes every onboarding decision.
Built againstFIC Act ss.21–21H · GN 7B · PCC 59 (beneficial ownership) · PCC 51 (foreign and domestic PEPs) · POPIA ss.26–27 (biometrics)
Prevents: incomplete, late or undocumented CDD and beneficial-ownership gaps
AI-Assisted
Module 04
Screening & Monitoring
Screening through specialist providers against UN Security Council targeted financial sanctions (as published on the FIC TFS list), PEP data and adverse media Simulated in demo. A confirmed sanctions match is a hard stop. The platform prepares STRs, CTRs and terrorist property reports as goAML XML, and the compliance officer (MLRO) must authorise every report before it is filed Simulated in demo. Ongoing re-screening is scheduled on the compliance calendar. Coming next: every screening kept as its own record with the FIC list version and time, proof that the whole book was re-screened after each list change, alert-handling and closure-quality logs against Directive 5, and evidence capture from your transaction-monitoring, wallet-analytics and Travel Rule providers Planned.
Built againstFIC Act ss.26A–26C, 28, 28A, 29 · GN 4B, 5C, 6A · PCC 44A · Directive 5 (automated monitoring) · Directive 9 & PCC 61 (Travel Rule)
Prevents: TFS screening failures and late or poor-quality regulatory reports
Module 05
Compliance Operations
A compliance calendar that pulls deadlines from every module. Incident and breach management, and document control. A representative register with debarment workflow, fit-and-proper and CPD tracking, and suitability and record-of-advice capture. Employee screening, plus a tamper-evident, hash-chained audit trail of every generation, review and approval event.
Built againstFAIS Act ss.13, 14, 18 · General Code of Conduct s.3A (conflicts), s.7 (disclosure), s.8 (suitability), s.9 (record of advice) · Fit & Proper Requirements (BN 194 of 2017) · FIC Directive 8 & PCC 55
Prevents: procedural gaps, missing evidence and unmanaged representative risk
Module 06
Regulatory Intelligence
A curated, versioned library of primary regulatory sources that grounds every AI-generated draft with citations. Superseded instruments are flagged; GN 7A, for example, is marked as replaced by GN 7B. Material-change notifications show which RMCP sections each new FSCA, FIC, SARB/PA or Information Regulator publication affects, for compliance-officer review. A documented content-governance process keeps the library current: weekly source monitoring, materiality assessment, automated ingestion and quarterly reconciliation.
Primary sourcesfic.gov.za (Act, guidance notes, directives, PCCs) · FSCA · Information Regulator · tabled CoFI Bill
Prevents: working from superseded guidance and missing new obligations

Simulated in demo = shown end to end, not yet connected to the live regulator system. Planned = designed, not yet in the demonstration environment.

See Fintegris in action

Request access to our demonstration environment. It runs on synthetic data only, and access is arranged after a short call with our team.

Request a demo →
Why Fintegris

Purpose-built for South Africa. Not adapted from somewhere else.

Many international and domestic platforms handle a piece of South African compliance: identity, screening, onboarding or monitoring. Fintegris is designed to prove the whole programme, from first principles for this regulatory environment, and is candid about where the boundaries are.

🇿🇦
South African regulatory framework, not an import
Workflows and citations are built against the FIC Act and its regulations, FIC guidance notes, directives and PCCs, the FAIS Act and Codes, POPIA, and Joint Standards 1 of 2023 and 2 of 2024. The FIC's own website is the primary source for every FIC instrument.
🔒
Hosted in South Africa, with a hard PII boundary
The platform and its data stores run in AWS af-south-1 (Cape Town). Client identifiers are masked before storage and never reach the AI layer, which is what allows AI inference through Amazon Bedrock without sending personal information across borders. Sanctions and PEP screening is designed to run through a South African provider, processed in South Africa. Adverse-media screening and transaction monitoring use an offshore specialist provider; those calls are cross-border transfers, sent with minimised fields under a documented POPIA s.72 basis.
🤝
Human-in-the-loop, always
No AI output becomes an RMCP, onboarding decision or regulatory report without authorisation by a named officer in the right role. The review gates are part of the architecture and cannot be switched off. They respect POPIA s.71 on automated decision-making and the institution's own accountability under the FIC Act and FAIS.
📊
Explainable, and measured for oversight
Every AI-drafted RMCP section shows its sources. The platform tracks how often reviewers amend or flag AI output, so that rubber-stamping is visible rather than hidden. SHAP explainability and fairness testing come with the risk model Planned. The approach follows the FSCA and Prudential Authority's November 2025 report on AI in the South African financial sector.
💰
Works with the providers you already use
Fintegris is designed to sit above your identity, screening, wallet-analytics, Travel Rule and transaction-monitoring providers, collecting their results into one inspection-ready record, rather than asking you to replace them.
🔗
Designed to connect to South African systems
Integrations are planned with the FSCA ePortal for filings, the FIC reporting platform (goAML) for STR, CTR and TPR submissions, CIPC for beneficial ownership, and South African identity providers for Home Affairs checks. Submission modes will be confirmed with each regulator.
Regulatory framework

The instruments Fintegris is built against.

The legislation, guidance and standards that shape the platform's workflows and citations. FIC instruments are taken from the FIC's own lists of guidance notes, directives and PCCs.

FIC Act & Regulations
fic.gov.za ↗
  • Financial Intelligence Centre Act 38 of 2001, as amended in 2017 and by the General Laws (AML/CFT) Amendment Act 22 of 2022
  • Key sections: ss.21–21H (CDD, beneficial ownership, PEPs) · ss.22–23 (records) · ss.26A–26C (TFS) · s.28 (CTR) · s.28A (TPR) · s.29 (STR) · s.42–42A (RMCP & governance) · s.43B (registration)
  • Money Laundering and Terrorist Financing Control Regulations, including reporting periods and the R49 999,99 cash threshold
  • Schedule 1 — item 11 (credit providers), item 12 (FSPs) and item 22 (CASPs)
FIC Guidance Notes
fic.gov.za ↗
  • GN 7B — Implementation of various aspects of the FIC Act (3 August 2026)Current · replaces GN 7 and GN 7A
  • GN 4B — Reporting suspicious and unusual transactions (s.29)
  • GN 5C — Submitting cash threshold reports (s.28)
  • GN 6A — Terrorist property report obligations (s.28A)
FIC Directives
fic.gov.za ↗
  • Directive 12 — Submission of RMCPs (4 September 2026)New
  • Directive 10 — Information on geographic locations (31 July 2026)
  • Directive 11 — Risk and compliance return 2026
  • Directive 9 — Travel Rule for crypto asset transfers
  • Directive 8 of 2023 — Screening of employees
  • Directive 5 of 2019 — Automated transaction monitoring systems
  • Directive 3A — Notification of failure to report
FIC Public Compliance Communications
fic.gov.za ↗
  • PCC 53 RMCPs · PCC 54 Proliferation financing · PCC 59 Beneficial ownership
  • PCC 51 Foreign and domestic PEPs · PCC 44A Targeted financial sanctions
  • PCC 12A Outsourcing to third parties · PCC 22A Information processing under the FIC Act
  • PCC 55 Employee screening · PCC 61 Travel Rule · PCC 60 2026 RCR
  • PCC 25 FSP scope · PCC 57 Crypto asset service providers
FAIS & conduct
FSCA
  • FAIS Act 37 of 2002 — s.13 (representatives) · s.14 (debarment) · s.17 (compliance officers) · s.18 (maintenance of records) · s.19 (accounting and audit)
  • General Code of Conduct (BN 80 of 2003, as amended) — s.3 (specific duties, incl. 5-year record keeping) · s.3A (financial interest and conflict of interest management) · s.7 (information about the financial service) · s.8 (suitability) · s.9 (record of advice)
  • Fit and Proper Requirements (BN 194 of 2017)
  • Crypto assets declared a financial product under FAIS (FSCA, October 2022)
  • FSCA OMNI-Risk Return — in consultation (FSCA Communication 19 of 2025); pilot timing still to be confirmed
Data, technology & AI
IR · FSCA · PA
  • POPIA (Act 4 of 2013) — s.18 (notification) · s.19 (security) · ss.20–21 (operators) · s.22 (breaches) · ss.26–27 (special personal information) · s.71 (automated decisions) · s.72 (cross-border transfers)
  • Joint Standard 1 of 2023 — IT governance and risk management (in force 15 November 2024, for institutions in scope)
  • Joint Standard 2 of 2024 — Cybersecurity and cyber resilience (in force 1 June 2025; applies to specified FSPs, including discretionary and administrative FSPs)
  • FSCA/PA report — AI in the South African financial sector (November 2025)
  • Monitoring: CoFI Bill (tabled April 2026) · draft General Laws (AML/CFT) Amendment Bill (2026) · planned Joint Standards on cloud/offshoring and outsourcing

Last reviewed 15 October 2026. This list describes the instruments the platform is designed around; it is not legal advice and does not replace an institution's own compliance assessment. Spotted an update? Tell us.

Regulatory engagement

Seeking regulatory clarity before going to production.

Fintegris applied for the IFWG Regulatory Sandbox in July 2026. We are asking the FSCA, FIC and SARB/PA for guidance on three specific questions before the AI-assisted modules go into commercial use. The order is deliberate. It avoids costly re-architecture after a determination, and it lets regulators shape responsible AI adoption in financial-sector compliance rather than ratify it after the fact.

FSCA · FIC Act s.42 / GN 7B
Does a board-approved, AI-assisted RMCP satisfy the requirement for a firm-specific, risk-based compliance programme?
Submitted with reference to GN 7A, which GN 7B replaced on 3 August 2026.
FIC · FIC Act ss.28 & 29
Does AI-assisted STR/CTR pre-population, with mandatory MLRO review before submission, satisfy the reporting obligations?
SARB / Prudential Authority · FIC Act s.21
What minimum AI governance standards apply when an FSP relies on an explainable AI risk-classification model for CDD?
Development timeline
✓
July 2026
IFWG Sandbox application submitted
Conceptual architecture, governance documentation, AI Fact Sheet, Shared Responsibility Matrix and POPIA PIA completed.
✓
September 2026
Demonstration environment live
All six modules running on synthetic data in af-south-1. No live client data is processed.
🤝
Now
Design partners sought
We are looking for a small number of accountable institutions (crypto asset service providers, credit providers, investment platforms and asset managers) to shape the product as design partners. Technology, cloud and compliance-services firms can talk to us about partnering.
⚙
Next
Production build & Sandbox testing
Production hardening, the XGBoost/SHAP risk model and regulator integrations. AI applications tested with pilot institutions, subject to the IFWG determination.
🚀
Then
Commercial launch
Subject to regulatory determinations. Sold directly to institutions and through AWS Marketplace and AWS co-sell, with technology and services partners.
Technology

Cloud-native. AI-governed. Secure by design.

Built on AWS in Cape Town, with a layered AI architecture designed around South African data-protection and AI-governance expectations. Dotted tags are simulated in the demo; dashed tags are planned.

☁️
AWS af-south-1
Production architecture in the AWS Cape Town region: private VPC subnets, KMS encryption at rest, TLS in transit, MFA-protected access, WAF and CloudTrail logging. Audit events are hash-chained so tampering is evident, with WORM retention on S3 Object Lock. Designed with Joint Standards 1 of 2023 and 2 of 2024 in mind.
ECS Fargate RDS PostgreSQL S3 Object Lock CloudWatch AWS KMS
🤖
AI Architecture
Anthropic's Claude, via Amazon Bedrock, drafts RMCP sections from a cited regulatory library, and PII is stripped before any inference call. Bedrock may serve requests through cross-Region inference, which is why the PII boundary, not the model's location, is what protects client data. Planned: a self-hosted open model inside the VPC for sensitive text, and an XGBoost risk model with SHAP explainability.
Claude via Amazon Bedrock RAG with citations Llama 3.1 8B (VPC) XGBoost + SHAP Fairness testing
🔗
Integrations
Designed to connect to South Africa's regulatory and identity systems within POPIA's data-minimisation requirements, with role-based access control and field-level protection for personal information. Regulator submission modes are to be confirmed with the FSCA and the FIC.
SA identity verification Sanctions & PEP screening CIPC FSCA ePortal FIC goAML
Get involved

Help shape the evidence layer for FICA compliance.

We are looking for design partners among crypto asset service providers, credit providers, investment platforms and asset managers for the pilot during the IFWG Sandbox testing period. If proving your FICA programme to an inspector or your bank takes too long, or you'd like to see the demo, we'd like to hear from you. Technology, cloud and compliance-services firms can talk to us about partnering.

Protected by reCAPTCHA (Google Privacy & Terms).

Privacy notice (POPIA s.18)

Who we are: Didusec (Pty) Ltd (reg. 2014/111799/07), 57 Sloane Street, Bryanston, Sandton, is the responsible party for this form.

What and why: we collect your name, work email, company and message only to respond to your enquiry about Fintegris. Providing them is voluntary, but we cannot reply without an email address.

Who processes it: submissions are relayed by our form provider (Web3Forms), and Google reCAPTCHA assesses bot risk. Both services operate outside South Africa, so sending the form is a cross-border transfer of your personal information. We rely on your consent for it (POPIA s.72(1)(b)), which you give by ticking the separate cross-border box. Without that tick the form is not sent and reCAPTCHA is not loaded; you can email [email protected] instead.

Your rights: you may ask for access to, correction of or deletion of your information, or object to its processing, by emailing [email protected] (attention: Information Officer). You may also complain to the Information Regulator (inforegulator.org.za).

Or contact us directly: [email protected] · A product of Didusec (Pty) Ltd, AWS APN Partner