When it comes to financial crime, the warning signs are almost always there, but not always spotted in time. In South Africa’s current, tightened regulatory environment, failing to detect red flags early can expose accountable institutions to reputational and legal fallout that far outweighs the cost of vigilance.
Despite investing heavily in client due diligence processes post greylisting, many businesses are still getting blindsided by illicit behaviour that could have been detected earlier.
The need for better approaches isn’t about the obvious fraudsters, it’s about the client who looked legitimate, until a bombshell revealed their illicit shell companies. The law firm that unknowingly handled property transactions for a politically connected fixer or the broker who missed a small inconsistency in identity document (ID) verification that turned out to be a synthetic identity.
Everyday red flags
The Financial Intelligence Centre (FIC) has issued extensive guidance around certain behavioural and transactional signs including:
- Structured cash deposits just under the R49 999.99 FIC Act (FICA) reporting threshold
- Cash refund requests after a high-value purchase
- Clients unwilling to provide standard identification documentation
- Payments from or to high-risk jurisdictions known for weak anti-money laundering (AML) and counter financing of terrorism (CFT) controls
- Unusual transactions that make no commercial or economic sense
- Goods purchased far from a client’s residential or business address
- Clients transacting in sectors unrelated to their known activity, with no history or stated rationale
These are not isolated indicators. They are often presented as a combination of risk behaviours. For example, a client might insist on cash-only payments, refuse to explain the source of funds, and make high-value purchases in a different province. On their own, each behaviour might appear innocuous but together, they signal risk. This is where asking the right questions and really knowing your client can make all the difference.
How can you protect your business?
Gathering comprehensive customer information at onboarding is incredibly important, but the real risk often lies in failing to reassess clients over time. Risk, after all, isn’t static.A client who seemed (or was) low-risk at onboarding might become high-risk after a change in ownership, media exposure, or jurisdiction.
We’ve seen firsthand that dynamic, real-time risk monitoring – through identity triangulation, biometric liveness detection, and adverse media scanning – gives institutions the ability to reassess clients continuously. This is particularly important for industries prone to so-called “gatekeeper abuse”, where professionals are unknowingly used to legitimise criminal transactions.
So, how can institutions better protect themselves?
- Automate onboarding and screening processes to reduce human error
- Use biometric and digital identity verification to detect fraud
- Monitor clients on an ongoing basis, not just at sign-up
- Be on the lookout for adverse media on clients to detect reputational risk before formal sanctions arise
- Ensure senior sign-off on high-risk clients, with evidence of enhanced due diligence
The risk of complacency
A common misconception is that small institutions are unlikely targets. In reality, criminals prefer smaller businesses that, more likely than not, have less robust compliance systems than their bigger counterparts. In a time of heightened risk and scrutiny, these steps have become survival tools and not merely compliance boosters.