Prudential Authority Imposes R35.6m in FICA Sanctions on Capitec, Ninety One and Albaraka

The Prudential Authority (PA), the arm of the South African Reserve Bank responsible for enforcing compliance with the Financial Intelligence Centre Act 38 of 2001 (FICA), announced on 11 September 2026 that it had imposed a combined R35.6 million in financial penalties on Capitec Bank, Ninety One Assurance, and Albaraka Bank. We verified every figure below directly against the PA's three published media releases.

Of the combined penalty, R8.44 million was conditionally suspended for 36 months, meaning it becomes payable only if the relevant institution repeats the non-compliant conduct within that period. The PA also imposed 10 cautions not to repeat the conduct and two reprimands across the three matters. All three institutions cooperated with the PA; Capitec and Albaraka have remediated the identified deficiencies, while Ninety One says it has undertaken the required remedial action.

The inspections underlying these sanctions took place between 2021 and 2023, well before this week's announcement, because the PA's process runs from inspection through a right-to-be-heard process to a final sanction, which can take years.

Capitec received the largest penalty, R28 million, of which R5.5 million is conditionally suspended for 36 months from 13 October 2025, plus five cautions. The sanctions follow a 2023 inspection.

• R10m (R3m suspended) for inadequate customer due diligence on sampled client files, contravening section 21, read with sections 42(1) and 42(2)(d) of FICA. Section 21 requires an accountable institution to establish and verify a client's identity in accordance with its Risk Management and Compliance Programme (RMCP).

• R5m (R1m suspended) for inadequate enhanced due diligence, contravening section 21A. This section requires an institution to determine whether future transactions will be consistent with its knowledge of the client, including the source of funds and purpose of the relationship.

• R5m (R1m suspended) for inadequate ongoing due diligence, contravening section 21C — the requirement to keep scrutinising transactions and updating client information throughout a business relationship.

• R3m (unsuspended) because Capitec failed to provide ongoing FICA training to sampled employees, contravening section 43.

• R5m (R500,000 suspended) under section 42 (the RMCP requirement itself), because Capitec had not obtained management approval for its anti-money-laundering screening manuals before implementation, had not documented approved processes for terrorist-property reporting ahead of the PA's inspection notice, and had gaps in its RMCP's provisions for terrorist-property reporting and financial sanctions.

This is not Capitec's first FICA sanction. In December 2024, the PA imposed a separate R56.25 million penalty on Capitec following earlier inspections of its retail banking segment (2021) and business banking segment (2022) — with R10.5m of that conditionally suspended from 30 July 2024. There is substantive overlap in subject matter between the two matters (both involved due diligence and RMCP findings), but the specific shortcomings differ, and the inspection behind this week's sanction was conducted in 2023 — before the earlier sanctions took effect or were publicly announced.

Ninety One received two cautions, two reprimands, and R6 million in penalties, of which R2.5 million is conditionally suspended for 36 months from 19 June 2025, following a 2023 inspection.

• R2.5m (R1.5m suspended) for inadequate enhanced due diligence on sampled files, contravening section 21A read with its own RMCP.

• R3.5m (R1m suspended) under section 42, for failing to adequately develop and implement an RMCP covering sanctions screening, prominent-influential-person screening, and client/business risk, and for failing to evidence documented, implemented policies for meeting those obligations.

Ninety One said in a statement that there was no suggestion of money laundering, client misconduct, or financial harm; it accepted the findings, paid in full, and did not appeal.

Albaraka received three cautions and R1.6 million in penalties, of which R440,000 is conditionally suspended for 36 months from 10 June 2024, following a 2021 inspection.

• R100,000 (R40,000 suspended) for failing to submit 232 cash threshold reports on time, contravening section 28 read with regulation 24(4) of the FICA Regulations.

• R500,000 (unsuspended) for failing to submit 144 suspicious transaction reports on time, contravening section 29 read with regulation 24(3).

• R1m (R400,000 suspended) under section 42, for RMCP documentation gaps covering risk-factor weighting, customer risk-rating triggers, prohibited business relationships, and geographic risk assessment.

A separate, related sanction against Albaraka was overturned on appeal. The PA had also imposed a R2m penalty (R600,000 suspended) and a caution on Albaraka for inadequate customer due diligence on 12 trade-finance client files, related to source-of-funds information for clients' ultimate beneficial owners. Albaraka appealed under section 45D of FICA. During the appeal, the PA narrowed its case to section 21C, and the FICA Appeal Board found that Albaraka's own RMCP required it to establish the source of its clients' funds — not separate source-of-funds information for the clients' beneficial owners and signatories, where the clients were legal persons using their own funds. The Board held that sanctionable provisions must be read strictly, that an RMCP's purpose is to achieve FICA compliance rather than create self-imposed grounds for sanction, and set the finding aside. This appeal outcome does not affect the R1.6 million in sanctions described above — it relates only to the separate R2m matter.

Who must act, and what specifically changes: Nothing changes in FICA itself — this is an enforcement action against three specific institutions, not a new rule. But compliance officers at any accountable institution should treat this as a current enforcement-priority signal: the PA is actively sanctioning gaps in customer due diligence (sections 21, 21A, 21C), RMCP documentation and implementation (section 42), ongoing staff training (section 43), and reporting timeliness (sections 28 and 29).

Financial and operational exposure: The suspended portions of these penalties are not abstract — they become payable if the same institution repeats the same conduct within the 36-month window, on top of any new penalty for the repeat conduct. For any institution, an RMCP that has not been reviewed and approved by management, or that has not been updated to reflect current geographic and client risk factors, is a documented enforcement pattern the PA is actively pursuing.

Realistic compliance timeline: This is not a deadline-driven filing for outside institutions. It is, however, a prompt to audit: (1) whether your RMCP has documented management approval and is current: (2) whether ongoing due diligence and enhanced due diligence processes are evidenced on client files, not just described in policy; (3) whether cash-threshold and suspicious-transaction reports are being filed within the regulatory 24(4) and 24(3) windows; and (4) whether staff training records for FICA compliance are current and documented.

What remains uncertain or pending: The Appeal Board's broader legal question — whether an RMCP can create obligations beyond FICA's own statutory requirements, and whether non-compliance with a self-imposed RMCP term can itself attract a sanction — was not decided. The Board resolved Albaraka's case on narrower grounds (the PA's own interpretation was wrong) and expressly declined to rule on the wider point. That question remains open for future enforcement matters and appeals.

What is the Prudential Authority, and what power does it have to fine banks? The PA is the arm of the South African Reserve Bank responsible for supervising and enforcing compliance by "accountable institutions" — banks, insurers, and other regulated entities — with FICA. It derives its inspection power from section 45B of FICA and its administrative-sanction power from the sections that follow, with institutions able to appeal a sanction to the FICA Appeal Board under section 45D. These are administrative penalties, not criminal fines — they're imposed by the regulator directly, without a criminal trial.

How much was each institution actually fined, after suspensions? Capitec: R28m total, R5.5m of it conditionally suspended (so R22.5m is payable now). Ninety One: R6m total, R2.5m suspended (R3.5m payable now). Albaraka: R1.6m total, R440,000 suspended (R1.16m payable now). Combined, R35.6m was imposed and R8.44m of that is suspended.

What does "conditionally suspended" mean — does the bank still have to pay it? Not unless it repeats the same non-compliant conduct within the 36-month suspension window. If it does, the suspended amount becomes payable on top of whatever new penalty applies to the repeat conduct. It's a standard PA sanctioning tool, not a discount or a warning without consequence.

Do these sanctions mean money laundering actually happened at these banks? No — FICA authorises the PA to sanction inadequate systems and controls (due diligence gaps, missing training records, late reporting) regardless of whether laundering is proven to have occurred. Ninety One said in its own statement that there was no suggestion of money laundering, client misconduct, or financial harm in its matter. The PA's releases for Capitec and Albaraka likewise describe process and documentation failures, not a finding that laundering took place.

Is this Capitec's first FICA sanction, or has it happened before? It's Capitec's second in under two years. The PA fined Capitec R56.25m in December 2024 over earlier inspections (2021 retail banking, 2022 business banking). This week's R28m sanction stems from a separate 2023 inspection with overlapping subject matter — customer due diligence and RMCP gaps recur in both — but the specific findings differ, and the 2023 inspection predates the 2024 sanction's implementation.

Does Albaraka's successful appeal reduce the R1.6m it was fined? No. The appeal that succeeded concerned a separate, additional R2m sanction (over trade-finance client due diligence), which the FICA Appeal Board set aside entirely. The R1.6m described in this article — covering late cash-threshold reports, late suspicious-transaction reports, and RMCP gaps — is untouched by that appeal outcome and remains in force.

What should compliance teams at other institutions take from this, if they weren't named? Treat it as a current enforcement-priority signal rather than a new legal requirement. The PA is actively sanctioning gaps in customer/enhanced/ongoing due diligence, RMCPs lacking documented management approval, missed reporting deadlines, and undocumented staff training — the kind of gaps an internal audit against your own RMCP would surface before an inspection does.

Where can I read the actual sanction documents rather than a summary of them? All three PA media releases are linked in full in the Sourcing section above and are two to three pages each — short enough to read directly rather than relying on secondary coverage.