Thilomi Govender, Financial Crime Compliance Manager, nCino KYC. Many South African businesses unknowingly enable money laundering due to weak controls, poor due diligence, or a lack of employee training. Doing so puts them at risk of losing everything.This is according to Thilomi Govender, Financial Crime Compliance Manager at nCino KYC, who was speaking ahead of the Fighting Financial Crime Conference on Anti-Money Laundering (AML) and FICA compliance.Govender says South African businesses are estimated to launder billions annually as part of increasingly sophisticated operations. However, many of them do so unwittingly.“The Financial Action Task Force (FATF) greylist in October 2025 was likely what rocked the boat. We find that most South African accountable institutions are taking a hard stand about improving things and ensuring that they are FICA compliant by finding the right screening solutions and trying to do work with companies like ourselves, for instance. A lot of prosecutions have taken place, and a lot of learning and development has taken place,” she says.However, some are still at risk of significant fines and even imprisonment. Businesses face up to 15 years’ imprisonment, fines up to R100 million, asset forfeiture, and licence suspension for non-compliance.Govender says: “The Prevention of Organised Crime Act (POCA) does not require proof of intent in all instances. In certain circumstances, negligence or willful blindness is sufficient for a conviction. So a business owner who ought reasonably to have known that the funds were the proceeds of crime, can be prosecuted. A devastating parallel mechanism is civil asset forfeiture. Under Chapter 5 and Chapter 6 of POCA, the asset forfeiture unit (AFU) can apply to court to seize and forfeit those assets, including the business itself, and they can do that without a criminal conviction. So if your assets are connected, even passively, to the proceeds or instrumentalities of crime, and you cannot demonstrate that you took reasonable steps to prevent it, the state has the legal tools to take them away.”In addition, under the FIC Act, administrative sanctions apply where accountable institutions fail to meet their compliance obligations. Govender says: “The FIC can also impose a fine of up to R50 million, and they can issue remedial orders. They can recommend suspension of business activities - even where no actual money laundering is proven. Another devastating consequence is reputational damage. Banks and insurers can terminate the business relationship and suppliers and clients may even walk away from that business. Regulatory deregistration can also take place. It's a real possibility for licensed entities such as financial service providers, estate agents or any other accountable institution who holds some regulatory licence.”Govender says: “Real estate transactions are a major vector for money laundering. Property is bought using dirty money - sometimes through a third-party or even a shelf company - and is later sold at market value, producing clean proceeds. Estate agents and conveyancers who fail to conduct proper due diligence on the source of the funds used to buy property become unknowingly involved in facilitating financial crime. Cash-intensive businesses are also a common entry point - the second-hand goods, scrap metal dealers, independent used car dealerships are frequently used to blend illicit cash with legitimate revenue.“There will also be some businesses that have intent, because they can make a quick buck here and there and many money laundering scenarios present themselves as unusually attractive propositions. However, many businesses are really struggling to identify suspicious activities. This may be because their staff are not properly trained and don’t know what to look for, or because they don't have a tool in place to assist them to screen for targeted financial sanctions. Companies need to exercise more commercial common sense,” she says. Govender says some red flags include highly attractive business propositions, above market prices and paid without negotiation, large upfront cash payments, or urgency without obvious commercial justification. “If a deal seems too good to be true, you should take a deeper look,” she says. Govender says businesses in high-risk sectors such as property, financial services, luxury goods or cash-intensive retail need to approach compliance proactively. “The cost of prevention is a fraction of the cost of what it costs to lose everything or to face a penalty or prosecution. This means implementing the right systems, employing the right people to do the job, and understanding overall what your obligations truly are,” she says.“Compliance boils down to having proper controls in place. You need to do more than basic KYC - you must know your customer base and ask the right questions with intent. The single most important control is understanding who you are doing business with. Even for businesses that fall outside of the formal accountable institution definition, conducting basic due diligence on customers, suppliers, and business partners is both commercially prudent and legally advisable,” she emphasises. “This means verifying those identities, understanding the nature of the business relationship with you, scrutinising the source of the funds where large or unusual amounts are involved.”She notes that accountable institutions also have to curate and implement a Risk Management and Compliance Programme (RMCP). “That is mandated under section 42 of the FIC Act. Where people are getting it wrong is they look at a RMCP as just a document they can file away in a drawer and forget about it. But the FIC's own guidance makes it very clear that your RMCP cannot be generic - it needs to offer real protection and be tailored to the specific risks of your business, updated regularly, and be actively implemented. Training of your employees is a FICA obligation, under Section 43 of FICA. Employees are your first line of defense against money laundering, so they must understand what suspicious transactions look like.”Govender recommends that businesses and their employees stay abreast of risk by attending FIC webinars and industry events.Implementing these controls doesn't have to be overwhelming. Software providers like nCino KYC Africa offer accountable institutions a purpose-built compliance platform that streamlines KYC onboarding, automates sanctions and PEP screening, and supports the implementation of a tailored RMCP reducing both compliance risk and administrative burden. For more information, visit kycafrica.ncino.com.