Criminal background screening is the process of checking whether an individual has a criminal record, a pending criminal case, or other indicators of criminal risk, before a business employs that person or enters into a relationship with them. In South Africa, criminal records are held by the South African Police Service (SAPS) Criminal Record Centre, and the authoritative way to query them is by matching an individual's fingerprints against the SAPS criminal database.
There is an important distinction that most businesses do not appreciate until it causes a problem. Criminal background screening in South Africa operates at two levels. Database-level screening, which uses an identity number and name, returns a risk indicator quickly and cheaply. Biometric fingerprint screening, which requires the physical capture of an individual's fingerprints, returns a confirmed result. The two are not interchangeable, and using the first as though it were the second exposes a business to both operational and legal risk.
This guide explains how criminal background screening works in South Africa, how it relates to obligations under the Financial Intelligence Centre Amendment Act (FICA), what each level of screening can and cannot tell you, how to conduct a full biometric fingerprint-based check, and what the Protection of Personal Information Act (POPIA) requires throughout.
Why Does Criminal Background Screening Matter for FICA Compliance?
Most businesses treat criminal screening as a human resources matter. For Accountable Institutions under FICA, it is also a compliance obligation.
Directive 8, issued by the Financial Intelligence Centre (FIC) on 31 March 2023, requires every Accountable Institution to screen prospective and current employees for competence and integrity, and to scrutinise employee information against the targeted financial sanctions lists. The directive is supported by Public Compliance Communication 55, which sets out how it should be applied. Screening must be risk-based, must be conducted on an ongoing basis rather than only at the point of hiring, and must be documented in the institution's Risk Management and Compliance Programme (RMCP). The FIC recommends that employees in higher-risk roles be screened at least annually.
It is worth being precise here, because the point is frequently overstated. Directive 8 does not name a criminal record check as a mandatory control. It requires integrity screening and leaves the method to the institution's risk-based approach. A criminal record check is the most direct and widely accepted means of evidencing that screening, which is why it has become standard practice, but the obligation is framed by outcome rather than by instrument.
The connection to the RMCP is what makes this a compliance issue rather than an HR preference. The RMCP must record how the institution screens employees, and an inspection tests whether the institution did what its programme says. Refer to our guide: What is a Risk Management and Compliance Programme (RMCP)?
Criminal screening also arises on the client side. Where a client presents elevated risk, criminal record indicators form part of a wider enhanced due diligence picture alongside sanctions exposure, adverse media and source of funds. Refer to our guides: What is Enhanced Due Diligence (EDD)? and How to Conduct Enhanced Due Diligence on High-Risk Clients in South Africa.
For the practical hiring process itself, including driver's licence and Professional Driving Permit verification, refer to our guide: How to Screen Employees for Criminal Records and Driver's Licences in SA.
What are the Two Levels of Criminal Background Screening?
The difference between the two levels comes down to what identifies the person being checked.
Database-level screening matches an individual using a South African identity number and full name. It is fast, requires no physical attendance, and can be run at scale across an entire workforce or client base. Because the match is made on identifiers that can be shared, stolen or fabricated, the result is an indicator of risk rather than a confirmation of it.
Biometric fingerprint screening matches an individual using their fingerprints, submitted through the Automated Fingerprint Identification System (AFIS) to the SAPS Criminal Record Centre. Because fingerprints cannot be borrowed or misrepresented, the result is authoritative. The cost is that the candidate must physically attend a fingerprint capture appointment.
The sensible way to use these is sequentially rather than as alternatives. Database screening acts as a first-pass filter across a large population, and biometric screening confirms the cases that the filter flags, along with any role or relationship where a confirmed result is required regardless.
What Does Database-Level Criminal Screening Return?
ThisIsMe offers two services at this level.
Forensic Assessment screens South African criminal databases for existing criminal records associated with an individual, using their South African identity number and full name. The result is binary. Where no record is found, the service returns "No Illicit Found". Where a record is found, it returns "Possible Illicit". The service does not disclose what offence was committed. It is available as a bulk or batch service, which makes it well suited to screening an existing workforce or client base in a single exercise.
Criminal Risk Indicator (CRI) is a broader, fully automated service that combines criminal record risk screening with identity verification and consumer contactability data in a single call. Alongside the criminal risk result, it returns the individual's full name and initials, birth date, vital status, citizenship, identity number status, marital status and identity photograph, together with up to five physical addresses, five contact numbers and five recent employment statuses. It operates on a delayed call-back basis rather than returning instantly, and it is available through Partners Plus, API and bulk channels.
The Criminal Risk Indicator is useful precisely because it collapses several checks into one workflow. The identity and address data it returns supports customer due diligence in its own right, which means a single call can serve both a screening purpose and a verification purpose. Refer to our guides: What is Identity Verification (IDV)? and How to Verify Physical Addresses and Contact Details.
Both services carry the same critical limitation, and ThisIsMe states it explicitly in its own service documentation: neither is a suitable replacement for fingerprint-based biometric criminal record checking. Both should be used as risk assessment tools, not as the basis for a final decision about a person.
Why is Fingerprint-Based Screening Still Necessary?
A "Possible Illicit" result tells a business that something warrants investigation. It does not tell the business what the offence was, when it occurred, whether the matter resulted in a conviction or is still pending, or, most importantly, whether the record genuinely belongs to the person in front of them.
That last point is the substantive one. Identity numbers and names are routinely misused in identity fraud, and common surnames produce false associations. A record matched on an identity number is a record matched on a claim about identity. A record matched on a fingerprint is matched on the person.
Acting adversely on an unconfirmed indicator is also legally hazardous. Declining to employ someone on the strength of a result that does not identify the offence and has not been biometrically confirmed is difficult to defend before the CCMA or a court, and it sits poorly with POPIA's requirement that personal information be accurate and complete.
The practical rule is therefore straightforward. Treat a "No Illicit Found" result as reasonable comfort in a low-risk role. Treat a "Possible Illicit" result as a trigger for a fingerprint-based check, never as a decision.
How Do You Conduct a Full Biometric Fingerprint-Based Criminal Record Check?
A complete fingerprint-based check in South Africa follows six steps.
Step one: obtain written consent and indemnity. The candidate must give specific, informed, written consent before any fingerprints or personal information are submitted. This is not a formality. Criminal behaviour information and biometric information are both special personal information under POPIA, and consent is one of the gateways that makes processing them lawful.
Step two: capture the fingerprints digitally. Fingerprints must be captured electronically by a trained operator using an accredited capture device, together with the candidate's demographic details and original identity document or passport. Capture quality directly determines whether the submission succeeds, which is why this step is handled by accredited providers rather than done in-house. ThisIsMe is partnered with a nationwide network of fingerprint capture providers, so candidates can complete this step locally rather than travelling.
Step three: submit through AFIS to SAPS. The captured prints are submitted electronically through the Automated Fingerprint Identification System and checked against the SAPS criminal database of convicted persons and persons awaiting trial.
Step four: receive the electronic result. Where no match is found, the system returns a result indicating that no illicit activity was identified, which confirms that the individual has no criminal record on the SAPS database. ThisIsMe returns results within 48 hours. Turnaround across the market generally runs from a few hours on premium tiers to two working days on standard tiers, and varies with system availability and the quality of the prints captured.
Step five: obtain the SAPS69 where a match is found. A match does not by itself explain the record. The detail sits in the SAPS69 report, which is generated by SAPS and sets out the charge, case number, date and place of the offence, the sentence handed down, the sentencing date, and any pending cases. Businesses should plan for this: the SAPS69 typically takes considerably longer than the initial electronic result, commonly several weeks.
Step six: make and document the decision. The result must be assessed against the inherent requirements of the specific role, not applied as a blanket disqualification, and the candidate should be given the outcome and a chance to respond before any adverse decision is finalised. For Accountable Institutions, the recorded decision forms part of the evidence that the RMCP was implemented.
One distinction causes persistent confusion. A criminal record check is a digital result generated through AFIS and used for employment and due diligence screening within South Africa. A Police Clearance Certificate is a formal physical document issued by the SAPS Criminal Record Centre, required for visa applications, emigration and work abroad. Private providers cannot issue a Police Clearance Certificate, and SAPS turnaround for one is measured in weeks to months. Businesses screening domestically need the former, and should not delay hiring while waiting for the latter.
What Does POPIA Require for Criminal Background Screening?
Criminal background screening engages POPIA more heavily than almost any other verification activity, because it processes two categories of special personal information at once.
Section 26 of POPIA prohibits the processing of special personal information, which includes information about a data subject's criminal behaviour and biometric information, unless a statutory gateway applies. Section 27 provides the general gateways, including the data subject's consent and processing necessary for the establishment, exercise or defence of a right or obligation in law. Section 33 specifically authorises the processing of criminal behaviour and biometric information by responsible parties who obtained it in accordance with the law, and routes employee vetting through labour legislation.
Four practical principles follow. Consent must be specific, informed and in writing, obtained before the check is run rather than inferred from an employment application. The check must be relevant to the role, because POPIA requires that information collected be adequate, relevant and not excessive: a criminal check on a candidate who will handle client funds is defensible, while a blanket check across every role regardless of function is harder to justify. The result may only be used for the stated purpose, and should not be retained for future hiring rounds or shared onward. And the subject has a right of access and response, so an individual facing an adverse decision should be told and given an opportunity to answer.
There is one further requirement that catches businesses out entirely. Under section 57(1)(b) of POPIA, a responsible party that processes information on criminal behaviour on behalf of third parties must obtain prior authorisation from the Information Regulator before doing so. This applies to screening businesses and providers rather than to an employer screening its own candidates, but any business intending to run checks for clients, group companies or counterparties should establish its position before it starts.
Does a Criminal Record Ever Expire?
Not automatically, and the widespread belief that it does is worth correcting because it affects how businesses interpret results.
Section 271A of the Criminal Procedure Act provides that certain minor convictions "fall away" after ten years for sentencing purposes. This does not remove the record. The conviction remains fully visible on the SAPS criminal record database and will still appear on an employment screening check or a visa application.
Permanent removal requires a formal expungement under section 271B, applied for in writing to the Department of Justice and Constitutional Development. The principal requirements are that at least ten years have passed since the date of conviction, that the sentence fell within the limited categories the section covers, including fines not exceeding R20 000 and sentences other than direct imprisonment without the option of a fine, and that the person has not been sentenced to direct imprisonment during that period. The Department indicates that a complete application takes approximately 60 working days.
The implication for a screening business is simple. An old, minor conviction will still surface on a check, and the appropriate response is proportionate assessment against the role rather than automatic exclusion.
Criminal Background Screening Solutions for South African Businesses
As South Africa's leading provider of world-class identity verification, screening and due diligence solutions, ThisIsMe gives businesses both levels of criminal background screening in one place. Our Forensic Assessment and Criminal Risk Indicator services deliver fast, scalable criminal risk indicators using nothing more than an identity number and name, ideal for first-pass screening across a workforce or client base. Where a confirmed result is required, our nationwide network of fingerprint capture providers uses gold-standard fingerprint technology cross-checked against SAPS criminal databases, with results returned in 48 hours. Combined with our identity verification, AML and sanctions screening, and ongoing monitoring solutions, ThisIsMe helps Accountable Institutions meet their Directive 8 obligations and build screening that stands up to FIC scrutiny. To experience our full suite of screening solutions and find out how we can serve your business, contact our team here.
