FICA Section 21 CDD: Automate Customer Due Diligence Workflows
Paper CDD packs and shared drives fail Section 21 record-keeping the moment an examiner samples the file. Incomplete identity, address, or risk evidence is what turns a routine inspection into a finding.
We build CDD automation that captures examiner-ready Section 21 evidence for every client.
Sound Familiar?
These are the Section 21 gaps MLROs and compliance counsel face before CDD automation:
- Section 21 identity, address, and risk evidence lives across email, shared drives, and paper folders
- FIC or Prudential Authority sampling finds incomplete CDD files with missing proof of residence or source of funds
- Compliance officers spend days reconstructing who verified what, and when, before an inspection
- System fields do not match the documents on file, so the examiner treats the record as unverified
- Beneficial owner methodology is not evidenced, even when the RMCP says it should be
Capitec faced R56.25 million in FIC Act sanctions after inspections that included Section 21 CDD, EDD, and ongoing due diligence failures on sampled files. The FIC ran 556 inspections in 2024/25 and prescribed remedial action for 330 institutions. Incomplete CDD is no longer a paperwork inconvenience; it is an enforcement risk.
What Section 21 CDD Automation Actually Does
Identify the client → verify identity and address → obtain further information where required → store a complete evidence pack.
Identify the Client
Capture particulars for the client, representatives, and persons on whose behalf they act
Verify Identity & Address
Run DHA and document checks, confirm residence, and file outcomes with timestamps
Obtain Further Info
Risk-based prompts for source of funds, wealth, and other RMCP-required particulars
Store Evidence Pack
Complete, retrievable Section 21 records ready for examiner sampling and five-year retention
Everything You Need for Examiner-Ready CDD
Identity Capture & Verification
Section 21 identity steps run as a controlled workflow: collect particulars, verify against reliable sources such as DHA, and store the result with a timestamp.
Address Confirmation Controls
Proof of residence is requested, validated, and filed against the client record so inspectors do not find address gaps in sampled CDD packs.
Further Information Triggers
When risk rises, the workflow prompts for source of funds, source of wealth, and other RMCP-required particulars before the relationship proceeds.
Risk Tier Evidence
Client risk scoring, screening outcomes, and review notes sit with the CDD file so the institution can show why the measures applied matched the risk.
Examiner-Ready Evidence Packs
One exportable pack per client: identity proof, address confirmation, risk evidence, approvals, and retention metadata ready for FIC sampling.
Five-Year Record Control
FICA record-keeping obligations are built into storage and retention rules, not left to folders that get renamed, moved, or deleted.
Systems We've Connected for Section 21 CDD
From 70 Minutes Per Pack to a 5-Minute Review
How a mid-size FSCA-licensed FSP stopped reconstructing Section 21 files from shared drives before every inspection cycle.
The Manual CDD Process
- Compliance assembled each evidence pack from email, WhatsApp PDFs, and a shared drive
- Average 70 minutes per client file when preparing for FIC sampling
- 18% of sampled files missing identity, address, or source-of-funds evidence
- Inspection prep ran for three weeks of overtime across the compliance desk
- No reliable trail showing who verified identity and when
The Automated CDD Process
- Identity, address, and risk evidence captured as each Section 21 control completes
- Compliance reviews a generated pack in about five minutes
- Incomplete-file rate fell below 2% on internal sampling
- Inspection prep compressed from three weeks to four days
- Every pack carries timestamps, verifier identity, and retention metadata
Before vs After Section 21 CDD Automation
How It Works
From first conversation to live Section 21 CDD controls in 3–6 weeks.
Map Section 21 Controls
Which identity, address, and further-info steps your RMCP requires, and where evidence currently goes missing.
Free Scoping Call
30-minute call to design CDD automation around your accountable-institution obligations and inspection readiness.
Build & Parallel Test
We wire verification, document capture, risk prompts, and evidence packs, then run parallel against live client files.
Go Live & Monitor
Incomplete CDD stops entering the book unchecked. Monitoring flags gaps before an examiner finds them.
Frequently Asked Questions
What does FICA Section 21 require for customer due diligence?
Section 21 requires accountable institutions to establish and verify the identity of a client when establishing a business relationship or concluding a single transaction, including persons acting for the client and persons on whose behalf the client acts. Related provisions cover obtaining business-relationship information (section 21A), beneficial ownership measures (section 21B), ongoing due diligence (section 21C), and record keeping. The FIC's Revised Guidance Note 7A expects the nature and extent of verification to follow your risk-based RMCP.
How is this different from a full KYC onboarding journey product?
This build focuses on Section 21 CDD controls and examiner-ready evidence: identity verification, address confirmation, further information where required, risk evidence, and retention. Speed of onboarding is a side effect, not the primary promise. If your priority is a polished customer journey, we can connect those workflows, but the design centre here is complete, timestamped CDD files that survive inspection sampling.
What inspection findings does this help prevent?
Prudential Authority and FIC reviews repeatedly cite incomplete onboarding documents (identity, proof of residence, source of funds or wealth), missing beneficial owner methodology, and mismatches between system fields and documentary evidence. Automated CDD workflows capture each control with evidence and timestamps so sampled files are complete when inspectors ask.
Can you integrate DHA identity verification and address checks?
Yes. We connect Home Affairs NPR verification (real-time or off-peak batch) and address confirmation steps into the CDD workflow, then store the verification outcome with the client file. From July 2025, DHA prices real-time checks at R10 and off-peak batch at R1, so we design verification patterns that match urgency and cost.
How long are Section 21 records kept?
FICA generally requires accountable institutions to keep CDD and transaction records for at least five years. We design storage, retention, and retrieval so packs remain available for inspections and investigations, rather than relying on shared drives that cannot prove what was verified and when.
How much does Section 21 CDD automation cost?
Typical builds that automate identity, address, further-info prompts, and examiner-ready evidence packs run from about R35,000 to R90,000 depending on systems, verification providers, and RMCP complexity. Against R26,500 to R53,000 per corporate KYC review in industry research, and the administrative penalty ceiling of R50 million for legal persons, most mid-size desks see payback within a few months of live volume.
Stop Rebuilding Section 21 Files Before Every Inspection
If your CDD evidence still lives in paper packs and shared drives, you are carrying Section 21 risk that automation already solves.
Tell us which systems hold client data, how your RMCP defines identity and address checks, and where incomplete files still slip through. We will show you how automated CDD workflows produce complete, timestamped evidence for every client.