What is the grey list?

Role of the Reserve Bank

Four South African banks hit with administrative sanctions

What is the grey list?

The grey list is a public document that is issued three times a year by the Financial Action Task Force (FATF). The FATF is a global inter-governmental body which was founded in 1989 with the mandate to develop and promote policies and define international policies regarding anti-money laundering (AML). In 2001, its mandate was expanded also to counter the financing of terrorism (CFT). Currently, the FATF comprises 39 members—for example, South Africa, Mozambique, and Namibia. According to Cliffe Dekker Hofmeyr (CDH), some of the features of the FAFT grey list are:

The list publicly identifies a country with serious deficiencies regarding AML/CFT. As a result, the country is subjected to, ‘among other things, increased monitoring by the FATF.’

‘A country is typically placed on the grey list when there are serious deficiencies through the mutual evaluation exercise, but despite such deficiencies, the country is actively working with the FATF to address the deficiencies in their regimes.’

Increased monitoring means the country has ‘committed to resolving the identified deficiencies within an agreed time frame and with the FATF monitoring such implementation.’

Greylisting is not a punitive action, but rather additional support and motivation for countries.

The FATF placed South Africa on its grey list in February 2023, after failing to address the 67 recommendations (Action Items) issued by the task force to act against money laundering and the financing of terrorism. The recommendations were issued after an onsite visit by the FATF in 2019. Since February 2023, the country has made significant progress in addressing the Action Items. However, in July 2026, the National Treasury announced that the country is not expected to exit the grey list before June 2026. In a statement issued on 2 July 2026, the National Treasury noted ‘that while South Africa is on track to address all the outstanding Action Items, it remains a tough challenge to address all 14 of the Action Items by February 2026.’ Treasury emphasised that ‘all relevant agencies and authorities will need to continue to demonstrate significant improvements,’ adding that the improvements must be effective and sustainable.

🏆10 Best Forex Brokers in South Africa

Rank	Broker Review	Regulators	Minimum Deposit	Visit Broker
🥇	Read Review	ASIC, FSA, CBI, BVI, FSCA, FRSA, CySEC, ISA, JFSA	$100	Visit Now
🥈	Read Review	FSCA, FCA, DFSA, FSA, CMA	$0	Visit Now
🥉	Read Review	CySEC, IFSC, DFSA, FCA	$5	Visit Now
4	Read Review	ASIC, CySEC, FSA, SCB	$0	Visit Now
5	Read Review	FSA, FSCA	$250	Visit Now
6	Read Review	FSA, FSC, FSCA, ASIC, CMA	$20	Visit Now
7	Read Review	FSC, FSCA	$50	Visit Now
8	Read Review	ASIC, CySEC, FSCA, FSA, FSC, CMA	$100	Visit Now
9	Read Review	CySEC, MWALI, FSCA	$25	Visit Now
10	Read Review	FSA, CySEC, FSCA, FSC	$10	Visit Now

Role of the Reserve Bank

The South African Reserve Bank is one of the large number of government authorities that is tightening the screws to address the outstanding deficiencies listed on FATF’s grey list. In an address to the Financial Sector Conduct Authority industry on 13 March 2026, Lesetja Kganyago (governor of the Reserve Bank) said that he is confident South Africa will be removed from FATFs grey list by the next review date of the watchdog during early 2026. Kganyago said that the Reserve Bank are ‘implementing fixes.’ The Prudential Authority (PA) of the South African Reserve Bank plays a major role in the bank’s efforts to address and rectify failures regarding money laundering and the financing of terrorism in the South African banking industry. The Prudential Authority (PA) The Prudential Authority (PA) is a juristic person that operates within the administration of the South African Reserve Bank (SARB). The PA was established on 1 April 2018. The PA ‘regulates financial institutions and market infrastructures to promote and enhance their safety and soundness, and support financial stability,’ according to the Reserve Bank. The FIC Act is an important tool used by the Prudential Authority to identify and penalise South African banks involved in unlawful activities. The FIC Act The FIC Act (Act 38 of 2001), short for the Financial Intelligence Centre Act, (in this article also referred to as the Act) was introduced on 1 July 2003, establishing a juristic person, the Financial Intelligence Centre (FIC) with, in terms of section 3 of the Act, amongst others, the following objectives:

assisting in the identification of the proceeds of unlawful activities, as well as in the identification of persons involved in money laundering activities, and

the combating of money laundering activities, and the financing of terrorist and related activities.

In addition, in terms of section 3 (2) of the Act, the FIC is required ‘to make the information it collects and produces available to’ various other institutions involved in the processes. For instance:

an investigating authority,

the National Prosecuting Authority,

the South African Revenue Service (SARS), or

a Special Investigating Unit, and the office of the Public Protector, to name a few.

For a detailed list of the FIC’s objectives, refer to section 3 (Objectives) of the FIC Act. Regarding the sections of the Act cited by the Prudential Authority (PA) for non-compliance by the banks, sections 21(1) and 21A to 21H and section 42 are applicable. Sections 21(1) and 21A to 21H are categorised into Chapter 3 of the Act under the heading: Money laundering, financing of terrorist and related activities and financial sanctions control measures.

Section 21 (1) - Identification of clients and other persons

When engaging with a prospective client ‘to enter into a single transaction or to establish a business relation,’ an accountable institution is obliged to:

establish and verify the identity of the client, or

establish the identity of a person on whose behalf the client is acting, or

establish and verify the identity of the person who is acting on behalf of the client, as well as the person’s authority to act on behalf of the client.

Sections 21A to 21H

Section 21A requires that an accountable institution understands the business relationship as contemplated in section 21 and obtains information ‘to reasonably enable the accountable institution to determine whether future transactions that will be performed in the course of the business relationship concerned are consistent with the institution’s knowledge of that prospective client.’ Sections 21B to 21H cover, inter alia, the following aspects:

Section 21B - Additional due diligence measures relating to legal persons, trusts, and partnerships.

Section 21C - An accountable institution is required to conduct ongoing diligence regarding a business relationship, including the monitoring of transactions such as the source of funds (where necessary), ensuring that the transactions are consistent with the accountable institution’s knowledge of the client and the client’s business and risk profile.’

Section 21D - When an accountable institution has doubts about the veracity or adequacy of previously obtained information, the institution must repeat the steps described in sections 21 and 21B ‘to the extent that it is necessary to confirm the information previously obtained.’

Section 21E - If an accountable institution is not able to:

- establish and verify the identity of a client or other relevant person in terms of section 21 or 21B, - obtain the information described in section 21A, or - conduct ongoing due diligence as per section 21C, the institution is prohibited to:

establish a business relationship or conduct any transaction with a client, or

conclude a transaction in the course of a business relationship.

The institution is also required to terminate an existing business relationship with a client.

Section 21F - If a prospective client is a ‘foreign politically exposed person,’ the accountable institution is legally bound to:

- obtain senior management approval before establishing the business relationship, - ‘take reasonable measures’ to determine the client’s source of wealth and source of funds, and - execute ‘enhanced ongoing monitoring’ of the business relationship.

Section 21G - The requirements of section 21F are also applicable when a prospective client, or the beneficial owner of that prospective client, is a ‘domestic politically exposed person or a prominent influential person.’

Section 21H - This section clarifies the term ‘exposed person’ referred to in sections 21F and 21G, saying it indicates ‘immediate family members and ‘known close associates of a foreign or domestic politically exposed person or a prominent influential person.’

According to section 21H, an immediate family member includes: - the spouse, civil partner, or life partner, or the previous spouse, civil partner, or life partner, if applicable, - children and step-children and their spouse, civil partner, or life partner, - parents, and - sibling and step-sibling and their spouse, civil partner, or life partner.

Section 42 - Risk Management and Compliance Programme (RMCP)

Section 42(1) requires an accountable institution to ‘develop, document, maintain, and implement a programme for anti-money laundering, counter-terrorist financing, and proliferation financing risk management and compliance.’ Subsection (2) of section 42 states that a risk management and compliance programme must enable the accountable institution to identify, assess, monitor, mitigate, and manage the risk which new and existing products rendered by the institution ‘may involve or facilitate money laundering activities, the financing of terrorist and related activities or proliferation of financing activities.’ Paragraphs (2)(b) to (2)(s) of subsection (2) describe the provisions a RMCP must provide for. For example: - ‘provide for how and the processes by which the institution conducts additional due diligence measures in respect of legal persons, trusts, and partnerships,’ paragraph (2)(f), - ‘provide for how the accountable institution will terminate an existing business relationship as contemplated in section 21E,’ paragraph (2)(k), - ‘provide for how and place at which the records are kept…,’ paragraph (2)(n), - provide for the processes for reporting information to the Financial Intelligence Centre (FIC), paragraph (2)(p), and - provide for any prescribed matter. Furthermore, in terms of section 42, an accountable institution is legally bound to take the following actions: - indicate in its risk management and compliance programme whether any paragraph of subsection (2) does not apply to the institution and provide the reason why it is not applicable (subsection (2A)), - the board of directors, senior management, or other person or group of persons exercising the highest level of authority must approve the institution’s RMCP (subsection (2B)), - review its RMCP at regular intervals, ensuring that the programme remains relevant to the institution’s operations (subsection (2C)), - make documentation describing the institution’s RMCP available to each of its employees involved in transactions to which the FIC Act applies (subsection (3)), For detailed descriptions of the sections referred to above, refer to the Financial Intelligence Centre Act.

Four South African banks hit with administrative sanctions

The four banks discussed below serve only as an example of the Reserve Bank’s efforts to get the country off the grey list. The banks are listed in alphabetical order,

Bank of China

Reserve Bank announcement

The Prudential Authority (PA) of the South African Reserve Bank (SARB) stated on 7 June 2026, announcing that it has imposed administrative sanctions on the Johannesburg branch (BOC Jhb) of the Bank of China.

Inspection preceding the announcement

A FIC Act inspection was conducted in 2021 during which certain data for the period from 2016 to 2020 was assessed.

Reasons for administrative sanctions, cautions, and penalties

The administrative sanctions comprise four cautions, a reprimand, and a financial penalty amounting to R30.5 million, of which an amount of R15.25 million is conditionally suspended for 36 months as of 19 March 2026. The reasons for the administrative sanctions are as follows:

The bank failed to comply with its Customer Due Diligence (CDD) obligations as per sections 21(1) and 21A of the Act.

The bank was cautioned to not repeat the conduct leading to the non-compliance and received a financial penalty of R20 million, of which 50% is conditionally suspended for 36 months.

BOC Jhb did not comply with its ‘Suspicious and Unusual Transaction Reporting (STR) obligations,’ failing to promptly report suspicious transactions and/or activities to the FIC.

Not complying with FIC Directive 5 of 2019, neglecting to timeously attend to its automated transaction monitoring system alerts within the prescribed 48-hour period.

The PA cautioned the bank not to repeat this infringement and issued a penalty of R500 000, of which R250 000 is conditionally suspended for 36 months.

BOC Jhb did not comply with some requirements of section 42 of the Act. For instance:

failed to adequately develop and document its RMCP regarding its dormant accounts, and
neglected to ensure that its board of directors customise and approves its RMCP.

The PA imposed a caution not to repeat the non-compliance infringement, while a penalty of R10 million was issued, of which 50% is conditionally suspended for 36 months.

The bank’s response

BOC Jhb cooperated with the PA and committed to applying the necessary remedial actions to tackle the ‘identified compliance deficiencies and control weaknesses.’

Bidvest Bank

Reserve Bank announcement

The Reserve Bank has imposed administrative sanctions on Bidvest Bank based on the outcome of a FIC Act inspection executed by its Prudential authority (PA). The sanctions were announced in a press statement on 4 October 2026.

Inspection preceding the announcement

The sanctions imposed by the Reserve Bank follow an inspection conducted in 2022.

Reason for administrative sanctions, caution, and penalty

Bidvest Bank failed to comply with section 42 of the FIC Act, failing to implement its RMCP ‘in relation to the assessed trade-based transactions in respect of a sample of clients assessed.’ A caution was imposed, warning the bank not to repeat the conduct which led to the non-compliance. In addition, a financial penalty was issued, of which R2.5 million was conditionally suspended for twelve months, as of 23 August 2026.

HSBC Bank

Reserve Bank announcement

The South African Reserve Bank has imposed administrative sanctions on the Johannesburg branch of HSBC Bank Plc, announcing the sanctions in a press statement on 4 October 2026.

Inspection preceding the announcement

A FIC Act inspection was conducted in 2021.

Reasons for administrative sanctions, cautions, and penalties

The Johannesburg branch of the bank failed to comply with certain requirements of the Act, resulting in three cautions and a financial penalty amounting to R9.5 million, of which R4 million is conditionally suspended for 36 months, starting 10 June 2026. The reasons for the administrative sanctions are as follows: - HSBC failed to comply with its customer due diligence (CDD) obligations as described in sections 21(1) and/or 21A to 21H of the Act, failing to acceptably execute CDD on ‘sampled active customer relationships.’ The Reserve Bank also referred to the following infringement, saying: ‘The non-compliance inter alia included deficiencies in the identification and verification of the beneficial owners of clients.’ The PA cautioned the bank not to repeat the conduct leading to the non-compliance. The financial penalty is R5 million - R2.5 million conditionally suspended for 36 months. - Failing to comply with Directive 5 of the Act for not attending automated transaction monitoring systems (ATMS) alerts within the required period of 48 hours. A caution not to repeat ignoring ATMS alerts accompanied a financial penalty of R1.5 million. - The HSBC (Jhb branch) failed to comply with section 42 of the FIC Act for not ‘adequately develop and or/implement its RMCP’ that would effectively allow the branch to identify and verify beneficial owners of clients. Regarding this infringement, the bank was also cautioned not to repeat it, while a financial penalty of R3 million was issued, of which 50% was conditionally suspended for a period of 36 months.

The bank’s response

HSBC cooperated with the Prudential Authority and has committed to implement the required ‘remedial action to address the identified compliance deficiencies and control weaknesses,’ according to the SARB.

Sasfin Bank

Sasfin announcement

In a SENS announcement on 6 August 2026, Sasfin Holdings limited (the parent company of Sasfin Bank) advised shareholders that Sasfin Bank received notice of administration sanctions from the PA of the Reserve Bank in terms of the Bank Act, Financial Sector Regulation Act, and the FIC Act on 1 August 2026.

Reasons for administrative sanctions, and penalties

According to the SENS announcement, the ‘sanctions principally relate to allegations of historic non-compliance with Sasfin Bank’s discontinued foreign exchange business.’ R49.05 million of the financial penalty of R209.69 million is suspended, leaving the bank liable for a penalty of R160.64 million.

The bank’s response

In the SENS announcement, Sasfin Holdings said that it has and continues to work ‘proactively and transparently with the relevant authorities and regulators.’ Sasfin has also taken legal advice and is contemplating further representations ‘which could result in a review or appeal of the sanctions in terms of the provisions of the relevant regulators.’