South Africa completed its Financial Action Task Force (FATF) action plan and left the grey list in October 2025. The more telling test now is whether the systems built under pressure remain effective when there is no deadline forcing the issue. For businesses, that makes compliance less a regulatory exercise than part of the infrastructure required to grow with confidence.
| Background: What is the FATF? |
| The Financial Action Task Force (FATF) is an international group created in 1989 by the G7. It sets global rules to stop money laundering, terrorist financing, and the funding of mass destruction weapons. Over 200 countries use its guidelines to protect the world money system.1 |
Getting off the Financial Action Task Force (FATF) grey list was an important achievement for South Africa. It proved that a country faced with serious weaknesses in its anti-money laundering and counter-terrorist financing framework could mobilise regulators, law enforcement agencies and the private sector around a common set of reforms.
However, drawing up an action plan and proving that a system works in the long term aren’t mutually assured. The FATF’s assessment process does not end when a jurisdiction leaves increased monitoring. South Africa’s next mutual evaluation is already imminent, with a possible on-site assessment in February 2027 and plenary discussion later that year.
Even though policies and affiliated institutions exist, FATF also assesses whether the mandated measures are in place and producing the outcomes they were designed to achieve. Those measures include everything from customer due diligence, transaction monitoring and suspicious-transaction reporting to supervision, investigation, prosecution, asset recovery and cooperation between the institutions responsible for fighting financial crime.
For financial institutions and other accountable businesses, compliance has changed. Beyond whether an organisation can demonstrate that it has a policy, a screening process or a transaction-monitoring system, the real test is whether those controls work, whether leadership has a clear sight of risk, and whether the organisation can respond when the environment changes.
Compliance meets credibility
This is all happening in the shadow of the Madlanga Commission, which is examining allegations of criminality, political interference and corruption within the criminal justice system. The Commission’s work is ongoing, and its findings must be allowed to run their course. But the public discourse has already put institutional credibility in the spotlight.
In July, the Minister of Justice and the National Director of Public Prosecutions publicly acknowledged that testimony before the Commission had raised serious credibility concerns around the Investigating Directorate Against Corruption and affected public trust in its operations. The Commission’s final report is now due in November.
For the private sector, there is a useful principle here without attempting to prejudge any of the Commission’s findings. A framework is only as credible as its ability to operate as intended. Governance structures, policies and controls can’t be ignored, but confidence ultimately rests on whether they can withstand scrutiny in practice. The same is true of any anti-money laundering programme. A board may receive detailed compliance reports every quarter and still lack a consolidated view of the risks moving through the organisation. A business may have sophisticated technology and still struggle to explain why alerts are being generated, how decisions are being made or who is responsible when something goes wrong. This supports the argument that compliance maturity has become a business issue rather than a compliance-team issue.
From remediation to strategy
Greylisting forced many South African institutions to invest. Awareness was heightened, controls tightened, beneficial-ownership requirements reevaluated, and financial-crime risk climbed higher up the executive agenda. The mistake now would be to regard those investments as the cost of passing a regulatory test that is safely behind us.
Commercially, removing a country-level risk label does not mean that banks, investors, partners and counterparties stop assessing the quality of an individual organisation’s controls. In fact, it makes the organisation’s own compliance maturity more visible.
A business that understands its customers, can explain its risk exposure and has reliable information available when decisions need to be made is better equipped to onboard customers efficiently, enter new markets, satisfy potential partners and scale without accumulating compliance debt. Those are both regulatory and operating advantages.
Effective compliance infrastructure gives decision-makers better information. Better information allows risk to be assessed properly. And when systems are designed to grow with the business, expansion does not have to be followed by an expensive scramble to rebuild controls that were never designed for the new level of complexity.
The strongest organisations should stop asking how much compliance is enough to satisfy the regulator. The pertinent question is whether their financial-crime programme gives the business the visibility, resilience and confidence it needs to make good decisions.
Are we done yet?
There is no finish line for maintenance. South Africa’s greylisting jumpstarted urgency because the consequences were visible and the deadlines were finite. The next phase is more difficult precisely because it is less dramatic. Maintaining effectiveness requires continued investment when there is no crisis forcing the conversation.
FATF’s next evaluation will provide one external measure of how well South Africa has sustained its progress. The wider credibility debate playing out through the Madlanga Commission is the big yellow Post-it note reminding us that trust cannot be established through structures alone.
Compliance cannot be something we build for an inspection and hide in a cupboard. It must function every day, under changing conditions, with enough visibility for leadership to understand what is happening and enough resilience to support where the business wants to go next.
Staying credible, competitive and ready for what comes next will require something more enduring.
Written By Bradley Elliott, CEO at RelyComply