South Africa is home to more than 167,000 refugees and asylum seekers, according to UNHCR's 2025 figures — the majority from Burundi, the Democratic Republic of Congo, Somalia, South Sudan, Rwanda, and Zimbabwe. Unlike in many neighbouring countries, South Africa does not operate a camp system. Most refugees and asylum seekers live within urban communities, where they work, run businesses, and participate in the formal economy. They need bank accounts, insurance, credit, and access to financial services — and they have a legal right to access them.
Yet for most South African Accountable Institutions, the standard KYC workflow is built entirely around South African citizens and their 13-digit ID numbers. When a refugee or asylum seeker presents a Section 22 or Section 24 permit instead of a South African identity document, many businesses find themselves unable to proceed — not because the law prevents onboarding, but because their verification systems lack the tools to do so compliantly.
This guide explains how South African businesses can onboard refugees and asylum seekers lawfully and compliantly, using data from the Department of Home Affairs' National Immigration Information System (NIIS) to conduct proper due diligence on this population.
Understanding the Legal Status of Refugees and Asylum Seekers in South Africa
Before designing a compliant onboarding workflow, it is important to understand the legal distinction between an asylum seeker and a recognised refugee — and what rights each status confers.
South Africa's refugee framework is governed by the Refugees Act 130 of 1998, as amended in 2017, which aligns South African law with the 1951 UN Refugee Convention and the 1969 OAU Convention. The Act creates a two-stage determination process, and each stage produces a distinct identity document.
A Section 22 permit — commonly known as an asylum seeker permit — is issued on the day a person lodges an asylum application at a Refugee Reception Office (RRO). It is valid for up to six months and must be renewed before it expires. A lapsed Section 22 permit renders the holder's stay illegal, exposing them to detention or deportation. The Section 22 permit confirms that its holder is in South Africa lawfully, awaiting a decision on their asylum claim. Asylum seekers with valid Section 22 permits are entitled to work and study in South Africa and have the right to access financial services.
A Section 24 permit — or refugee status recognition document — is issued once a Refugee Status Determination Officer has formally recognised the individual as a refugee. The Section 24 holder receives the distinctive maroon refugee identity card, which serves as their primary identity document in South Africa. Recognised refugees enjoy most of the rights of South African citizens — including the right to work, study, and access healthcare — but do not vote and do not automatically acquire citizenship.
Both Section 22 and Section 24 permit holders are legally entitled to be onboarded by Accountable Institutions, provided their documents are valid and the business can conduct the required due diligence. The challenge, historically, has been conducting that due diligence without access to a verified data source for immigration documents.
Why Standard KYC Workflows Fall Short for This Population
The standard KYC workflow for South African Accountable Institutions is designed around the DHA's HANIS database — the authoritative source of identity information for South African citizens, verifiable using a 13-digit ID number. Refugees and asylum seekers do not have South African ID numbers. When they present their permits at onboarding, a business using only a HANIS-based verification system cannot verify those documents against an authoritative data source.
This creates a compliance problem with a direct legal consequence. FICA Section 21E states that when an Accountable Institution is unable to establish and verify the identity of a client, it may not establish a business relationship or conclude a single transaction. In the absence of an alternative verification pathway, many businesses default to declining service to permit holders entirely — not because the law requires it, but because their systems cannot support it.
The result is de facto financial exclusion of a legally present and legally entitled population. It is also a compliance risk in its own right: the FIC's Guidance Note 3A on client identification explicitly cautions that overly restrictive document policies can frustrate clients and may not reflect the full scope of what FICA permits. The stakes are not abstract. In December 2024, Capitec Bank was fined R56.25 million by the FIC for FICA compliance failures, and in January 2025, Standard Bank received a R13 million administrative sanction. The trend of active regulatory enforcement makes it essential that Accountable Institutions have defensible, documented processes for every category of client — including foreign nationals.
For a comprehensive explanation of FICA, Accountable Institutions, and what the designation requires, refer to our guide: What is an Accountable Institution? FICA Obligations Unpacked.
What is NIIS and How Does it Enable Compliant Onboarding?
The National Immigration Information System (NIIS) is the Department of Home Affairs' database of immigration records, holding information on foreign nationals in South Africa — including asylum seekers and recognised refugees. The NIIS is currently being modernised as part of the DHA's broader digital transformation under its new National Identity System (NIS), which forms a central pillar of the Department's Home Affairs @ Home digital-first strategy for 2024 to 2029.
ThisIsMe's Immigration Status Check service provides businesses with authorised, real-time access to NIIS data — enabling the verification of Section 22 asylum seeker permits and Section 24 refugee status documents directly against the DHA's immigration records. The FIC has long recognised the DHA's electronic verification process as an appropriate mechanism for banks and other Accountable Institutions to verify asylum seeker and refugee permits before relying on them for onboarding. The NIIS Immigration Status Check provides precisely this capability — filling the verification gap that has historically made compliant onboarding of this population practically impossible.
Step-by-Step: How to Onboard Refugees and Asylum Seekers Compliantly
Step 1: Identify the Individual's Immigration Document Type
The onboarding process begins by establishing which document the individual holds. The two primary document types to recognise are the Section 22 asylum seeker permit and the Section 24 refugee status document. Both are valid identity documents for FICA onboarding purposes, provided they are current and verified against DHA records.
A Section 22 permit has a specific expiry date and must be checked for current validity before it is accepted. An expired Section 22 is not a valid identity document for FICA onboarding purposes. Where a Section 22 permit has expired, the individual should be directed to renew their permit at the relevant RRO before onboarding proceeds.
It is important to note that the DHA does not turn away applicants who lack travel documents at the point of asylum application — the right to apply for asylum is protected under South African law. However, for the purposes of business onboarding, the individual must hold a currently valid permit in order for verification to proceed.
Step 2: Validate the Document Against NIIS Data
Once the individual's document type has been established, the permit details should be submitted to ThisIsMe's specialised service, called Immigration Status Check, which will validate the document against the DHA's immigration records.
Immigration Status Check confirms the validity and current status of the permit, verifies the individual's basic particulars — such as their file or ID number and the correctness of their documented details — and confirms that the document is genuine and currently active in the DHA system. This step is the equivalent, for foreign nationals, of the HANIS identity verification check used for South African citizens and provides an authoritative, database-backed confirmation that the document is real, current, and belongs to the person presenting it.
Importantly, the NIIS check generates an audit record of the verification, which should be captured and retained as part of the business's RMCP. FICA requires Accountable Institutions to maintain records of all due diligence checks for a minimum of five years.
For a comprehensive explanation of how identity verification works and why it is essential, refer to our guide: What is Identity Verification (IDV) and Why Does it Matter?
Step 3: Conduct AML and Sanctions Screening
With the individual's identity confirmed via NIIS data, the next step is to conduct AML risk screening — applying the same checks that would be applied to any customer, regardless of their immigration status.
AML screening for refugees and asylum seekers should include a PEP check to determine whether the individual holds or has held a prominent public function, a sanctions check against national and international watchlists, and an adverse media screen to identify any published information that suggests a financial crime risk. The fact that an individual is a refugee or asylum seeker does not, in itself, constitute a risk indicator. AML screening is applied on the basis of the individual's risk profile — not their nationality or immigration status.
Where an individual is identified as a Politically Exposed Person — for example, a senior official from their country of origin who has sought asylum in South Africa — Enhanced Due Diligence will be required before the relationship proceeds. For a detailed explanation of EDD triggers and what the process involves, refer to our guide: What is Enhanced Due Diligence (EDD) and When is it Required?
For a comprehensive explanation of AML screening components, refer to our guide: What is AML Screening? PEP, Sanctions & Adverse Media Explained.
Step 4: Conduct Address Verification
Address verification for refugees and asylum seekers follows the same principles as for any other customer, but may require greater flexibility in the types of documentation accepted. ThisIsMe provides address verification services that are accessible using just a South African ID number for the individual in question.
Accountable Institutions should ensure that their RMCP explicitly addresses the range of address documents acceptable for foreign national clients, in order to avoid the risk of both non-compliance and unjustified exclusion.
Step 5: Apply Risk-Based Decision-Making
South Africa's Risk-Based Approach to AML/CFT means that the depth of due diligence applied to any individual customer should be proportionate to the risk they present — not to their demographic or immigration category. A refugee with a valid Section 22 permit, a clean AML screen, and a verifiable address is not, by definition, a higher-risk customer than a South African citizen in an equivalent situation.
Accountable Institutions should ensure that their RMCP's risk assessment criteria are applied consistently and objectively — assessing risk on the basis of the individual's actual profile, not on generalised assumptions about the risk associated with refugee or asylum seeker status.
For a comprehensive guide to the RBA and what it means for Accountable Institutions, refer to our guide: What is KYC? Know Your Customer Explained for South African Businesses.
Step 6: Establish Ongoing Monitoring
As with any customer, refugees and asylum seekers onboarded by an Accountable Institution should be subject to ongoing monitoring throughout the life of the business relationship.
One dimension of ongoing monitoring that is specific to permit-holding customers is the monitoring of permit validity. A Section 22 permit must be renewed every six months, and a lapsed permit changes the individual's legal status in South Africa. Accountable Institutions should maintain a record of the permit expiry date at onboarding and establish a process for prompting permit renewal verification before expiry — ensuring that the business relationship remains grounded in a currently valid immigration status.
What Information Does the NIIS Immigration Status Check Return?
ThisIsMe's Immigration Status Check returns a full profile from the NIIS database for the individual in question, including confirmation of document type and current status, the individual's documented particulars, permit validity and expiry information, and an audit record of the check. This information enables a complete and defensible due diligence workflow on individuals who do not hold South African ID numbers — making previously impossible onboarding journeys both compliant and commercially viable.
Why Inclusive KYC Matters for South African Businesses
Financial inclusion is not only a social imperative — it is a commercial opportunity. South Africa's refugee and asylum seeker population of more than 167,000 urban-dwelling individuals represents a significant addressable market that the majority of Accountable Institutions are currently failing to reach, not because of regulatory prohibition, but because of systems gaps.
Closing that gap with NIIS-enabled verification allows businesses to expand their onboarding reach, meet their FICA obligations comprehensively across all eligible customer categories, and contribute to the broader financial inclusion goals that the FIC, DHA, and UNHCR are all actively advancing in South Africa. As UNHCR's September 2025 regional report confirmed, Southern Africa is making meaningful progress in including refugees in national systems — and the businesses that invest in inclusive KYC infrastructure now will be best positioned as that progress continues.
NIIS and Immigration Status Check Solutions for South African Businesses
As South Africa's leading provider of world-class identity verification, KYC, and due diligence solutions, ThisIsMe's Immigration Status Check provides authorised, real-time access to NIIS data — enabling Accountable Institutions to verify Section 22 and Section 24 permit holders compliantly, within the same seamless onboarding journey used for South African citizens. To experience our full suite of identity verification and KYC solutions and find out how we can help your business onboard every eligible customer with confidence, contact our team here.
