SARB Hits Three Firms With R35.6 Million in AML Penalties

The South African Reserve Bank (SARB) imposed financial penalties totalling R35.6 million on Capitec Bank Limited, Albaraka Bank Limited, and Ninety One Assurance Limited. Announced on 11 September 2026, the administrative sanctions followed inspections conducted by the Prudential Authority under section 45B of the Financial Intelligence Centre Act 38 of 2001. The findings covered customer due diligence, regulatory reporting, sanctions screening, terrorist property reporting, employee training, and institutional risk governance. All three institutions cooperated with the authority and either completed or undertook the required remediation.

South Africa AML penalties include R28 million against Capitec

Capitec received five cautions and a R28 million financial penalty, of which R5.5 million was conditionally suspended for 36 months from 13 October 2025. The measures followed an inspection conducted in 2023. A R10 million component, including R3 million suspended, arose because the bank had not conducted adequate customer due diligence on sampled client files, contrary to section 21 read with sections 42(1) and 42(2)(d). A further R5 million, including R1 million suspended, concerned inadequate enhanced due diligence under section 21A read with sections 42(1) and 42(2)(e). Another R5 million, also including R1 million suspended, addressed inadequate ongoing due diligence under section 21C read with sections 42(1) and 42(2)(g). These three findings collectively demonstrate weaknesses at the initial, enhanced, and continuing stages of the customer relationship. The authority separately imposed R3 million because Capitec had not provided ongoing training to sampled employees as required by section 43. The remaining R5 million component, including R500,000 suspended, related to section 42 deficiencies. Capitec had not obtained management approval for its business banking name-screening and payment-screening investigation manuals before implementing them. It also could not evidence that end-to-end processes for terrorist property reporting had been documented and approved before the inspection notification arrived. Its Risk Management and Compliance Programme did not adequately establish the relevant policies, procedures, standards, and controls for terrorist property reporting and financial sanctions. These findings are significant because effective screening depends on approved investigation methods, clear decision-making responsibilities, documented escalation routes, and reliable reporting processes. Capitec cooperated with the authority to remediate the identified deficiencies and control weaknesses.

Albaraka penalised for late regulatory reports and weak governance

Albaraka received three cautions and a R1.6 million financial penalty following an inspection conducted in 2021. Of that amount, R440,000 was conditionally suspended for 36 months from 10 June 2024. The bank failed to submit 232 Cash Threshold Reports or Aggregated Cash Threshold Reports within the required period, contrary to section 28 read with Regulation 24(4). That finding resulted in a R100,000 component, including R40,000 suspended. Albaraka also submitted 144 Suspicious Transaction Reports or Suspicious Activity Reports late, breaching section 29 read with Regulation 24(3), for which the authority imposed R500,000. Delayed submissions can reduce the operational value of financial intelligence because investigators may need prompt information to identify connected accounts, compare activity across institutions, or trace funds before they are transferred elsewhere. The remaining R1 million component, including R400,000 suspended, concerned section 42. Albaraka had not sufficiently documented the rationale for assessed risk factors and their assigned weightings, the events that should trigger review or alteration of a customer’s rating, and the industries, activities, or business relationships that it prohibited. It also failed to evidence adequate consideration of the geographical locations in which it operated and where its customers were based when assessing exposure to illicit finance and terrorist financing. Additional findings concerned the review and approval of the institutional programme, related assessments and policy documents, and implementation across customer checks, cash reporting, and suspicious reporting. The authority had separately imposed a R2 million sanction, including R600,000 suspended, for alleged deficiencies involving sampled trade finance clients. Albaraka appealed that finding under section 45D, and the Appeal Board set the sanction aside. It is therefore not included in the final R1.6 million outcome. Albaraka cooperated and remediated the identified deficiencies and weaknesses.

Ninety One receives R6 million penalty after its 2023 inspection

Ninety One received two cautions, two reprimands, and a R6 million financial penalty, of which R2.5 million was conditionally suspended for 36 months from 19 June 2025. The decision followed a 2023 inspection. A R2.5 million component, including R1.5 million suspended, arose because the insurer did not conduct adequate enhanced due diligence on some sampled client files, contrary to section 21A read with its own Risk Management and Compliance Programme. Enhanced examination is intended to provide a deeper understanding of customers presenting greater exposure, including their circumstances, associated parties, sources of funds where applicable, and the purpose and expected nature of their relationships. The second component amounted to R3.5 million, including R1 million suspended, and addressed section 42 deficiencies. Ninety One had not adequately developed, documented, maintained, or implemented a programme capable of effectively identifying, assessing, monitoring, mitigating, or managing exposure associated with sanctions screening, prominent influential person screening, its business, and its clients. It also failed to provide evidence of adequately documented and implemented policies, procedures, and controls explaining how applicable obligations would be fulfilled. The findings demonstrate that including a control topic within a high-level policy is insufficient when the institution cannot evidence the operational processes supporting it. Screening governance should define data sources, matching logic, alert ownership, escalation standards, approval responsibilities, investigation records, periodic testing, and treatment of changes affecting an existing relationship. Ninety One cooperated with the authority and indicated that it had undertaken the remedial action required to address the deficiencies and control weaknesses.

The three cases expose failures across the preventive lifecycle

Although the notices were issued together, they address different weaknesses and should not be treated as interchangeable. Capitec’s findings span the broadest range of preventive controls, covering initial customer checks, enhanced examination, continuing reviews, staff training, name and payment screening, financial sanctions, and terrorist property reporting. Albaraka’s case combines delayed transaction reporting with insufficient documentation, approval, and implementation of its institutional framework. Ninety One’s case concentrates on enhanced customer review and the design and implementation of screening and risk-management processes. The combined R35.6 million includes R8.44 million in conditionally suspended amounts, comprising R5.5 million for Capitec, R440,000 for Albaraka, and R2.5 million for Ninety One. This leaves R27.16 million that was not described as suspended. A suspended amount remains part of the sanction and may become payable if the applicable conditions are breached during the specified period. It is legally and financially different from Albaraka’s separate R2 million measure, which was overturned and no longer forms part of the operative outcome. None of the three notices alleges that the institutions knowingly processed criminal proceeds or intentionally assisted offenders. The enforcement actions concern preventive control deficiencies established through supervisory inspections. Nevertheless, such weaknesses can restrict an institution’s ability to detect unusual behaviour, establish whether transactions match a customer’s known profile, identify prohibited exposure, and supply useful intelligence to competent authorities within the required period.

The enforcement message extends beyond the monetary penalties

The three decisions show that institutions must maintain an evidential chain connecting enterprise-wide assessments to individual customer decisions, transaction monitoring, screening, investigation, escalation, reporting, training, and senior-management oversight. Written frameworks must explain how material exposure is identified, classified, controlled, reviewed, and escalated, while operational records must demonstrate that employees followed those processes in practice. The Albaraka findings illustrate the importance of measurable filing controls capable of identifying approaching deadlines, rejected submissions, incomplete reports, and unresolved exceptions. Its governance deficiencies also show that risk-rating methodologies require documented reasoning, particularly for geographic exposure, prohibited relationships, and events that should prompt reassessment. The Capitec findings demonstrate why controls must cover the entire customer lifecycle and why investigation manuals require proper approval before use. They also underline the need to establish terrorist property reporting procedures before a potential match occurs, rather than attempting to design them during an actual escalation. The Ninety One findings reinforce the expectation that sanctions and influential-person screening must be supported by documented, implemented, and testable procedures. Across all three cases, cooperation and remediation did not remove accountability for historical deficiencies. Boards and senior managers should therefore use these decisions as a basis for targeted assurance work, including file sampling, filing-timeliness reviews, screening effectiveness tests, employee-training assessments, and confirmation that approved policies match current operational practice. The central lesson is that technical compliance cannot be separated from control effectiveness. An institution may possess policies, platforms, and specialist teams, but it remains exposed if it cannot show how those components work together, how exceptions are resolved, and how significant decisions are recorded. The R35.6 million outcome therefore represents more than three isolated enforcement measures. It is a clear supervisory warning that incomplete documentation, delayed reporting, inadequate customer review, and poorly evidenced screening governance can each create serious vulnerabilities, even where no underlying laundering transaction has been established.

The three financial penalties total R35.6 million, including R8.44 million conditionally suspended.

Capitec received a R28 million penalty covering customer reviews, training, screening governance, and terrorist property reporting.

Albaraka received a R1.6 million penalty after 232 late cash-related reports, 144 late suspicious reports, and institutional programme deficiencies.

Ninety One received a R6 million penalty relating to enhanced customer reviews, sanctions screening, and prominent influential person controls.

A separate R2 million sanction against Albaraka was set aside on appeal and is excluded from the operative total.

Frequently Asked Questions

What penalties were imposed on the three institutions?

The financial penalties totalled R35.6 million, comprising R28 million for Capitec, R1.6 million for Albaraka, and R6 million for Ninety One. The combined amount includes R8.44 million conditionally suspended for 36 months.

How much of Capitec’s R28 million penalty was suspended?

R5.5 million was conditionally suspended for 36 months from 13 October 2025. The suspended components related to customer checks, enhanced and ongoing reviews, and weaknesses involving terrorist property reporting and financial sanctions.

What reporting failures were identified at Albaraka?

Albaraka submitted 232 Cash Threshold Reports or Aggregated Cash Threshold Reports late. It also filed 144 Suspicious Transaction Reports or Suspicious Activity Reports outside the required period.

Why was the separate R2 million Albaraka sanction excluded?

Albaraka appealed the measure concerning due diligence on sampled trade finance clients under section 45D. The Appeal Board set it aside, so it does not form part of the operative R1.6 million penalty.

What weaknesses were found at Ninety One?

Ninety One did not adequately perform enhanced due diligence on some sampled client files. Its institutional programme also contained deficiencies concerning sanctions screening, prominent influential person screening, and the documentation and implementation of related controls.

Did the authority accuse the institutions of laundering money?

No. The notices address non-compliance with preventive obligations and do not allege that the institutions knowingly laundered criminal proceeds. A regulator can impose sanctions for ineffective controls without establishing a completed underlying offence.

Why are the suspended amounts still important?

A suspended component remains part of the financial penalty, although payment is conditional during the specified 36-month period. It differs from a sanction overturned on appeal, which no longer forms part of the enforceable outcome.

What should other institutions learn from these cases?

Institutions should test the complete control chain from customer identification and risk classification through monitoring, screening, investigation, reporting, training, and governance. They must also retain evidence showing that procedures were approved, implemented, tested, and corrected when deficiencies emerged.

Financial Intelligence Centre Act 38 of 2001

Prudential Authority AML and CFT Supervision

Financial Intelligence Centre Compliance Resources

FATF South Africa Mutual Evaluation

Julius Baer Monaco Fined €1.5m for Serious AML Failings

Lombard Odier Fined 3 Million Francs in Major Money Laundering Ruling

ABN AMRO Fined €8.5 Million by Dutch Central Bank

Some of FinCrime Central’s articles may have been enriched or edited with the help of AI tools. It may contain unintentional errors.

Want to promote your brand, or need some help selecting the right solution or the right advisory firm? Email us at info@fincrimecentral.com; we probably have the right for you.