Risk Under Review: What Guidance Note 7B Means For Accountable Institutions

The Financial Intelligence Centre (“FIC”) has published Guidance Note 7B (“GN 7B”), introducing a targeted but important update to the application of the risk-based approach under the Financial Intelligence Centre Act, 2001 (“FICA”).

Issued on 3 August 2026 in terms of section 4(c) of FICA, GN 7B follows the publication of draft amendments for public consultation on 12 June 2026. The consultation process attracted comments from the banking industry, crypto asset service providers, legal practitioners and a range of other stakeholders before the guidance was finalised. While GN 7B does not replace Revised Guidance Note 7A, it updates Chapter 1 in several important respects and provides greater clarity on the FIC's expectations regarding risk assessment, due diligence and the management of financial crime risks.

The amendments are technical rather than fundamental, but they should not be viewed as minor. Together, they reinforce the direction in which South Africa's anti-money laundering and counter-financing framework continues to develop and provide accountable institutions with a clearer indication of how the FIC expects the risk-based approach to be implemented in practice.

Perhaps the most noticeable change is the express inclusion of proliferation financing throughout the guidance. Revised Guidance Note 7A referred primarily to money laundering and terrorist financing. GN 7B now consistently refers to money laundering, terrorist financing and proliferation financing (“ML, TF and PF”), integrating proliferation financing into the broader compliance framework rather than treating it as a separate or peripheral issue.

GN 7B also introduces a definition of proliferation financing, describing it as including activities that provide property, financial services or economic support which may be used in connection with the manufacture, acquisition, possession, development, transport, transfer or use of nuclear, chemical or biological weapons and their means of delivery, including conduct that constitutes an offence under section 49A of FICA.

Although this may appear to be a drafting exercise, it has practical implications. The consistent inclusion of proliferation financing throughout Chapter 1 makes it clear that accountable institutions are expected to consider it alongside money laundering and terrorist financing when identifying, assessing and mitigating financial crime risks. Institutions should therefore ensure that their existing risk frameworks adequately recognise and address all three risk categories.

Another important development is the additional guidance dealing with new products, business practices and technology. GN 7B provides that accountable institutions should identify and assess the ML, TF and PF risks arising from new products, new business practices, new delivery mechanisms and the use of new or developing technologies. Importantly, this applies not only to entirely new products but also to existing products that are enhanced or delivered through new technology. The guidance further states that these assessments should be reflected in the institution's risk assessment processes and its Risk Management and Compliance Programme (“RMCP”).

This clarification is particularly relevant as financial institutions continue to invest in digital transformation. Artificial intelligence (“AI”), digital onboarding, automated monitoring systems, embedded finance, payment innovations and new customer delivery channels all present opportunities for growth, but they may also introduce new financial crime risks. GN 7B makes it clear that where suspicion arises, simplified due diligence is no longer appropriate and enhanced due diligence measures become necessary..

The guidance also provides greater clarity on risk classification. GN 7B states that under-served or low-income persons should not automatically be regarded as presenting a lower ML, TF or PF risk. Instead, accountable institutions are expected to conduct a comprehensive risk assessment before concluding that a business relationship, transaction or category of clients presents a lower level of risk.

This is an important clarification because it reinforces one of the central principles of the risk-based approach. Risk classifications should be evidence-based and supported by objective factors rather than assumptions about particular client groups. A client's financial circumstances alone should not determine the level of due diligence that will be applied.

GN 7B also clarifies the circumstances in which simplified due diligence may not be used. While Revised Guidance Note 7A recognised that simplified due diligence could be appropriate where the assessed risk was lower, GN 7B now expressly provides that simplified due diligence must not be applied where there is a suspicion of money laundering, terrorist financing or proliferation financing. In those circumstances, the business relationship or transaction automatically presents a high risk. The accountable institution must apply enhanced due diligence and submit a report in terms of section 29 of FICA.

Although this position is consistent with the principles already underpinning the risk-based approach, the new wording removes any uncertainty. A client initially assessed as low risk cannot continue to benefit from simplified due diligence once suspicious circumstances emerge. Institutions are expected to respond dynamically to changing risk rather than relying solely on the client's original classification.

Importantly, GN 7B should not be viewed as creating an entirely new compliance framework. The underlying obligations continue to arise from FICA and the existing risk-based approach. What GN 7B does is articulate the FIC's expectations more clearly and provide additional guidance on how those obligations should be implemented in practice.

That does not mean accountable institutions can simply note the publication and continue business as usual. The publication of GN 7B provides an appropriate opportunity to review existing compliance frameworks against the updated guidance.

In particular, accountable institutions should revisit their RMCPs to ensure that they reflect the changes introduced by GN 7B. Even where institutions already have mature AML, CFT and CPF frameworks in place, the updated guidance warrants a fresh review of existing documentation to confirm that it remains aligned with the FIC's current expectations.

More broadly, institutions should also consider whether their governance structures, product approval processes, customer onboarding procedures, transaction monitoring controls and staff training continue to reflect the evolving financial crime landscape. As financial services become increasingly digital and new technologies continue to reshape the market, risk management frameworks must evolve alongside them.

The publication of GN 7B is therefore less about introducing new compliance obligations than it is about refining existing expectations. It reinforces that the risk-based approach remains the cornerstone of South Africa's AML, CFT and CPF framework, but that the quality of an institution's implementation will increasingly be measured by the effectiveness of its documented processes, governance and ongoing assessment of emerging risks.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.