How FIC Directive 10 Turns Group Footprint Data Into a Monitoring Coverage Question

FIC Directive 10 reads like an administrative rule, and in one sense it is. Directive 10 of 2026 specifies the geographic location particulars that must accompany an accountable institution’s registration with the Financial Intelligence Centre under section 43B of the Financial Intelligence Centre Act, 2001 (FICA). It was signed by the FIC Director on 31 July 2026 and took effect on publication in the Government Gazette.

The Directive does not mention transaction monitoring. The FIC’s stated purpose is to help it and supervisory bodies understand group structures and apply risk-based supervision of group-wide compliance. That purpose is the link for a risk leader. A group that must tell the supervisor where it operates should be able to show that its monitoring covers those places.

This article sets out what the Directive requires, what the FIC has said about scope, and a reconciliation that connects the registered footprint to monitoring coverage.

The registered footprint and the monitoring coverage map should agree, and a change to either should trigger a check of the other.

What Directive 10 requires

An accountable institution with operations in more than one geographic location must give, when it registers, the name, licence number and registration number where applicable, the business address and the contact details of the person carrying out the compliance function under section 42A(2)(b) of FICA, for its head office, each branch, each subsidiary’s head office and each subsidiary’s branches, in South Africa and abroad. Institutions already registered when the Directive commenced must update their registration within 90 days of commencement, and must update again within 90 days after any change. Failure to comply is non-compliance that can attract an administrative sanction under FICA.

The Directive applies to the accountable institutions in items 1, 2, 3, 9, 11 (excluding banks, mutual banks and co-operative bank credit providers), 14, 20, 21 and 22 of Schedule 1 to FICA. Moonstone’s report of the final Directive maps these to legal practitioners, certain trust and company service providers, estate agents, gambling institutions, credit providers other than banks, Postbank, high-value goods dealers, the South African Mint and crypto asset service providers. The draft had covered every Schedule 1 institution, and the FIC has indicated that a further directive may follow for the financial institutions sector.

What counts as a branch

The Directive defines a branch as a physical office, not a separate legal entity or accountable institution, located away from the head office, where business is conducted for the institution and products and services are provided to clients. In its consultation feedback, as reported by Moonstone, the FIC said this means premises where Schedule 1 products and services are provided directly and in person to clients. It said the Directive does not reach data centres, ATMs, remote-working locations or virtual platforms. A business that operates mainly through a virtual platform must still give its head office, and where it uses third-party agents to engage clients, the agents’ branches must be listed.

The FIC also said the Directive does not require branches or subsidiaries to register as separate accountable institutions.

Why the footprint list is not the monitoring perimeter

The two lists answer different questions. The registered footprint says where the institution provides services in person. Monitoring coverage says which customers, products and channels generate alerts and who reviews them. A virtual product sold nationally may have no branch to list yet carry most of the transaction risk, and a branch may be listed that handles few transactions.

The reconciliation is therefore a check, not a rule: for each listed location and the head office, can the group show which monitoring rules, case queue and named reviewer cover its customers and products, and for each monitored product, can it show where it is delivered from?

Dates and the next update

The Directive took effect on publication in Government Gazette No. 55097 of 31 July 2026, as reported by Moonstone. On a count of 90 days from 31 July 2026, the first update window runs to 29 October 2026. That date is calculated; each institution should confirm it against its own reading of the commencement date. After that, any change to the particulars must be updated within 90 days.

The FIC has said further guidance will explain how the information must be submitted, and that submissions will go through a dedicated category on its registration and reporting platform that does not affect existing reporting.

Four checks for risk leaders

The Directive is an obligation about registration. These four checks use it to test something it does not require.

How Nexiant supports group coverage mapping

FraudShield, Nexiant’s specialist transaction-monitoring brand, is built around real-time detection, configurable rule logic and case-management workflows. For group coverage mapping, the useful tests of any monitoring capability are whether alerts can be traced to the location or channel they came from, whether rule sets can be compared across subsidiaries, and whether changes to configuration are recorded. Nexiant brings these questions together across compliance, fraud and monitoring as a design discipline, not as a claim about one integrated system.

Frequently Asked Questions

This article was accurate at the time of publication in October 2026 and is intended for general informational purposes only. It does not constitute legal, regulatory or compliance advice. Organisations should seek qualified professional guidance in relation to their specific obligations.