RCR Season Is Here: What Directive 11 Means For Accountable Institutions

The Financial Intelligence Centre’s (“FIC”) publication of Directive 11 of 2026 (“Directive 11”) and Public Compliance Communication 60 (“PCC 60”) on 12 June 2026 is a timely reminder that the 2026 risk and compliance return (“RCR”) is now a live compliance obligation. For many accountable institutions the immediate challenge will be practical rather than conceptual: gathering the right data, aligning it to the correct reporting periods, and submitting an accurate return on time. PCC 60 serves as final guidance on the format, manner of completion and submission of the 2026 RCR, as contemplated by Directive 11, which is the successor to Directive 6 of 2023 and Directive 7 of 2023 (together, the “2023 Directives”), which were previously issued by the FIC to require accountable institutions to submit RCRs in respect of earlier reporting periods.

An important distinction must be drawn between PCC 60 and Directive 11. PCC 60 is guidance issued by the FIC in terms of section 4(c) of the Financial Intelligence Centre Act, 2001 (“FICA”) read with Regulation 28. Whilst PCC 60 is described as “authoritative in nature” and must be taken into account when interpreting FICA or assessing compliance, it is not legislation. It does not, of itself, create binding legal obligations. Directive 11, by contrast, is issued by the FIC in terms of section 43A(3)(a) of FICA. A directive made under section 43A is a form of delegated legislation: it imposes binding obligations on accountable institutions and non-compliance is subject to administrative sanction under section 62E of FICA. In short, directives are law; PCCs are not.

That said, the practical significance of PCC 60 should not be understated. The FIC expressly states that enforcement action may follow where there has been non-compliance with FICA in areas addressed by its guidance, unless the institution can demonstrate equivalent compliance. For accountable institutions, that is an important signal that PCC 60 should be treated as operational guidance with real compliance significance, not as a document to be skimmed and filed away.

Differences between the 2023 Directives and Directive 11

There are several notable differences between the RCR obligations under the 2023 Directives and those now imposed by Directive 11.

First, the 2023 Directives applied to different categories of accountable institutions on a split basis: Directive 6 applied to designated non-financial businesses and professions under items 1 (legal practitioners), 2 (trust and company service providers), 3 (estate agents) and 9 (licensed gambling institutions, including casinos and non-casino gambling institutions) of Schedule 1 to FICA, whilst Directive 7 applied to accountable institutions under items 11 (credit providers), 14 (the South African Postbank Limited), 20 (high-value goods dealers), 21 (the South African Mint Company (RF) (Pty) Ltd) and 22 (crypto asset service providers). Directive 11 consolidates both groups into a single directive, applying to all specified accountable institutions across items 1, 2, 3, 9, 11 (excluding banks, mutual banks and co-operative banks carrying on the business of a credit provider), 14, 20, 21 and 22.

Second, the reporting periods have expanded significantly. Under the 2023 Directives, the reporting periods were relatively short: Directive 6 covered 1 April 2022 to 31 March 2023 (one year), and Directive 7 covered 1 January 2023 to 30 June 2023 (six months). Directive 11 requires data spanning approximately three years, from either 1 April 2023 or 1 July 2023 (depending on the category of institution) to 31 March 2026, broken into three separate reporting years or periods. This is a materially more onerous data-gathering exercise.

Third, the 2023 Directives described the RCR as an “automated return” to be populated via a link on the FIC website. Directive 11 and PCC 60 introduce a more structured electronic submission process through the goAML platform, requiring accountable institutions to hold a valid Org ID, with detailed guidance on multi-session completion, saving of progress, and the finality of submission (which cannot be retracted or withdrawn once made).

Fourth, whilst the 2023 Directives contained relatively brief provisions on non-compliance (stating that non-submission “may result in an administrative sanction” under sections 62E and 43A(3) of FICA), Directive 11 is more direct: a specified accountable institution that fails to comply “is non-compliant and is subject to an administrative sanction” under section 62E. The change in language from permissive to declarative signals greater enforcement intent.

The immediate headline is timing. The web notice published on 12 June 2026 records that specified accountable institutions under item 11 (excluding banks, mutual banks and co-operative bank credit providers), items 14, 21 and 22, and casinos under items 2 and 9 must submit by 30 June 2026, no later than 17:00.

High-value goods dealers under item 20, and institutions under items 1, 3 and 9 (non-casinos), have until 31 July 2026, also no later than 17:00. The schedule to PCC 60 repeats those dates and makes clear that the RCR submission process commenced on 4 May 2026.

For many businesses, however, the more difficult part is not the deadline itself but the structure of the return. PCC 60 explains that the RCR must be completed using data that spans multiple years or periods, depending on the category of accountable institution. For items 1, 2, 3 and 9, the reporting period runs from 1 April 2023 to 31 March 2026 and must be completed across three separate years.

For item 11 (excluding banks, mutual banks and co-operative bank credit providers), and items 14, 20, 21 and 22, the relevant period runs from 1 July 2023 to 31 March 2026 and must be completed across three separate reporting periods. The guidance emphasises that institutions may submit only once they have completed the required data separately for each year or period.

PCC 60 also makes it clear that the process is entity-specific and Org ID-driven. Each specified accountable institution must submit a separate RCR for each unique organisation identity (“Org ID”) number. A single consolidated return is generally required for the business activities of the head office and all branch offices, but separate legal entities in a franchise or associated structure must register separately and file their own RCRs. The guidance also warns that where an institution conducts business across more than one Schedule 1 item, it may be required to submit more than one RCR, one for each separate designated item profile.

This may surprise some institutions. The guidance does not allow a blanket or group-level approach where the legal structure requires otherwise. It also states that only institutions registered with the FIC and with an Org ID number may submit an RCR online. Institutions that are not yet properly registered should register promptly on goAML.

There is another practical message running through PCC 60: preparation matters. The FIC recommends that institutions first download and study the sample questionnaire template, gather and collate the required data, and complete the information in draft before attempting the online submission.

The communication also notes that the online form may be saved multiple times before final submission, but once the RCR has been submitted it cannot be altered, retracted or withdrawn on goAML. If an institution later realises that its submission was inaccurate, it must raise a written compliance query with the FIC. That makes review and internal sign-off especially important.

The consultation feedback note adds a useful further point. It records that comments were received from a range of sectors, including crypto asset service providers, legal practitioners and estate agents, and confirms that the FIC has considered and incorporated comments where appropriate.

It also shows that one area of concern was the treatment of newly registered or newly operating accountable institutions, leading to additional examples in the final guidance. The FIC expressly cautions institutions against falsely omitting returns for years in which the business was open or required to be registered.

The broader implication is that the 2026 RCR process is becoming a more structured test of enterprise-wide AML, CFT and CPF governance. It is not only a reporting exercise. It is also a measure of whether an accountable institution understands its own risk profile, legal structure, reporting perimeter and recordkeeping position well enough to answer detailed regulatory questions accurately and consistently. That is why PCC 60 matters. It turns the RCR from a looming obligation into a defined compliance process with authoritative guidance, fixed timeframes and little room for casual preparation.

For accountable institutions that have not yet started collating their data or checking their Org ID and reporting structure, the practical message is simple: the filing window is already here, and the time for preparation is now very short.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.