Micro-Finance Compliance Pack

Micro-lenders and credit providers granting loans against security of movable or immovable property, and persons conducting the business of lending money against pledge, are Accountable Institutions under Schedule 1, Item 11 of FICA. They must register with the FIC via the goAML platform before conducting business. Registration is a prerequisite for fulfilling FICA reporting obligations (STRs, CTRs, TPRs). Penalty: Operating without FIC registration — administrative sanction up to R10 million (FICA s45C); cannot file required reports.

Every accountable institution must develop, document, maintain, and implement a Risk Management and Compliance Programme (RMCP) as required by FICA s42. For micro-lenders, the RMCP must address: ML/TF risks specific to cash-intensive lending, customer identification procedures for walk-in borrowers, source of funds verification for repayments, record keeping, reporting obligations, employee training, and compliance monitoring. RMCP must be approved by senior management and reviewed annually. Penalty: Up to R50 million administrative sanction (FICA s45C).

Any person who enters into a credit agreement as a credit provider, regardless of the principal debt owed, must be registered with the National Credit Regulator (NCR) per NCA s40. Application is made via Form 2 (NCA Regulations) and requires: company registration documents, directors/shareholders fit and proper declarations, proof of compliance management systems, FICA Accountable Institution registration, proof of physical address, and prescribed registration fee (sliding scale based on projected loan book). Processing time: 6-10 weeks. Penalty: Operating as a credit provider without registration is an offence — fine up to R1 million or imprisonment up to 10 years (NCA s157), plus agreements may be declared unlawful and void under NCA s89.

All credit marketing and advertising must comply with NCA s75-s76: quoted interest rates must reflect actual rates offered, cost of credit must be fully disclosed, negative option marketing is prohibited, and direct-marketed credit agreements trigger cooling-off rights. Advertisements must not be misleading and must state the credit provider's NCR registration number (NCRCP prefix). The NCR may require the withdrawal of non-compliant advertising.

Credit providers MUST conduct an affordability assessment before entering into any credit agreement, per Regulation 23A (GN 202 of March 2015). The assessment must: (a) validate existing financial means, prospects, and obligations by obtaining the 3 most recent payslips / bank statements / financial statements; (b) calculate a minimum monthly living expense using the prescribed table (Annexure A) unless actual figures are provided; (c) assess existing debt obligations via a credit bureau enquiry; (d) calculate discretionary income and confirm it is sufficient for the new repayment. Records must be retained for minimum 3 years. Penalty: Credit granted without compliant affordability assessment is reckless credit (NCA s80(1)(b)), exposing the provider to NCT set-aside orders and NCR fines.

Credit providers must notify the NCR of any change in business address, branch opening, branch closure, or appointment of authorised agents within 20 business days. Each branch attracts a separate registration fee. Unnotified branches may render agreements concluded there invalid. Reference: NCA s51, NCR Registration Conditions.

Credit providers and their collections agents must comply with the NCA's prohibited conduct provisions (s129-s133) and the Debt Collectors Act 114 of 1998 where third-party collectors are used. Prohibited practices include: harassment, contact outside reasonable hours, contacting third parties (except to confirm consumer location), false representation, threats of action that cannot lawfully be taken, and charging unauthorised collection fees. All collections must be reconciled to the loan account daily. Credit providers must maintain a collections register and ensure out-of-court collections cap at prescribed legal fees (Magistrates' Court tariff). Penalty: Prohibited conduct complaint to NCR; sanctions under Debt Collectors Act.

Credit agreements and marketing materials must comply with the Consumer Protection Act 68 of 2008 (CPA) — although credit agreements are primarily regulated by the NCA, CPA provisions on plain language (s22), prohibited marketing practices (s29-s30), and unfair contract terms (s48-s52) apply to consumer-facing communications, brochures, websites, and SMS campaigns. All consumer-facing disclosures must be in plain language and (where feasible) an official language the consumer understands.

For credit agreements entered into as a result of direct marketing, or where the consumer was visited at their home/workplace, the consumer has a 5 business day cooling-off right. The credit provider must disclose this right in the pre-agreement quotation and in the agreement itself. During the cooling-off period, the consumer may terminate by delivering a notice and returning any advanced funds. Credit providers must have a process to: identify direct-marketed agreements, honour rescission notices, and refund consumers promptly.

Credit providers must submit monthly updates to registered credit bureaux (TransUnion, Experian, XDS, Compuscan) for all credit agreements. Submissions must include: consumer identity, agreement type, principal debt, current balance, payment profile, arrears status, and account status (active, settled, written off, under debt review). Data must be accurate — incorrect listings expose the provider to defamation and NCA s72 complaints. The NCR Credit Information Regulations (GN R144 of 2006) prescribe data fields and submission frequencies. Penalty: Incorrect or late submissions — NCR enforcement; consumer may demand removal of adverse listings; damages claims.

All new debit order collections on credit agreements must be authenticated via DebiCheck — a customer-approved, authenticated debit order mandate managed by PASA (Payments Association of South Africa). The consumer must authorise the mandate via their bank's channel before the first collection. DebiCheck was phased in from 2017 and replaced early debit orders (EDO) for consumer credit agreements. Credit providers must: register with PASA and their sponsoring bank, capture mandate details accurately, and manage mandate amendments per PASA rules. Reference: SARB NPSD Circular, PASA DebiCheck rules.

When a consumer applies for debt review, the debt counsellor notifies all credit providers on Form 17.1 within 5 business days. Credit providers must: (a) suspend enforcement action on the affected agreements pending the debt review outcome; (b) provide certificates of balance promptly on request; (c) engage in good faith with the proposed restructuring; (d) accept NCT / Magistrate's Court consent orders. Credit providers may only proceed with enforcement where debt review is formally terminated under s86(10) or s88(3). Penalty: Enforcement in breach of debt review is prohibited conduct; costs and damages.

Directors, members, trustees and shareholders holding 5% or more of the credit provider must satisfy NCR fit and proper requirements at all times. Fit and proper considerations include: no disqualifying criminal convictions (dishonesty, fraud, theft, corruption), no unrehabilitated insolvency, no prior cancellation of a credit provider registration, and general good standing. Changes in directors or material shareholders must be notified to the NCR within 20 business days. Reference: NCA s46, NCR Registration Conditions.

Accountable institutions must file with the FIC via goAML: (1) Suspicious and Unusual Transaction Reports (STRs/SUTRs) — within 15 business days of forming a suspicion of ML, TF, or proliferation financing (FICA s29); tipping off the client is a criminal offence. (2) Cash Threshold Reports (CTRs) — all cash transactions of R49,999.99 or more within 2 business days (FICA s28). (3) Terrorist Property Reports (TPRs) — within 5 business days of knowledge (FICA s28A). Penalty: Failure to report — fine up to R100 million or imprisonment up to 15 years.

Before concluding any credit agreement, the lender must identify and verify the borrower per FICA s21. For natural persons: full names, date of birth, SA ID number, residential address, income tax number (if any). For legal persons: registered name, registration number, registered address, directors, and beneficial owners. Verification via SA ID + proof of address not older than 3 months, or electronic verification service (HANIS/DHA). Records must be retained for minimum 5 years after the business relationship ends (FICA s22-s24). Penalty: Up to R50 million administrative sanction.

Credit providers must not charge interest, fees or cost of credit exceeding the maximum rates prescribed in Schedule 5 (GN 1080 of November 2015, as amended). Current caps include: unsecured credit (repo + 21% per annum), short-term credit (5% per month on the first loan, 3% per month on subsequent loans), initiation fee (capped at R175 + 10% of principal above R1,000, maximum R1,207.50), monthly service fee (R69 incl. VAT), credit life insurance (R4.50 per R1,000 cover for short-term credit). Rates must be reviewed when SARB repo rate changes. Total cost of credit must be disclosed in the pre-agreement quote. Penalty: Overcharging is an offence (NCA s100, s101); consumer may claim refund via NCT; administrative fines.

Credit providers must maintain an internal complaints resolution process and respond to consumer complaints in a reasonable timeframe. Unresolved complaints may be referred to the NCR, the Credit Ombud, or a Consumer Court. Credit providers must cooperate with NCR investigations, provide requested documents within the timeframes stipulated in NCR notices, and implement NCR remedies. A complaints register must be maintained recording: complaint details, date received, investigator, resolution, and escalation. Reference: NCA s134-s137, Credit Ombud Rules.

Registered credit providers must pay annual renewal fees to the NCR and submit annual compliance returns. Renewal fees are calculated on loan book size and the number of branches. The annual compliance return (Form 39) must be submitted within 6 months of financial year-end and includes: gross loan book, number of active accounts, impairment ratios, reckless lending cases, complaints data, and branch information. Failure to submit or pay may result in registration being cancelled. Reference: NCA s52, NCR Circular 2 of 2015.

Credit providers must submit Form 39 Annual Statistical Return within 6 months of their financial year-end. The return details: total loan book value, number of agreements entered into, written-off amounts, reckless lending determinations made, total complaints received and resolved, impairment ratios, and branch-level data. Non-submission triggers NCR enforcement action and may result in cancellation of registration. Reference: NCA s52(5), NCR Compliance Reporting Framework.

Credit providers must deliver periodic statements of account to consumers at the frequency prescribed in s108: monthly for credit facilities, every 2 months for small agreements, every 3 months for intermediate/large agreements, and on request. Statements must show: opening balance, all credits and debits, fees and interest charged, closing balance, minimum payment due, and any overdue amounts. Delivery may be electronic if the consumer has consented. Penalty: Non-compliance is a prohibited conduct — NCR enforcement and administrative fines; consumer may bring a complaint to the NCT.

Before entering into a small or intermediate credit agreement, the credit provider must deliver to the prospective consumer a pre-agreement statement in the prescribed Form 20 / Form 20.2, and a quotation disclosing: principal debt, proposed distribution of amount, interest rate, all other credit costs, total cost of credit, basis of interest, rate, frequency of instalments, number of instalments, and balance due. The quotation is binding on the credit provider for 5 business days. Penalty: Failure to deliver may render the agreement unenforceable and expose the provider to NCT proceedings.

Before granting credit, providers must obtain a credit bureau report on the prospective consumer to assess existing debt obligations as part of the affordability assessment (Reg 23A). The enquiry must be recorded with the bureau as an 'enquiry' footprint. The credit provider must have a documented bureau enquiry SLA and retain the bureau report in the client file for minimum 3 years. Consumer consent for the enquiry must be obtained and retained.

Credit providers must not enter into a credit agreement if: (a) the consumer did not generally understand the risks, costs, or obligations; (b) entering the agreement would make the consumer over-indebted; or (c) no compliant affordability assessment was performed. Credit providers must maintain a documented reckless lending prevention policy, train loan officers on the NCA s80 indicators, and implement controls to reject applications where reckless lending risk exists. Consequences of reckless lending findings: NCT may suspend force and effect of the agreement, set aside all or part of consumer obligations, or restructure the debt (NCA s83). Repeat findings may trigger NCR enforcement action against registration.

Credit providers must retain credit agreement records, pre-agreement quotations, affordability assessments, identity verification records, and payment records for a minimum of 3 years from the date of the last transaction on the account (NCA Regulation 55). FICA records must be retained for 5 years from termination of the business relationship. Records may be stored electronically provided they are readable and retrievable. Penalty: Missing records undermine defence of reckless lending complaints and expose provider to NCR/FIC enforcement.

Before commencing any legal proceedings to enforce a credit agreement that is in default, a credit provider MUST deliver a notice to the consumer in terms of NCA s129(1)(a). The notice must: draw the default to the consumer's attention, propose that the consumer refer the agreement to a debt counsellor, alternative dispute resolution agent, consumer court or ombud, and propose that the parties resolve any dispute or agree on a plan to bring payments up to date. The consumer has 10 business days to respond. Proceeding without a valid s129 notice is fatal to the enforcement action. Penalty: Case dismissed; cost orders; re-start of enforcement process.

Every responsible party (including micro-finance providers) must register an Information Officer with the Information Regulator. By default, the CEO / head of the organisation is the Information Officer, but may delegate to a Deputy Information Officer. Registration is via the Information Regulator's eServices portal. The Information Officer is responsible for POPIA compliance, handling data subject requests, data breach notifications, and regulatory liaison. Reference: POPIA s55, Information Regulator Regulations 2018.

Credit providers process significant personal information (ID, financial history, employment details, beneficiary info). POPIA requires: (a) lawful basis for each processing activity (consent, contract, legal obligation, legitimate interest); (b) specific, informed consent for marketing use; (c) purpose limitation; (d) minimum necessary data; (e) data subject rights (access, correction, deletion); (f) security safeguards; (g) PAIA Manual describing records held, published on the company website and submitted to the Information Regulator. Penalty: Administrative fine up to R10 million; criminal offence with imprisonment up to 10 years for serious breaches.