No fluff. Just the facts. RMCP in plain English.
05 February 2026
If you’re a law firm in South Africa and your “FICA compliance” lives in someone’s inbox, a dusty template, or a single KYC checklist, then you don’t have compliance — you have hope. And hope, unfortunately, is not a control measure.
The document that turns FICA obligations into an operational system is the RMCP — Risk Management and Compliance Programme.
And it’s not optional.
The Financial Intelligence Centre (FIC) is explicit: legal practitioners, as accountable institutions, must develop, maintain, and implement an RMCP to manage money laundering, terrorist financing, and proliferation financing risk.
What an RMCP Is (and What It Isn’t)
An RMCP is your firm’s written, risk-based AML/CFT/CPF playbook. It documents:
- The risks your practice is exposed to, and
- The controls you use to identify, mitigate, manage, monitor, and report those risks
Just as importantly, an RMCP is not:
- A generic “FICA policy” downloaded from the internet
- A once-off client onboarding checklist that is never revisited
- “That thing we’ll finalise after month-end” (a mythical time, much like perfectly paginated bundles)
The FIC frames this clearly: an RMCP must address the requirements of section 42 of the FIC Act, including policies, processes, systems, and controls for:
- Customer due diligence
- Record-keeping
- Reporting obligations
- Risk-based approach implementation
- Staff training
Why Every Law Firm Needs an RMCP (Even If You “Don’t Do High-Risk Work”)
Legal practices are gatekeepers in the financial system, which is precisely why they are attractive to criminals seeking to move, disguise, or legitimise funds.
Risk doesn’t only come from obviously problematic clients. It arises from everyday legal work, including:
- Conveyancing and property transactions
- Trust formation and administration
- Company incorporations and restructures
- Handling client funds, deposits, and settlements
- Cross-border parties or funding arrangements
- Complex or unclear beneficial ownership structures
If your firm touches any of the above, your RMCP is the bridge between legal services and regulated AML discipline.
The Real Compliance Shift: Evidence, Not Intention
Modern FICA compliance is outcomes-driven. Regulators increasingly expect firms to demonstrate, not just state, that controls exist and are applied.
This includes being able to show:
- Your risk assessment process
- Your client risk-rating logic
- Your CDD decisions and escalations
- Your training records
- Your monitoring and reporting workflow
In short: prove it.
The RMCP is designed to do exactly that, document the logic of your controls and make them repeatable across matters, teams, and offices.
What a Good RMCP Should Contain (In Practice)
A properly structured RMCP typically covers:
- Governance
Roles, accountability, approval structures, review cycles, and compliance ownership. - Risk Assessment Framework
A practice-level risk assessment and clear client-level risk-rating methodology. - Customer Due Diligence Controls
Identification and verification processes, beneficial ownership checks, ongoing due diligence, and triggers for enhanced due diligence. - Sanctions and PEP Controls
Screening processes, escalation pathways, approvals, and monitoring. - Monitoring and Reporting
Internal red flags, decision-making workflows, and when and how suspicious activity is reported. - Record-Keeping
What records are kept, how they are stored, and statutory retention periods. - Training
Onboarding training, annual refreshers, role-specific training, and documented attendance.
Common RMCP Mistakes Law Firms Make
Patterns that regularly fail under scrutiny include:
- Copy-and-paste RMCPs that don’t reflect the firm’s actual services or client profile
- No documented or applied risk assessment
- KYC done once with no ongoing monitoring or refresh triggers
- Beneficial ownership blind spots, especially with trusts and layered corporates
- Sanctions screening that is informal or undocumented
- Training with no evidence (no registers, no content logs, no refresh cycle)
A Quick RMCP Readiness Check
Ask yourself:
- Do we have a documented practice-level risk assessment aligned to our work?
- Can we explain and evidence how clients are risk-rated before instructions are accepted?
- Are beneficial ownership rules clearly documented and applied in files?
- Are sanctions and PEP triggers documented with escalation and sign-off?
- If the FIC asked tomorrow, could we produce our RMCP and show it is implemented in real matters?
If any of these answers are “not quite”, your RMCP likely needs attention.
The Takeaway
An RMCP is not admin.
It is your firm’s compliance operating system.
It reduces regulatory exposure, standardises decision-making, and ensures that when your firm says “we comply with FICA”, it can demonstrate that compliance, file by file, matter by matter.
Less exciting than litigation, perhaps.
But significantly less expensive than a regulatory learning experience.
Contact Us
If you require assistance drafting or updating your RMCP, conducting a practice-specific risk assessment, or stress-testing your current FICA controls against regulatory expectations, please contact Mc Kelvey Inc. for professional legal support.
Disclaimer
The information contained in this article is provided for general informational purposes only and does not constitute legal advice. Laws, regulations, and regulatory guidance may change, and the content may not reflect the most recent developments. You should not act, or refrain from acting, on the basis of this information without obtaining legal advice tailored to your specific circumstances. Mc Kelvey Inc. accepts no liability for any loss or damage arising from reliance on this content.