RSK4802
EXAM PACK
,GOVERNANCE, RISK AND COMPLIANCE
MANAGEMENT - RSK4802
JANUARY/FEBRUARY 2026
EXAM ANSWERS
QUESTION 1
1(a) Identify any four possible risks that the banks face for non-compliance with
FICA. (4)
Failure to comply with the Financial Intelligence Centre Act (FICA) can expose a bank to
several important risks:
1. Regulatory and legal risk – The bank may be investigated or sanctioned by the
regulator and may be required to implement corrective measures.
2. Financial risk – Non-compliance can result in substantial administrative fines
and additional costs associated with correcting weaknesses in internal controls.
3. Reputational risk – Public knowledge that a bank has inadequate anti-money-
laundering controls can damage customer confidence and the institution's
reputation.
4. Money-laundering and terrorist-financing risk – Weak controls may allow
criminals or other prohibited persons to use the bank to conceal, transfer or
receive illicit funds.
1(b) Give reasons from the article why the Bank imposed administrative fines on
Capitec and Deutsche Bank. (3)
The administrative sanctions were imposed because the banks had deficiencies in their
FICA-related controls.
, Capitec was fined because it failed to report cash transactions exceeding the
prescribed threshold to the Financial Intelligence Centre. It was also instructed to
take remedial action.
Deutsche Bank was fined because its know-your-customer procedures were
inadequate. It also had weaknesses in its systems for detecting property
connected with terrorist activities.
The sanctions were therefore based on control and compliance failures, rather
than evidence that either bank had actually facilitated money laundering or
terrorist financing.
1(c)(i) Explain what is required for the bank to comply with KYC under FICA. (3)
Know Your Customer (KYC) requires a bank to establish and verify the identity of
customers before providing them with relevant financial services.
The compliance staff should ensure that:
1. The customer's identity is established using appropriate identification
information and documents.
2. The information is verified against reliable or independent sources so that the
person or entity can be properly identified.
3. Customer due diligence is maintained on an ongoing basis, including
understanding the nature and purpose of the relationship, monitoring
transactions and identifying unusual or suspicious activity.
The bank should also maintain appropriate records and apply enhanced due diligence
where the customer's risk profile requires it.
1(c)(ii) In the context of this report, identify and describe the nature of compliance
monitoring by the regulator. (7)
, Compliance monitoring by the regulator involves examining whether banks have
established and are operating systems that comply with applicable legislation and
regulatory requirements.
In this case, the South African Reserve Bank's supervisory function includes the
following:
1. Regulatory inspections
The regulator conducts inspections of banks to determine whether their
compliance systems and controls are operating effectively.
2. Assessment of internal controls
It evaluates whether banks have appropriate procedures for identifying
customers, monitoring transactions and preventing financial crime.
3. Testing compliance with FICA
The regulator checks whether the institution complies with statutory obligations
relating to money laundering and terrorist financing.
4. Identification of control weaknesses
Where deficiencies are found, the regulator identifies areas where the bank's
systems, procedures or staff practices are inadequate.
5. Enforcement and administrative sanctions
Where significant non-compliance is identified, the regulator may impose
administrative penalties. The fines imposed on Capitec and Deutsche Bank
illustrate this enforcement function.
6. Remedial action
A bank may be instructed to correct identified weaknesses and strengthen its
systems and controls.
7. Ongoing supervisory oversight
Compliance monitoring is not limited to identifying individual breaches. It forms
part of continuous prudential and regulatory supervision intended to ensure that
banks maintain effective governance and risk-control frameworks.
EXAM PACK
,GOVERNANCE, RISK AND COMPLIANCE
MANAGEMENT - RSK4802
JANUARY/FEBRUARY 2026
EXAM ANSWERS
QUESTION 1
1(a) Identify any four possible risks that the banks face for non-compliance with
FICA. (4)
Failure to comply with the Financial Intelligence Centre Act (FICA) can expose a bank to
several important risks:
1. Regulatory and legal risk – The bank may be investigated or sanctioned by the
regulator and may be required to implement corrective measures.
2. Financial risk – Non-compliance can result in substantial administrative fines
and additional costs associated with correcting weaknesses in internal controls.
3. Reputational risk – Public knowledge that a bank has inadequate anti-money-
laundering controls can damage customer confidence and the institution's
reputation.
4. Money-laundering and terrorist-financing risk – Weak controls may allow
criminals or other prohibited persons to use the bank to conceal, transfer or
receive illicit funds.
1(b) Give reasons from the article why the Bank imposed administrative fines on
Capitec and Deutsche Bank. (3)
The administrative sanctions were imposed because the banks had deficiencies in their
FICA-related controls.
, Capitec was fined because it failed to report cash transactions exceeding the
prescribed threshold to the Financial Intelligence Centre. It was also instructed to
take remedial action.
Deutsche Bank was fined because its know-your-customer procedures were
inadequate. It also had weaknesses in its systems for detecting property
connected with terrorist activities.
The sanctions were therefore based on control and compliance failures, rather
than evidence that either bank had actually facilitated money laundering or
terrorist financing.
1(c)(i) Explain what is required for the bank to comply with KYC under FICA. (3)
Know Your Customer (KYC) requires a bank to establish and verify the identity of
customers before providing them with relevant financial services.
The compliance staff should ensure that:
1. The customer's identity is established using appropriate identification
information and documents.
2. The information is verified against reliable or independent sources so that the
person or entity can be properly identified.
3. Customer due diligence is maintained on an ongoing basis, including
understanding the nature and purpose of the relationship, monitoring
transactions and identifying unusual or suspicious activity.
The bank should also maintain appropriate records and apply enhanced due diligence
where the customer's risk profile requires it.
1(c)(ii) In the context of this report, identify and describe the nature of compliance
monitoring by the regulator. (7)
, Compliance monitoring by the regulator involves examining whether banks have
established and are operating systems that comply with applicable legislation and
regulatory requirements.
In this case, the South African Reserve Bank's supervisory function includes the
following:
1. Regulatory inspections
The regulator conducts inspections of banks to determine whether their
compliance systems and controls are operating effectively.
2. Assessment of internal controls
It evaluates whether banks have appropriate procedures for identifying
customers, monitoring transactions and preventing financial crime.
3. Testing compliance with FICA
The regulator checks whether the institution complies with statutory obligations
relating to money laundering and terrorist financing.
4. Identification of control weaknesses
Where deficiencies are found, the regulator identifies areas where the bank's
systems, procedures or staff practices are inadequate.
5. Enforcement and administrative sanctions
Where significant non-compliance is identified, the regulator may impose
administrative penalties. The fines imposed on Capitec and Deutsche Bank
illustrate this enforcement function.
6. Remedial action
A bank may be instructed to correct identified weaknesses and strengthen its
systems and controls.
7. Ongoing supervisory oversight
Compliance monitoring is not limited to identifying individual breaches. It forms
part of continuous prudential and regulatory supervision intended to ensure that
banks maintain effective governance and risk-control frameworks.
