RMCP (Risk Management and Compliance Programme)

A Risk Management and Compliance Programme (RMCP) is a written programme that every accountable institution under FICA must develop, document, maintain, and apply. For property practitioners, this is non-negotiable: the FIC and PPRA may request the RMCP at any time during an inspection.

What an RMCP must cover

• How the firm identifies and assesses money-laundering and terrorist-financing risks
• Customer due diligence procedures (standard, simplified, and enhanced)
• Procedures for ongoing monitoring of business relationships
• Record-keeping policies and retention periods
• Reporting procedures for suspicious and cash-threshold transactions
• Staff screening, training, and competence requirements
• Sanctions screening procedures
• How the programme will be reviewed and updated

Risk-based approach

FICA expects accountable institutions to apply a risk-based approach: not every client gets the same level of scrutiny. High-risk clients (politically exposed persons, certain jurisdictions, complex ownership structures) require enhanced due diligence; lower-risk clients may qualify for simplified procedures.

Common RMCP gaps

In FIC inspections, the most common findings are RMCPs that are generic templates not tailored to the firm, no documented risk assessment, no evidence of staff training, and inconsistent record-keeping. The programme must be operational, not just on paper.

How REAPS supports your RMCP

While REAPS does not write your RMCP for you, it provides the operational backbone: enforced KYC capture, classification of clients by risk band, automated record retention, audit trails of every action, and reports that demonstrate your RMCP is being applied in practice.