Know Your Customer (KYC) for forex providers refers to the identity verification, screening and due diligence checks that foreign exchange businesses in South Africa must conduct on their clients in order to comply with the Financial Intelligence Centre Amendment Act (FICA) and the Exchange Control Regulations administered by the South African Reserve Bank (SARB). Because forex providers move value across borders, they sit at one of the highest-risk points in the financial system, and their KYC obligations are correspondingly demanding.

The regulatory landscape for foreign exchange shifted significantly in 2026. Exchange control thresholds have been raised, an explicit source of funds verification requirement has been introduced for a large category of forex businesses, and enforcement against foreign exchange dealers has continued at pace. This guide explains what KYC requires of a South African forex provider, what changed in 2026, and how to build a compliant onboarding and monitoring workflow.

For a foundational explanation of the discipline itself, refer to our guide: What is KYC (Know Your Customer)?

Are Forex Providers Accountable Institutions Under FICA?

Yes. A person who carries on the business of dealing in foreign exchange is listed in Schedule 1 of FICA as an Accountable Institution. This designation predates the December 2022 expansion of Schedule 1 and was left unchanged by those amendments, which means forex providers have been subject to the full suite of FICA obligations for many years.

Accountable Institution status carries specific legal duties: registering with the Financial Intelligence Centre (FIC), developing and implementing a Risk Management and Compliance Programme (RMCP), conducting customer due diligence, screening clients against sanctions lists, monitoring relationships on an ongoing basis, reporting certain transactions, keeping records for five years, appointing an anti-money laundering compliance officer, and training staff.

For a full explanation of what this status means in practice, refer to our guide: What is an Accountable Institution? FICA Obligations Unpacked.

One point is frequently overlooked. A single business can be an Accountable Institution under more than one Schedule 1 item, and registration follows the item rather than the business. A business that deals in foreign exchange and also issues, sells or redeems travellers' cheques or money orders falls under multiple items and must register for each. The FIC has also confirmed that where an ADLA operates a branch network, the head office and each branch are treated as separate Accountable Institutions and must register separately.

Who Regulates Forex Providers in South Africa?

Foreign exchange is one of the more heavily supervised sectors in South Africa, and the applicable regulator depends on the nature of the business.

Authorised Dealers are registered banks appointed by the SARB to deal in foreign exchange. They operate under the Currency and Exchanges Manual for Authorised Dealers.

Authorised Dealers in foreign exchange with limited authority (ADLAs) are non-bank businesses appointed by the SARB to conduct certain designated foreign exchange transactions. This category includes bureaux de change and money transfer operators, and it is divided into categories reflecting the scope of business permitted. ADLAs operate under the separate ADLA Manual, and under FICA the SARB supervises them for anti-money laundering and counter-terrorist financing compliance and inspects them accordingly.

Forex and Contract for Difference (CFD) brokers fall under the Financial Sector Conduct Authority (FSCA). A broker providing advice or intermediary services requires a Financial Services Provider (FSP) licence under the Financial Advisory and Intermediary Services Act (FAIS), typically Category I or Category II. A broker that originates, issues or makes a market in over-the-counter derivatives such as CFDs as principal separately requires an Over-the-Counter Derivative Provider (ODP) authorisation under the Financial Markets Act. An FSP licence does not, on its own, permit a firm to issue derivatives as principal.

The practical consequence for a compliance officer is that a forex business may answer to the FIC, the SARB and the FSCA simultaneously, and its KYC controls must satisfy all of them.

What KYC Checks Must a Forex Provider Conduct?

FICA requires Accountable Institutions to establish and verify the identity of every client before establishing a business relationship or concluding a single transaction. For a forex provider, this will always depend on the specific stipulations of the business's unique Risk Management and Compliance Programme (RMCP), but will generally involve the following layers:

• Identity verification: South African clients should be verified against authoritative government data rather than accepted on the strength of a submitted document. Verification against the Department of Home Affairs (DHA) HANIS database confirms that an identity number is valid and returns the associated name, date of birth, vital status and citizenship. Refer to our guide: What is Identity Verification (IDV)?
• Document authentication: Foreign exchange is a passport-heavy sector. Travellers, foreign nationals and non-residents frequently present passports rather than South African identity documents, which makes document authenticity a front-line control. Validating the Machine Readable Zone of a passport or identity card and scoring it for tampering detects forged and altered documents that visual inspection reliably misses.
• Biometric confirmation: Comparing a client's selfie to the photograph held on record at the DHA, or to the photograph on the presented document, confirms that the person transacting is the person the document describes. This is the control that defeats the use of genuine documents by impostors.
• Address and contact verification: FICA requires institutions to obtain and verify residential address information on a risk-sensitive basis, and contact details matter equally for fraud control. Refer to our guide: How to Verify Physical Addresses and Contact Details.
• AML and sanctions screening: Every client must be screened for Politically Exposed Person (PEP) status, presence on regulatory enforcement and sanctions lists, adverse media and other reputational risk indicators. Screening against the United Nations Security Council's Targeted Financial Sanctions list is a standalone statutory obligation rather than a discretionary control, and the FIC expects it to be conducted on an ongoing basis. Refer to our guide: What is AML Screening?
• Beneficial ownership: Where the client is a company, trust or partnership, the provider must establish the ownership and control structure and identify the natural persons behind it. The FIC's Public Compliance Communication 59 strongly recommends identifying all persons holding five percent or more of the ownership interest in a legal person, a threshold considerably below the twenty-five percent standard many businesses previously applied. For partnerships, every partner must be identified regardless of percentage held. Refer to our guide: How to Verify Businesses and Entities.
• Source of funds and source of wealth: For forex providers this has moved from good practice to explicit requirement, as set out below.

What Changed for Forex Providers in 2026?

Following the 2026 Budget, the SARB's Financial Surveillance Department issued a package of nine exchange control circulars on 8 April 2026, giving legal effect to a set of threshold increases and administrative relaxations. Several of these directly affect how forex providers onboard and transact with clients.

The single discretionary allowance (SDA) for resident individuals aged eighteen and older was increased from R1 million to R2 million per calendar year, across both the Authorised Dealer and ADLA frameworks. The SDA may be used for any legal purpose abroad, including travel, gifts, remittances and offshore investment, subject to correct reporting classification.

The foreign capital allowance remains R10 million per individual per calendar year and continues to require an Approval for International Transfer (AIT) PIN from the South African Revenue Service (SARS). Transfers beyond the combined allowances require prior approval from the Financial Surveillance Department, which scrutinises both the source of the funds and the purpose of the transfer.

The cross-border cash limit for South African banknotes carried into or out of the country was increased from R25 000 to R100 000 per person.

Transactional limits were also raised elsewhere: card-based cross-border payments for imports, services and subscriptions moved from R50 000 to R100 000 per transaction, and the miscellaneous transfers threshold for certain payments to non-residents moved from R100 000 to R200 000. The prohibition on splitting transactions to circumvent a limit was retained.

Most significantly for KYC purposes, the ADLA circular introduced an explicit source of funds verification requirement. In respect of transactions effected through ADLAs exceeding an aggregate value of R50 000, including travel and study allowances and monetary gifts to non-residents or to residents temporarily abroad, the ADLA is required to obtain and verify the source of the funds. Following public consultation, the final circular framed this as a risk-based obligation to be applied in line with the institution's internal controls, while retaining a defined minimum threshold.

The SARB also consulted during early 2026 on a draft regulatory framework for alternative remittance providers, aimed at informal value transfer channels operating outside the ADLA system. Forex and remittance businesses should confirm the current status of that framework, as it has the potential to bring additional participants into the regulated perimeter.

Why Does Source of Funds Verification Now Matter So Much?

The R50 000 aggregate threshold changes the practical shape of forex onboarding. A control that many providers previously reserved for large or obviously unusual transactions now attaches to a broad band of everyday business, including routine travel and study allowances.

This has two consequences. The first is volume: a manual, document-gathering approach does not scale to the number of transactions now in scope. The second is evidential quality. Verifying source of funds means more than filing a client's assertion. It means corroborating the stated origin of the money against independent information, such as analysed bank statement data evidencing income and spending patterns, employment information, credit footprint, or documented proceeds of an asset sale.

Source of funds also intersects directly with the abuse patterns most common in this sector. Structuring, in which a client splits a larger amount into transactions that individually fall below a reporting or verification threshold, is precisely what an aggregate threshold is designed to catch. Third-party funding, in which the person transacting is not the person whose money is moving, is another. Allowance abuse, in which multiple individuals are recruited to externalise a single pool of funds, is a third. None of these is detectable from an identity check alone.

What Happens if a Forex Provider Fails a FICA Inspection?

Enforcement in this sector is active and specific, and the published sanctions show exactly which controls regulators are testing.

In July 2026, the SARB imposed R600 000 in administrative sanctions on Southeast Exchange Company South Africa (Pty) Ltd, an ADLA, following a FICA inspection. The inspection identified weaknesses that inhibited the company's ability to conduct ongoing customer due diligence in accordance with its own RMCP and to apply the risk-based methodology set out in that programme. The SARB also found that the company had failed to appoint an anti-money laundering compliance officer and had not provided the required anti-money laundering training to its staff. The penalties comprised R100 000 in respect of section 21, R100 000 in respect of section 21C, R200 000 in respect of section 42, R100 000 in respect of section 42A(2)(b) and R100 000 in respect of section 43. The company was also directed to remedy the identified deficiencies.

This was not an isolated case. In October 2025, the SARB sanctioned Access Forex after identifying deficiencies in its RMCP, its customer due diligence processes and its staff training. In an earlier round of ADLA inspections, Tower Bureau de Change, Sikhona Forex and Travelex Africa Foreign Exchange were sanctioned for failures including not screening client names against sanctions lists, not reporting suspicious and unusual transactions, and not sufficiently establishing and verifying client identities.

Two patterns are worth drawing out. First, the largest single component of the Southeast Exchange penalty attached to the RMCP itself, which is consistent with the FIC's long-standing finding that institutions struggle less with having an RMCP than with having one genuinely customised to their business and actually implemented. A template programme that does not reflect real risk exposure will not survive an inspection. Second, in each case the regulator was explicit that the sanctions related to weaknesses in preventive control measures, not to findings that the business had facilitated money laundering. Control failure alone is sufficient.

Financial penalties under FICA can reach R10 million for a natural person and R50 million for a legal person. Refer to our guides: What Happens if You Fail a FIC Audit? and How to Pass a FIC Audit: A Step-by-Step Checklist for SA Businesses.

South Africa's removal from the Financial Action Task Force greylist on 24 October 2025 has not reduced supervisory pressure on this sector. The FATF requires delisted countries to demonstrate continued commitment through measurable outcomes, including sanctions, and South Africa's next mutual evaluation is expected to conclude in October 2027. Enforcement against foreign exchange businesses forms part of the evidence base for it.

How Should Forex Providers Handle Ongoing Due Diligence?

Section 21C of FICA requires ongoing due diligence, and the Southeast Exchange sanction demonstrates that this is inspected as a distinct obligation rather than folded into onboarding. A client screened clean at onboarding may become a PEP, appear on a sanctions list, or attract adverse media at any point afterwards, and the provider is expected to know.

Continuous monitoring is the only practical answer at scale. Rather than re-screening an entire client book manually at intervals, a monitored client list generates an alert the moment a profile's risk status changes. For the distinction between the two approaches, refer to our guide: Once-Off AML Screening vs Continuous AML Monitoring: What's the Difference? For providers with a large existing client base to bring up to standard, refer to our guide: How to Ensure Re-screening Compliance with Bulk Services.

Ongoing due diligence also means keeping identity data current. Vital status changes, and transacting on a deceased person's identity is a recognised fraud vector as well as a compliance failure.

Where a client presents elevated risk, whether through PEP status, exposure to a high-risk jurisdiction, an opaque ownership structure or unexplained transaction patterns, enhanced measures are required. Refer to our guide: What is Enhanced Due Diligence (EDD)?

What Makes Forex KYC Different in Practice?

Two operational points apply with particular force to foreign exchange. Because onboarding often happens at a counter or in a single session, a dependency on live DHA availability is a commercial risk as well as a compliance one, so identity verification should fail over automatically to cached data when the DHA is offline and resume live verification the moment it returns. And because forex serves non-residents and migrant workers, providers need a route to verify clients without South African identity numbers: an immigration status check against the National Immigration Information System enables due diligence on asylum seekers and refugees who would otherwise be impossible to onboard.

For providers processing meaningful volume, automating the full sequence through an Application Programming Interface (API) is considerably more defensible than a manual process, because it produces a consistent, timestamped, auditable record of every check performed on every client. Refer to our guides: How to Automate KYC Compliance with an API and Manual vs Automated FICA Compliance: Which is Right for Your Business?

KYC Solutions for South African Forex Providers

As South Africa's leading provider of world-class identity verification, KYC, AML screening and due diligence solutions, ThisIsMe gives forex providers the tools they need to onboard clients quickly and to satisfy the FIC, the SARB and the FSCA with confidence. With access to 45+ services, including real-time identity verification against the DHA's HANIS database, passport and document authentication with tamper detection, biometric photo comparison, immigration status checks for foreign nationals, AML and sanctions screening powered by global risk intelligence, continuous AML monitoring, bank account verification, and bank statement analysis to support source of funds corroboration, ThisIsMe helps foreign exchange businesses verify every client, meet every threshold, and pass their inspections, stress-free. To experience our full suite of KYC solutions and find out how we can serve your forex business, contact our team here.