Enhanced Due Diligence (EDD) is the most demanding tier of customer due diligence and the area where South African Accountable Institutions are most frequently found wanting. Throughout 2025, the Financial Intelligence Centre (FIC) and the Financial Sector Conduct Authority issued multimillion-rand fines to both large financial firms and smaller accountable institutions, repeatedly citing failures in client due diligence, transaction monitoring, and the enhanced scrutiny of high-risk clients. 

The message from the regulator is clear: conducting proper EDD on high-risk clients is not optional, and a generic, tick-box approach will not satisfy an audit. This guide provides a practical, step-by-step framework for conducting Enhanced Due Diligence on high-risk clients in South Africa, covering who qualifies as high-risk, what each step of the EDD process involves, and how to document it defensibly.

For a foundational explanation of what EDD is and when it is triggered, refer to our guide: What is Enhanced Due Diligence (EDD) and When is it Required?

What Makes a Client "High-Risk"?

The starting point for any EDD process is correctly identifying which clients require it. Under South Africa's Risk-Based Approach (RBA), Enhanced Due Diligence is applied where a client, relationship, or transaction presents a risk that exceeds the standard threshold. Note that your company's unique RMCP will dictate who counts as a high-risk client and under what circumstances they require EDD. That being said, two of the most common high-risk indicators are:

• The client is a Politically Exposed Person, specifically a Domestic Politically Exposed Person (DPEP) or a Foreign Politically Exposed Person (FPEP), or an immediate family member or known close associate of either. FPEPs, in particular, are treated as inherently high-risk and require continuous, detailed monitoring.
• The client has links to a high-risk jurisdiction, a country with significant deficiencies in its AML/CFT framework, including those on the FATF's lists. The client has a complex or opaque ownership or control structure that makes it difficult to identify the natural persons who ultimately own or control the entity. The client operates in a high-risk industry, such as cryptocurrency, gambling, foreign exchange, or money or value transfer services. The client's transactions are unusually large, complex, or structured in a manner that lacks an obvious legitimate purpose. The client has been the subject of adverse media or has an association with financial crime.

For a detailed explanation of PEPs and the categories that fall within the definition, refer to our guide: What is a Politically Exposed Person (PEP)?

The Regulatory Foundation: FICA, the RBA, and Your RMCP

Like all other anti-financial crime and anti-fraud issues, Enhanced Due Diligence in South Africa is governed by the Financial Intelligence Centre Amendment Act (FICA) and administered by the FIC. Every Accountable Institution is required to develop, maintain, and apply a Risk Management and Compliance Programme (RMCP) that defines how it identifies high-risk clients and applies EDD measures.

In late 2025, the FIC issued clear guidance urging businesses to abandon generic, one-size-fits-all compliance templates in favour of practical, risk-focused programmes tailored to each business's actual operations — summarising its message as "focus on risks, not paperwork." For the purposes of EDD, this means that an Accountable Institution must be able to demonstrate not merely that it has an EDD policy, but that the policy is applied effectively and produces real scrutiny of genuinely high-risk clients. For a full explanation of Accountable Institutions and their obligations, refer to our guide: What is an Accountable Institution? FICA Obligations Unpacked.

How to Conduct EDD on a High-Risk Client

Step 1: Identify and Classify the High-Risk Client

The EDD process begins by formally classifying the client's risk level using the criteria set out in your RMCP. This classification should be the output of an objective risk assessment that considers the client's profile against the high-risk indicators described above -- it is not a subjective or inconsistent judgement.

Where the risk assessment identifies one or more high-risk indicators, the client should be formally designated as high-risk within your systems, and the EDD workflow should be triggered automatically. This classification should be recorded, along with the specific factors that informed it, so that the basis for applying EDD is documented from the outset.

Step 2: Verify Identity to an Enhanced Standard

For high-risk clients, standard identity verification must be supplemented with additional confirmation from independent and reliable sources.

For an individual, this means verifying their identity against the Department of Home Affairs (DHA) HANIS database, confirming the match between the individual and their identity document through biometric verification, and corroborating their identity details against additional independent sources where the risk warrants it. For a foreign national, identity should be verified against the appropriate authoritative source for their jurisdiction. For a comprehensive explanation of identity verification, refer to our guide: What is Identity Verification (IDV) and Why Does it Matter?

For a legal entity, identity verification extends to confirming the entity's registration and legal standing and verifying the identities of its directors and beneficial owners. For a complete walkthrough of business verification, refer to our guide: How to Verify Businesses and Entities in South Africa for KYC.

Step 3: Establish the Source of Funds and Source of Wealth

For high-risk clients, an Accountable Institution must take reasonable steps to establish both the source of funds and the source of wealth.

The source of funds refers to the origin of the specific money involved in a particular transaction or relationship — for example, the proceeds of a property sale, a salary, a business income, or an investment maturity. The source of wealth refers to the broader origin of the client's overall financial position — how they came to accumulate their total wealth over time. These are distinct concepts, and for high-risk clients, particularly PEPs and high-net-worth individuals, both must be established and documented.

Establishing source of funds and wealth involves obtaining supporting evidence — such as financial statements, payslips, sale agreements, tax records, or audited accounts — and assessing whether the explanation provided is reasonable and consistent with the client's profile. Where the declared source of wealth does not plausibly account for the client's financial activity, that discrepancy is a significant red flag requiring escalation.

Step 4: Identify and Verify the Beneficial Owners

For high-risk clients that are legal entities (companies, trusts, or partnerships), establishing who ultimately owns or controls the entity is a critical EDD step that South African regulation has significantly tightened.

Through Public Compliance Communication 59 (PCC59), which came into effect on 8 August 2024, the FIC lowered the expected beneficial ownership identification threshold from 25% to 5%. This means that Accountable Institutions are now expected to identify any natural person holding a 5% or greater ownership interest in an entity as a beneficial owner. For high-risk clients with complex or layered ownership structures, the verification process must look through each layer of ownership — through holding companies, trusts, and nominee arrangements — until the natural persons who ultimately own or control the entity are identified and verified.

This enhanced beneficial ownership requirement directly addresses the common money laundering tactic of fragmenting ownership across multiple smaller shareholdings to evade the previous 25% threshold.

Step 5: Conduct Comprehensive AML, Sanctions, and PEP Screening

High-risk clients require comprehensive screening against the full range of financial crime risk indicators. For legal entities, their directors and beneficial owners must also be verified and screened. 

A sanctions screen must confirm that the client does not appear on any Targeted Financial Sanctions list. South African Accountable Institutions are required to screen clients against the FIC's Targeted Financial Sanctions list, which is derived from United Nations Security Council resolutions. The FIC provides a free search function on its website for this purpose. A PEP screen must confirm whether the client or any associated person is a DPEP or FPEP, and an adverse media screen must identify any negative news that indicates a financial crime risk not yet captured by formal watchlists.

For high-risk clients, screening should be more frequent and more granular than for standard clients. For a detailed explanation of the components of AML screening, refer to our guide: What is AML Screening? PEP, Sanctions & Adverse Media Explained.

Step 6: Obtain Senior Management Approval

A defining requirement of EDD is that the decision to establish or continue a high-risk business relationship must be approved at a senior level within the Accountable Institution.

This requirement ensures that the acceptance of high-risk clients is a considered, accountable decision rather than a routine operational one. Senior management approval should be obtained before the relationship is established, should be based on a complete review of the EDD findings, and should be documented as part of the client's record. For relationships involving FPEPs and other inherently high-risk categories, this approval requirement is particularly important.

Step 7: Apply Enhanced Ongoing Monitoring

EDD does not end once a high-risk client has been onboarded. High-risk clients require enhanced ongoing monitoring throughout the life of the business relationship — a more frequent and more intensive level of scrutiny than applies to standard clients.

The FIC's risk-based framework establishes that review frequency should be calibrated to risk: low-risk clients require less frequent review, medium-risk clients require periodic review, and high-risk clients — including foreign PEPs — require continuous, detailed monitoring. Enhanced ongoing monitoring involves regularly re-screening the client against updated sanctions, PEP, and adverse media databases, scrutinising transactions for consistency with the client's established profile and declared source of wealth, and reviewing the client's risk classification periodically to ensure it remains accurate.

Any transaction that is suspicious must be reported to the FIC via a Suspicious Transaction Report (STR), and any cash transaction exceeding R49,999 must be reported via a Cash Threshold Report (CTR).

Step 8: Document Everything for Your RMCP and Audit Trail

The final — and arguably most important — step is comprehensive documentation. Given the FIC's intensified focus on the demonstrable effectiveness of compliance controls, an EDD process that is not documented is, from an audit perspective, an EDD process that did not happen.

For each high-risk client, an Accountable Institution should retain a complete record of the risk classification and the factors that informed it, the enhanced identity verification conducted, the source of funds and wealth evidence obtained and assessed, the beneficial ownership identification and verification, the screening results, the senior management approval, and the ongoing monitoring activity. FICA requires that these records be retained for a minimum of five years from the end of the business relationship or the conclusion of the transaction. A complete, well-organised audit trail is the single most effective protection against the kind of administrative sanctions that have characterised recent FIC enforcement.

Common EDD Mistakes to Avoid

Several recurring failures account for the majority of EDD-related compliance shortcomings in South Africa.

The most common is conflating source of funds with source of wealth, or establishing one but not the other — when high-risk clients require both. A second is applying the previous 25% beneficial ownership threshold rather than the 5% threshold introduced by PCC59. A third is relying on a generic, one-size-fits-all RMCP that does not produce genuine scrutiny of high-risk clients — precisely the approach the FIC has urged businesses to abandon. A fourth is treating EDD as a once-off onboarding exercise rather than an ongoing obligation that includes enhanced continuous monitoring. A fifth is failing to document the EDD process in sufficient detail to demonstrate its effectiveness during an audit.

Enhanced Due Diligence Solutions for South African Businesses

As South Africa's leading provider of world-class EDD, KYC, AML screening, and due diligence solutions, ThisIsMe equips Accountable Institutions with the complete toolkit needed to conduct comprehensive Enhanced Due Diligence on high-risk clients — accurately, efficiently, and in full compliance with FICA. From enhanced identity verification and beneficial ownership identification to PEP, sanctions, and adverse media screening and enhanced ongoing monitoring, our solutions are designed to help you meet the FIC's expectations and maintain an audit-ready compliance record. To experience our full suite of due diligence solutions and find out how we can serve your business, contact our team here.