FICA RMCP Implementation: Build Your Risk Management and Compliance Programme
An RMCP that lives in Word docs and spreadsheets fails inspections the moment operations change and the document does not. FIC requirements expect a living programme: documented controls, risk assessments, board reporting, and training evidence you can produce on demand.
We build the Risk Management and Compliance Programme infrastructure that stays inspection-ready.
Sound Familiar?
These are the programme gaps CEOs and Compliance Officers face before a living RMCP:
- Your Risk Management and Compliance Programme lives in Word docs and shared drives that nobody can prove are current
- Board packs for ML/TF/PF risk are assembled by hand the week before each meeting, with gaps nobody notices until an inspector asks
- Training registers sit in spreadsheets with missing signatures, so section 43 evidence fails the moment FIC requests it
- Control owners update the RMCP once a year, then operations drift until the next inspection finds the mismatch
- Entity-wide risk assessments are outdated the day after a new product, channel, or geography goes live
Subsequent remediation does not erase a finding. The FIC Appeal Board has upheld RMCP sanctions even where institutions later fixed gaps. A paper programme that is not maintained and implemented is already non-compliant under section 42, before any client file is sampled.
What a Living FICA RMCP Actually Does
Risk assessed → controls evidenced → board informed → training proven. No Word-doc archaeology before inspections.
Risk Assessment Updates
Entity-wide ML/TF/PF factors refresh when products, clients, or channels change
Controls Logged
Owners attest on schedule; exceptions escalate with timestamps
Board Pack Assembles
Quarterly risk and compliance packs build from live programme data
Training Evidenced
Registers, assessments, and schedules ready when FIC asks under section 43
Everything You Need for an Inspection-Ready AML Programme
Living RMCP Document Hub
Section 42 programme content is versioned, searchable, and ready to produce when the FIC requests it under section 42(4), not scattered across folders.
Entity-Wide Risk Assessment
Client, product, geography, and delivery-channel risk factors stay linked to controls, so the RMCP reflects how the business actually operates today.
Automated Control Evidence
Control owners log status on a cadence. Exceptions escalate. Inspectors see a control matrix with timestamps, not a static annex from last year.
Board Reporting Cadence
Quarterly ML/TF/PF packs for the board or highest authority assemble from live programme data, satisfying the FIC expectation of regular senior oversight.
Staff Training Automation
Induction and refresher schedules from your RMCP drive assignments, assessments, and attendance evidence that section 43 inspections expect to see.
Inspection-Ready Export
One package for examiners: approved RMCP, risk assessment, control matrix, training register, and board packs with retention metadata intact.
Systems We've Wired into RMCP Programmes
From 12 Hours/Week to 2 Hours/Week
How a mid-size accountable institution replaced a paper RMCP with a living programme and cut board-pack prep from three days to four hours.
The Paper Programme
- Compliance officer maintained the RMCP in Word, with annexes on a shared drive
- Risk assessment refreshed annually, then ignored until the next product launch panic
- Training registers lived in Excel with missing signatures and outdated modules
- Quarterly board packs took three days to assemble from emails and folders
- Inspection prep meant three weeks of reconstruction before FIC arrived
The Living Programme
- Approved RMCP content versioned and exportable for section 42(4) requests
- Control owners attest on cadence; overdue items escalate automatically
- Training assignments, completions, and assessments feed one register
- Board packs assemble from live risk and control data in hours
- Inspection export ready: programme, controls, training, and oversight evidence
Before vs After RMCP Automation
How It Works
From first conversation to a living RMCP in 4–8 weeks.
Map Your RMCP Gaps
Where section 42 content, risk assessments, controls, training, and board reporting currently live, and what fails under inspection.
Free Scoping Call
30-minute call with your Compliance Officer or CEO to design a living programme around FIC Guidance Note 7A and PCC 53.
Build & Parallel Test
We wire document control, risk assessment updates, control evidence, training registers, and board packs, then run parallel with your paper process.
Go Live & Monitor
Word-and-spreadsheet maintenance stops. Monitoring flags overdue reviews, missed training, and stale risk assessments before an examiner does.
Frequently Asked Questions
What must a FICA RMCP include under section 42?
Section 42 of the FIC Act requires accountable institutions to develop, document, maintain, and implement a Risk Management and Compliance Programme covering how they identify, assess, monitor, mitigate, and manage ML, TF, and PF risk. Guidance Note 7A and PCC 53 expect the documentation to cover the entity-wide risk assessment, policies and procedures (including CDD, record keeping, reporting, and targeted financial sanctions), and how the programme is implemented through systems, people, and training. The board, senior management, or person with highest authority must approve it, and that duty cannot be delegated.
How is this different from Section 21 CDD or KYC onboarding automation?
Section 21 and KYC pages automate day-to-day customer due diligence packs. This build is about the programme itself: governance, documented controls, risk assessments, board reporting cadence, and training evidence that make the RMCP a living system. CDD workflows can plug into it later, but the design centre here is FIC-aligned programme structure that survives inspection of the RMCP document, not of a single client file.
What happens if our RMCP is only on paper?
A static Word RMCP fails when operations change and the document does not. The FIC has sanctioned institutions specifically for failing to document, maintain, and implement an RMCP. Kunene Ramapala Incorporated faced R3.8 million for that section 42 failure alone (part of a R7.772 million total). Capital Point Properties was fined R108,000 for failing to develop and implement an RMCP timeously. Paper programmes also struggle to produce training registers and board packs on demand.
What training evidence does the FIC expect?
Section 43 requires ongoing training on the FIC Act and your RMCP. PCC 53 and Guidance Note 7A expect you to specify frequency, format, and attendees in the RMCP, and to retain evidence such as attendance registers, presentations, and assessment results. Records should be available for at least five years. We automate assignment, completion tracking, and exportable registers so inspectors are not waiting on a spreadsheet rebuild.
Who has to approve the RMCP?
The board of directors, senior management, or the person with highest authority must approve the RMCP and ensure the institution and its employees comply. That approval obligation cannot be delegated to a committee or the compliance officer alone. Legal persons must also appoint a sufficiently senior compliance function. Our board reporting cadence is designed so those approvers see timely ML/TF/PF information, not a last-minute pack.
How much does an RMCP programme build cost?
Typical builds that digitise RMCP document control, risk assessment updates, control evidence, training registers, and board packs run from about R45,000 to R120,000 depending on systems and programme complexity. Against R3.8 million section 42 penalties already imposed, and the R50 million ceiling for legal persons, most mid-size accountable institutions see payback within a few months of cutting manual programme admin.
Stop Running Your RMCP from Word and Spreadsheets
If your Risk Management and Compliance Programme only exists as a document, you are one inspection away from proving it is not implemented.
Tell us how your accountable institution is structured, where the RMCP lives today, and what the last inspection or internal audit flagged. We will show you how a living programme with automated controls, reporting, and training evidence would work for your business.