Get mandates and AML wrong, and you're not just fined; you're out.
Payment compliance in South Africa isn't a suggestion. Get it wrong and you're facing 10-million-rand fines, criminal prosecution, and business shutdown.
Three Altron FinTech compliance specialists recently laid out the rules. Here are five takeaways that can make or break your business.
By Get mandates wrong and you're kicked out of the national payment system. Period.
A mandate must include collector name and address, customer's full name and ID, account number, explicit written authorization to debit, collection amount and frequency, contract reference, and date of consent.
Common mistakes: missing signatures, voice recordings without explicit consent, no contract reference, confusion between mandate and authentication (a banking app pop-up is NOT a mandate; a TT3 PIN entry is NOT a mandate).
Store every mandate for seven years. When auditors request mandates, you have 48 hours to produce them.
For EFT transactions using voice recordings, convert to written mandates within 30 days. Banks won't accept voice-only for EFT disputes.
Speed matters. Delays give customers time to escalate to social media before you can respond.
When customers move banks, their old mandates become worthless.
A mandate is valid only for the specific account number listed on it. If a customer switches from Bank A to Bank B, you need a new mandate. Without it, they can dispute the transaction and claim it wasn't authorized, because technically, the mandate doesn't match the debited account.
Solution: When customers change banks, get a new mandate. Five minutes of effort prevents collections headaches.
4. AML checks are mandatory (and you're probably missing some)
Four non-negotiable checks:
Identity Verification: Verify onboarding (ID number), repeat every 2-3 months. Use automation; manual review is vulnerable to fraud.
Sanctions Screening: Check every transaction against local and international lists. If flagged, block immediately. Zero tolerance. No gray area. Lists update daily.
PEPs & PIPs: Screen government officials and business executives. Unlike sanctions, you don't block - you report and continue. Review every 6-12 months.
Risk Scoring: System auto-assigns 1-23 scores. Score 1-7 = basic checks. 16-23 = deep due diligence. The score determines the frequency and depth of checks.
Use systems to automate this. Don't rely on staff memory or spreadsheets.
You're registered with SARS. You're registered with the NCA. You have a unique national regulator number. Compliance audits happen yearly. You will be found.
Non-compliance penalties:
One major South African business was fined 10 million rand last year for failing to conduct proper AML due diligence.
The path forward is clear. Start by auditing your mandates now - verify every signature, consent date, and authorisation statement on file. Simultaneously, build a robust 7-year filing system with instant retrieval capability; when auditors request documents, you have 48 hours to deliver.
Don't do AML checks manually, automate ID verification, sanctions screening, and risk scoring to remove human error and ensure consistency.
Get your team trained on mandate requirements, so staff understand the difference between a mandate and transaction authentication. Finally, request a compliance audit to assess your status before regulators do it for you. The audit is coming; you can prepare for it now or face it unprepared. The choice determines whether you survive it.