South Africa

Identity Verification & KYC For South Africa

Q: What are the KYC requirements in South Africa?

South African KYC requirements mandate customer identity verification using government-issued documents (Smart ID, passport, driver's licence); conduct customer due diligence (CDD) or enhanced due diligence (EDD) based on risk profile; ongoing transaction monitoring; suspicious activity reporting to FIC; retention of KYC records for minimum 5 years from relationship termination; and compliance with FICA, POPIA, and regulatory obligations.

Q: What is SASSA identity verification and why is it important for KYC?

SASSA biometric facial recognition programme verifies social welfare grant eligibility; reveals endemic identity fraud and synthetic identity schemes in South Africa. SASSA facial verification failures indicate poor-quality biometric data or fraudulent identity documents. KYC systems must detect these fraud patterns to prevent account abuse and regulatory breach in financial services.

Q: What documents do I need for KYC in South Africa?

Primary documents: South African Smart ID Card (preferred, biometric-enabled), Green ID Book (valid but phasing out; 34% fraud rate), Passport (secondary document). Supporting: Driver's licence (address verification), Temporary/Permanent Residence Permit (non-citizens). Proof of address: utility bills (Eskom, Telkom, Rand Water) dated within 3 months, bank statements, or municipal rates documents.

Q: What is FIC compliance and how does it affect my business?

FIC compliance requires accountable institutions to verify customer identities, conduct ongoing monitoring, maintain 5-year records, report suspicious transactions, and screen customers against UN sanctions lists. The Financial Intelligence Centre enforces FICA obligations via criminal penalties (15 years imprisonment or R10M fines). FIC compliance is mandatory for banks, fintech, forex brokers, and money transmitters operating in South Africa.

Q: How do FIC sanctions screening and UNSC lists work in South Africa?

The Financial Intelligence Centre requires screening all customers and transactions against the UN Security Council Targeted Financial Sanctions (TFS) list during onboarding and ongoing monitoring. Obtain TFS list from FIC; screen customer names, ID numbers, addresses at onboarding; monitor transactions against updated TFS entries regularly; freeze assets and report immediately if match found; document all screening results for 5-year retention.

Q: What is POPIA and how does it relate to identity verification?

POPIA (Protection of Personal Information Act, Act 4 of 2013) mandates organisations collect, process, and store personal information lawfully and safely. Biometric data (face, fingerprints) are classified as Special Personal Information requiring AES-256 encryption, hardware security module protection, and heightened organisational safeguards. Identity verification must comply with POPIA Condition 7 (Security Safeguards) and Information Regulator standards.

Q: What is beneficial ownership and why must I declare it?

Beneficial ownership refers to any natural person holding 5% or greater ownership of a corporate entity in South Africa. CIPC requires all companies to declare beneficial owners on the Beneficial Ownership Register (effective 24 May 2023). Non-compliance triggers court-ordered administrative fines of 10% annual turnover or R1 million (whichever greater). UBO identification is mandatory for enhanced due diligence and AML compliance.

Q: How long must I retain KYC and AML records in South Africa?

FICA mandates minimum 5-year retention of customer records from date of business relationship termination or transaction conclusion. This includes customer due diligence records, identity verification documents, transaction records, and suspicious activity reports. Willful destruction within the 5-year period is a criminal offence punishable by 15-year imprisonment or R10 million fine.

Q: What is the goAML reporting system and why is it required?

goAML is the integrated software platform managed by the Financial Intelligence Centre for reporting suspicious transactions, unusual transactions, cash threshold reports, terrorist property reports, and international funds transfer reports. All accountable institutions must register and file reports within required timeframes. goAML reporting is mandatory under FICA and non-compliance attracts criminal and civil penalties.

Shufti delivers a complete know your customer solution for South Africa with KYC compliance, FIC sanctions screening, and AML SA regulatory alignment for compliant onboarding.

Operational performance for South Africa KYC

Our Numbers Speak Volumes

99.35%

Pass rates

< 5 sec

Verification
Time

90%

EIDV
Coverage

Evidence-Ready Checks Across People & Businesses

Individual Documents We Verify

Shufti supports 12 South African document types.

View All Supported Documents

South African Smart ID Card

Biometric-enabled national identity document issued by the Department of Home Affairs, featuring electronic chip storing face, fingerprints, and ID number. Primary document for KYC with rapid verification returns in under 5 seconds via eIDV electronic database.

South African Green ID Book

Older bar-coded identity document with photograph and biographic data, still valid but phasing out. Higher fraud risk (34% per 2024 Smile ID report) due to poor photograph quality; requires enhanced fraud detection during transition to Smart ID.

South African Passport

International travel document issued by Department of Home Affairs, with particulars printed in English and French. Acceptable as secondary KYC document for residents and non-citizens; validity period typically 10 years.

South African Driver's Licence

Photographic identity document authorising vehicle operation, issued in English by licensing authorities. Acceptable for address verification and secondary identity confirmation; validity typically 5-8 years depending on category.

Temporary Residence Permit

Visa-based travel and work permit issued by Department of Home Affairs for non-citizens, valid up to 3 years depending on category (work, business, medical, retirement, relative). Required KYC document for extended-stay foreign nationals.

Permanent Residence Permit

Long-term residency status issued by Department of Home Affairs following minimum 5 years lawful residence, granting indefinite stay and business rights equivalent to citizens. Acceptable KYC document for established foreign nationals in South Africa.

Business Entity Identity

CIPC Certificate of Incorporation

Form CoR 14.3 issued upon company registration by the Companies and Intellectual Property Commission, serving as evidence of legal entity creation and registration status for KYB verification purposes.

Memorandum of Incorporation (MOI)

Constitution of the company filed at CIPC registration, detailing governance structure, director powers, shareholding, and shareholder rights; required for complete KYB due diligence.

Business Tax Identity

Income Tax Reference Number (TRN)

10-digit numeric identifier issued by South African Revenue Service (SARS) via Notice of Registration (IT150), used for tax filing, VAT registration, and business entity identification during KYB verification.

VAT Registration Certificate

Certificate of registration with SARS for Value-Added Tax purposes, issued to eligible businesses; businesses use their TRN as VAT number for compliance and verification purposes.

Ownership & Control (UBO)

Beneficial Ownership Register (CoR 151A)

Mandatory CIPC filing documenting all natural persons holding 5% or greater ownership, effective from 24 May 2023. Essential for enhanced due diligence and UBO verification under South Africa's beneficial ownership regime.

CIPC Director Declaration Form

Statutory declaration listing all current directors and their shareholdings, filed at CIPC and updated annually; required for complete corporate governance verification and UBO identification.

Languages We Cover

Document Language And Script

South African KYC documents use primarily English for formal identity records; Afrikaans appears on some historical documents. All identity documents employ Latin script; passports printed in English and French to facilitate international travel.

Name Matching And Transliteration

South African identity documents reflect 12 official languages (English, Afrikaans, isiZulu, isiXhosa, Sepedi, Sesotho, Setswana, siSwati, isiNdebele, Tshivenda, Xitsonga, South African Sign Language); Shufti handles surname variations and transliteration across regional language variants.

Evidence Consistency Across Records

Shufti verifies document authenticity by cross-referencing identity data against Department of Home Affairs eHome Affairs portal, SARS tax records, and CIPC entity registers to ensure consistency across KYC documentation.

GOVERNANCE & CONTROLS

Audit-Ready Decisions, Lower Operational Drag

Fewer Re-Submissions

Smart ID-to-Green ID Book capture guidance reduces photographic rejection rates and manual re-verification cycles during the document format transition period.

Cleaner Audit Trails

Timestamped verification decisions and FIC compliance logs meet FICA 5-year recordkeeping obligations and audit requirements from SARB and Financial Sector Conduct Authority.

Better Name Matching

Multilingual surname handling across Zulu, Xhosa, and Afrikaans variants eliminates false rejections and accelerates onboarding of South Africa's diverse population.

One Workflow For All

KYC South Africa plus KYB plus AML SA screening combined in a single interface; eliminates tool fragmentation and reduces compliance officer training overhead.

Smart ID-First Flow Design

Biometric-enabled rapid verification prioritises the modern Smart ID Card while maintaining Green ID Book fallback, aligning with Department of Home Affairs rollout timelines.

Enterprise-grade compliance infrastructure

South Africa IDV/KYC Challenges

Dual ID Formats

Smart ID and Green ID Book coexist during phaseout; dual capture protocols and format-specific fraud rules required to manage 34% Green ID fraud rate.

SASSA Identity Fraud

Biometric recognition failures reveal identity fraud; systems must detect synthetic IDs and poor-quality biometric data in social welfare grant verification.

FATF Compliance Legacy

South Africa removed from FATF grey list on 24 October 2025; enhanced due diligence expectations persist with international compliance partners.

Cross-Border Fraud

West African networks exploit SADC borders; 83.7% of foreign nationals originate from SADC countries, creating document fraud and identity risk vectors.

Shufti’s IDV/KYC Solutions for South Africa

KYC Solutions

Face Verification

AI-powered facial matching against government biometric databases and document photographs, tuned to detect spoofing attacks and synthetic identity fraud endemic to South Africa.

Age Verification

Selfie-based age estimation combined with document verification fallback; supports Smart ID, Green ID Book, and passport date-of-birth validation for age-gated services.

Address Verification

Shufti can verify any address-bearing document against South African utility records (Eskom, Telkom SA, Rand Water, City Power) and bank account statements from Standard Bank, ABSA, FNB, and Nedbank.

Document Verification

Multi-format support for South African Smart ID Card, Green ID Book, passport, driver's licence, and visa documents with optical character recognition and security feature validation.

KYB Solutions

Business Verification

Automated verification of CIPC-registered companies, SARS tax identifiers, director and shareholding records, and beneficial ownership declarations against CIPC registers.

Enhanced Due Diligence (EDD)

Risk-weighted KYB workflows aligned to South Africa's FATF removal and FIC enhanced scrutiny expectations for high-risk jurisdictions and politically exposed persons.

AML Screening

Business AML Screening

Real-time screening against FIC sanctions lists, SARB Prudential Authority administrative sanctions, and UN Security Council Targeted Financial Sanctions list during onboarding and ongoing monitoring.

Transaction Screening

Continuous monitoring of transaction activity against updated FIC sanctions lists and adverse media sources; automated reporting to FIC for suspicious or unusual transactions under FICA.

REGULATORY ALIGNMENT

Built to Fit South Africa's Compliance Landscape

Financial Sector Conduct Authority (FSCA)

Supervises market conduct for banks, insurers, FSPs, and crypto asset service providers. Shufti supports FSCA-regulated KYC onboarding, crypto CASP licensing, and AML screening.

South African Reserve Bank (SARB)

South Africa's central bank; governs monetary policy, currency stability, and banking oversight. Shufti aligns cloud deployment to SARB Directive D3/2018 data governance standards.

Prudential Authority (PA)

Twin-peaks prudential regulator for banks, insurers, and cooperative banks across South Africa. Shufti delivers audit trails and compliance monitoring for PA prudential standards.

Financial Intelligence Centre (FIC)

South Africa's FIU; combats money laundering and terrorist financing under FICA via goAML. Shufti automates STR filing, UN TFS sanctions screening, and PEP monitoring for FIC.

Companies and Intellectual Property Commission (CIPC)

Registers South African companies and maintains the mandatory beneficial ownership register. Shufti verifies UBO declarations and director records against CIPC registers instantly.

Information Regulator (South Africa)

Enforces POPIA and PAIA; governs collection, processing, and storage of personal information. Shufti applies POPIA encryption, retention controls, and biometric data safeguards.

National Credit Regulator (NCR)

Regulates South Africa's credit sector under NCA 2005; registers credit providers and bureaus. Shufti supports NCR-compliant identity verification for credit provider onboarding.

Johannesburg Stock Exchange (JSE)

Africa's largest stock exchange; regulates listed companies and capital market conduct. Shufti supports investor KYC and UBO verification for JSE listing requirements.

Deployment Choice

AWS Africa (Cape Town) region with three availability zones plus Johannesburg local zone; Azure South Africa North; GCP Johannesburg region available.

Regulatory Alignment

POPIA Act 4 of 2013 with Information Regulator; FICA 5-year recordkeeping; SARB Directive D3/2018; biometric data classified as Special Personal Information.

Retention controls

FICA mandates 5-year minimum retention from relationship termination; willful destruction is criminal offence (15 years imprisonment or R10M fine).

Encryption posture

AES-256 encryption in transit and at rest per POPIA Condition 7; hardware security module protection; cryptographic key management per NIST guidelines.

Data Controls & Privacy for South Africa

BUILT FOR COMPLIANCE TEAMS

South Africa AML Sources That Strengthen Decision

National Assembly of South Africa

Financial Intelligence Centre (FIC), South Africa Sanctions

South African Reserve Bank Prudential Authority, Administrative Sanctions

South Africa National Treasury, Warnings and Regulatory Enforcement

TimesLIVE

News24

Mail & Guardian

SARS Entity Watchlist and Compliance Enforcement

National Assembly of South Africa

Financial Intelligence Centre (FIC), South Africa Sanctions

South African Reserve Bank Prudential Authority, Administrative Sanctions

South Africa National Treasury, Warnings and Regulatory Enforcement

TimesLIVE

News24

Mail & Guardian

SARS Entity Watchlist and Compliance Enforcement

National Assembly of South Africa

Financial Intelligence Centre (FIC), South Africa Sanctions

South African Reserve Bank Prudential Authority, Administrative Sanctions

South Africa National Treasury, Warnings and Regulatory Enforcement

TimesLIVE

News24

Mail & Guardian

SARS Entity Watchlist and Compliance Enforcement

Frequently Asked Questions

What are the KYC requirements in South Africa?

South African KYC requirements mandate customer identity verification using government-issued documents (Smart ID, passport, driver's licence); conduct customer due diligence (CDD) or enhanced due diligence (EDD) based on risk profile; ongoing transaction monitoring; suspicious activity reporting to FIC; retention of KYC records for minimum 5 years from relationship termination; and compliance with FICA, POPIA, and regulatory obligations.

What is SASSA identity verification and why is it important for KYC?

SASSA biometric facial recognition programme verifies social welfare grant eligibility; reveals endemic identity fraud and synthetic identity schemes in South Africa. SASSA facial verification failures indicate poor-quality biometric data or fraudulent identity documents. KYC systems must detect these fraud patterns to prevent account abuse and regulatory breach in financial services.

What documents do I need for KYC in South Africa?

Primary documents: South African Smart ID Card (preferred, biometric-enabled), Green ID Book (valid but phasing out; 34% fraud rate), Passport (secondary document). Supporting: Driver's licence (address verification), Temporary/Permanent Residence Permit (non-citizens). Proof of address: utility bills (Eskom, Telkom, Rand Water) dated within 3 months, bank statements, or municipal rates documents.

What is FIC compliance and how does it affect my business?

FIC compliance requires accountable institutions to verify customer identities, conduct ongoing monitoring, maintain 5-year records, report suspicious transactions, and screen customers against UN sanctions lists. The Financial Intelligence Centre enforces FICA obligations via criminal penalties (15 years imprisonment or R10M fines). FIC compliance is mandatory for banks, fintech, forex brokers, and money transmitters operating in South Africa.

How do FIC sanctions screening and UNSC lists work in South Africa?

The Financial Intelligence Centre requires screening all customers and transactions against the UN Security Council Targeted Financial Sanctions (TFS) list during onboarding and ongoing monitoring. Obtain TFS list from FIC; screen customer names, ID numbers, addresses at onboarding; monitor transactions against updated TFS entries regularly; freeze assets and report immediately if match found; document all screening results for 5-year retention.

What is POPIA and how does it relate to identity verification?

POPIA (Protection of Personal Information Act, Act 4 of 2013) mandates organisations collect, process, and store personal information lawfully and safely. Biometric data (face, fingerprints) are classified as Special Personal Information requiring AES-256 encryption, hardware security module protection, and heightened organisational safeguards. Identity verification must comply with POPIA Condition 7 (Security Safeguards) and Information Regulator standards.

What is beneficial ownership and why must I declare it?

Beneficial ownership refers to any natural person holding 5% or greater ownership of a corporate entity in South Africa. CIPC requires all companies to declare beneficial owners on the Beneficial Ownership Register (effective 24 May 2023). Non-compliance triggers court-ordered administrative fines of 10% annual turnover or R1 million (whichever greater). UBO identification is mandatory for enhanced due diligence and AML compliance.

How long must I retain KYC and AML records in South Africa?

FICA mandates minimum 5-year retention of customer records from date of business relationship termination or transaction conclusion. This includes customer due diligence records, identity verification documents, transaction records, and suspicious activity reports. Willful destruction within the 5-year period is a criminal offence punishable by 15-year imprisonment or R10 million fine.

What is the goAML reporting system and why is it required?

goAML is the integrated software platform managed by the Financial Intelligence Centre for reporting suspicious transactions, unusual transactions, cash threshold reports, terrorist property reports, and international funds transfer reports. All accountable institutions must register and file reports within required timeframes. goAML reporting is mandatory under FICA and non-compliance attracts criminal and civil penalties.

Build a South Africa-ready KYC, KYB & AML programme with Shufti

Check Pricing Request Demo

INDEPENDENTLY AUDITED. GLOBALLY CERTIFIED.

Certified to Global Standards

PROVEN WORKFLOWS

Use Cases for Regulated Growth in South Africa

Fintech

Forex

Banking

Gaming

Gig Economy

Crypto

Marketplace

Fintech

Forex

Banking

Gaming

Gig Economy

Crypto

Marketplace

Fintech

Forex

Banking

Gaming

Gig Economy

Crypto

Marketplace

Accelerate Growth, Eliminate Friction

Onboard users in seconds, not days. Deploy tiered address verification flows that maximise completion rates for genuine users while filtering out synthetic fraud.

Learn More Try Now

Onboard Global Traders in Real-Time

Verify investors across 250+ countries & territories. Ensure compliance with international financial regulations while preventing identity theft and high-risk chargebacks.

Learn More Try Now

Secure Trust at Every Transaction

Automate KYC and AML workflows to reduce manual onboarding costs. Strengthen residency checks while delivering the frictionless digital experience modern customers expect.

Learn More Try Now

Power a Fair & Secure Player Experience

Reduce bonus abuse and multi-accounting rings at the door. Enforce location rules and trigger step-up checks without disrupting the player journey.

Learn More Try Now

Build a Trusted, Verified Workforce

Screen freelancers and drivers at scale. Verify residency and reduce onboarding friction while maintaining trust between users.

Learn More Try Now

Scale Your Exchange with Confidence

Balance anonymity with compliance. Instantly verify user jurisdiction to meet Travel Rule obligations and help stop abuse without slowing down legitimate trading volume.

Learn More Try Now

Reduce fraud without blocking growth

Shufti supports marketplace integrity by verifying seller and buyer identities, enabling age-gated journeys where needed, and preserving evidence to support investigations, disputes and risk-led enforcement actions.

Learn More Try Now