PAIA MANUAL

FICME (PTY) LTD

MANUAL IN TERMS OF SECTION 51 OF THE PROMOTION OF ACCESS TO INFORMATION ACT 2 OF 2000 ("PAIA")

AS AMENDED BY THE PROTECTION OF PERSONAL INFORMATION ACT, 4 OF 2013 ("POPIA")

FICME (PTY) LTD

(Registration Number: 2026/646530/07)

(hereinafter referred to as "FICME")

Document Control
Document type	PAIA MANUAL
Document owner	INFORMATION OFFICER
Division	LEGAL
Lead contact	DIRECTOR
Document status
Version	v1.0
Approved by	Directors	Date	01/10/2026
Date of publication	01/10/2026	Next review date	01/10/2027
Date of original publication	01/10/2026	Revision frequency	Annually and when material changes occur
Superseded documents	N/A
Related documents	Legal Policies / Notices

1. AN INTRODUCTION TO PAIA

The Promotion of Access to Information Act, 2000 (PAIA) came into operation on 9 March 2001.

PAIA seeks, among other things, to give effect to the Constitutional right of access to any information held by the State or by any other person where such information is required for the exercise or protection of any right and gives natural and juristic persons the right of access to records held by either a private or public body, subject to certain limitations, in order to enable them to exercise or protect their rights.

PAIA sets out the requisite procedural issues attached to information requests, including the obligation to compile a PAIA Manual.

Section 51 of PAIA obliges private bodies to compile a manual to enable a person to obtain access to information held by such body and stipulates the minimum requirements that the manual has to comply with.

Where a person is desirous of obtaining information from a private body, in terms of PAIA such request must be made in the format as prescribed and described under the private body's PAIA Manual, and following receipt of the request, such private body must disclose the information if the requester is able to show that the record is required for the exercise or protection of any rights, and provided that no grounds of refusal contained in PAIA are applicable.

2. OUR PAIA MANUAL

This Manual constitutes FICME (PTY) LTD, or "FICME's" PAIA manual.

This Manual is compiled in accordance with section 51 of PAIA as amended by the Protection of Personal Information Act, 2013 (POPIA), which gives effect to everyone's Constitutional right to privacy and largely commenced on 1 July 2020. POPIA promotes the protection of personal information processed by public and private bodies, including certain conditions so as to establish minimum requirements for the processing of personal information. POPIA amends certain provisions of PAIA, balancing the need for access to information against the need to ensure the protection of personal information by providing for the establishment of an Information Regulator to exercise certain powers and perform certain duties and functions in terms of POPIA and PAIA, providing for the issuing of codes of conduct and providing for the rights of persons regarding unsolicited electronic communications and automated decision making in order to regulate the flow of personal information and to provide for matters concerned therewith.

This PAIA manual also includes information on the submission of objections to the processing of personal information and requests to delete or destroy personal information or records thereof in terms of POPIA.

For purposes of this Manual, we refer to ourselves as "FICME", "we", "us" or "our".

We have compiled this Manual to inform you of, and guide you through, the procedural and other requirements with which a PAIA request must comply.

The Manual identifies contact details, available records, access procedures and remedies, and the processing information required by section 51. It complements the Core Privacy Policy, General Privacy Statement and Website Privacy Policy; it does not replace them or limit statutory rights.

Abbreviations: IO — Information Officer; DIO — Deputy Information Officer; FIC Act / FICA — Financial Intelligence Centre Act 38 of 2001; KYC — know your customer; POPIA — Protection of Personal Information Act 4 of 2013; PAIA — Promotion of Access to Information Act 2 of 2000.

3. WHO ARE WE - ABOUT US AND OUR BUSINESS

FICME is a compliance-passport platform that lets individuals, businesses and accountable institutions store, keep current, and share FICA/KYC documents. FICME provides a secure electronic platform for the collection, verification, management, storage and controlled sharing of information and supporting documentation required for customer due diligence, know-your-customer ("KYC"), anti-money laundering ("AML"), counter-terrorist financing ("CTF"), beneficial ownership verification and related compliance processes.

Subscribing accountable institutions may use additional verification services to check information supplied or released by a user against authorised providers and lawfully accessible sources. Services may include identity, company-registration, sanctions or targeted-financial-sanctions list and adverse-media checks, where available and lawful. Access to restricted databases is not created by user consent.

FICME is not appointed as the institution's statutory record keeper under section 24 of the FIC Act. Institutions must download and retain their own statutory records. Verification results are presented in a report through the app for the institution to download and store; FICME does not store that report. This does not remove FICME's duties concerning records actually in its possession or under its control, including records held by an operator on its behalf.

Our public website contains information about our business and services: https://ficme.app/

4. THE COMPANY

FICME (PTY) LTD is a private limited liability company duly registered under Registration Number 2026/646530/07.

5. OUR BOARD OF DIRECTORS

Our directors are:

1. L Oosthuysen
1. DF Theron
1. LC Theron

The composition of the Board of Directors may change from time to time.

6. OUR CONTACT DETAILS

Our general contact details are as follows:

Postal Address: 3 Rose Street, Wellington, Western Cape, South Africa, 7655

Street Address: 3 Rose Street, Wellington, Western Cape Province, South Africa, 7655

Telephone contact number: +27 (0) 21 864 5180

7. DETAILS OF OUR INFORMATION OFFICER AND DEPUTY INFORMATION OFFICERS

The details of our Information and Deputy Information Officer/s are as follows:

Information Officer:

Name: Lorraine Oosthuysen

Address: 3 Rose Street, Wellington, Western Cape Province, South Africa, 7655

Telephone number: +27 (0) 21 864 5180

Email: privacy@ficme.app

Information Regulator reference number: 2026-064546

Correspondence:

For the attention of the Information Officer

Phone number for PAIA / POPIA requests: +27 (0) 21 864 5180

Email address for PAIA / POPIA requests: privacy@ficme.app

8. PAIA GUIDE

The Information Regulator's Guide, issued under section 10 of PAIA, explains PAIA and POPIA access rights, how to request records, the assistance available, fees and remedies. Language versions and accessible formats are available through the Regulator. The Guide and current PAIA forms can be obtained at https://inforegulator.org.za/paia/ or from our Information Officer. A copy of the Guide in [insert at least two official languages actually available] is available for public inspection at our office during normal office hours; the Information Officer will provide copies or assistance on request in accordance with the PAIA Regulations.

You may also contact the Information Regulator directly:

The Information Regulator (South Africa)

Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

Telephone: 010 023 5200; toll-free: 0800 017 160. Website: https://inforegulator.org.za/

Complaints email: PAIAComplaints@inforegulator.org.za

General enquiries: enquiries@inforegulator.org.za.

Current contact details and complaint channels: https://inforegulator.org.za/contact-us/

9. INFORMATION THAT IS AUTOMATICALLY AVAILABLE WITHOUT A PAIA REQUEST

Our public company and service information, published pricing, public contact details, this PAIA Manual, published privacy policies and other public legal notices are available without a formal PAIA request through our website or by contacting our Information Officer. This does not make user profiles, uploaded documents, verification information or internal business records publicly available. Authorised account access remains subject to authentication and the relevant sharing permissions.

10. RECORDS KEPT IN TERMS OF LEGISLATION

The legislation below is relevant to records FICME creates, holds or makes available, where applicable to its activities. A statutory duty to retain a record does not make it automatically available to everyone; access under another law is subject to that law's requirements, and other access requests are assessed under PAIA..

The following list identifies the legislation and relevant record categories:

Basic Conditions of Employment Act 57 of 1997

Banks Act 94 of 1990

Companies Act 71 of 2008

Close Corporations Act 69 of 1984

Compensation for Occupational Injuries and Diseases Act 130 of 1993

Electronic Communications and Transactions Act 25 of 2002

Employment Equity Act 55 of 1998

Financial Intelligence Centre Act 38 of 2001

Income Tax Act 58 of 1962

Labour Relations Act 66 of 1995

Occupational Health and Safety Act 85 of 1993

Regulation of Interception of Communications and Provision of Communication-Related Information Act 70 of 2002

Promotion of Access to Information Act 2 of 2000

Protection of Private Information Act 4 of 2013

Trade Marks Act 194 of 1993

Trust Property Control Act 57 of 1988

Unemployment Insurance Act 30 of 1966

Value Added Tax Act 89 of 1991

Income Tax Act 58 of 1962

Tax Administration Act 28 of 2011

National Credit Act 34 of 2005

This list is not exhaustive.

11. A DESCRIPTION OF SUBJECTS WE HOLD RECORDS ON AND CATEGORIES OF RECORDS

The following subjects and record categories describe records held by FICME, where applicable. Listing a category does not guarantee that every listed record exists or that it is disclosable. Access depends on the applicable law, including protection of third-party information and legally privileged records.

Companies Act Records

Documents of Incorporation;
Memorandum of Incorporation;
Minutes of Board of Directors meetings and General Meetings;
Written Resolutions;
Records relating to the appointment of directors / auditors / company secretary / public officer and other officers;
Share Register and other Statutory Registers; and
Other Statutory Records.

Financial Records

Annual Financial Statements;
Tax Returns;
Accounting Records;
Banking Records;
Bank Statements;
Electronic Banking Records;
Asset Register;
Rental Agreements; and
Invoices.

Income Tax Records

PAYE Records;
Documents issued to employees for income tax purposes;
Records of payments made to SARS on behalf of employees;
All other statutory compliances;
VAT;
Skills Development Levies;
UIF; and
Compensation for occupational injuries and diseases records, where applicable.

Personnel Documents and Records

Employment contracts;
Employment policies and procedures;
Employment Equity Plan;
Medical Aid records;
Pension Fund records;
Internal evaluations and disciplinary records;
Salary records;
Disciplinary codes;
Leave records;
Training records and manuals;
Operating manuals;
Personal records provided by personnel;
Other statutory records; and
Related correspondence.

Platform and Customer Records

registration and account particulars;
identity, address, entity, ownership and supporting compliance documents;
completed questionnaires; sharing authorisations, withdrawal and access records; subscription agreements; service communications and complaints.

Billing and add-on services

subscription invoices and payments;
credit purchases, balances, usage and refunds;
verification requests and associated authorisation, billing and technical audit records actually retained.
Verification reports are displayed for the institution to download and are not stored by FICME.

Operational and Compliance Records

supplier and operator agreements;
software and intellectual property records;
security and access logs; incident records;
privacy and PAIA requests and decisions; lawful processing assessments; and
relevant marketing and website records.

12. INFORMATION RELATED TO POPIA

12.1 Introduction

POPIA requires us to provide you with certain information relating to how personal information that we process is, amongst others, used, disclosed and destroyed.

FICME facilitates collection, management, storage and authorised sharing of compliance documents, and offers subscribing accountable institutions optional add-on verification services through lawfully accessible sources and authorised providers. It also processes personal information for account administration, subscriptions and credits, security, support, employment and other legitimate business operations. The Core Privacy Policy addresses platform processing; the General Privacy Statement explains general business processing and safeguards; the Website Privacy Policy addresses public website activity. These documents should be read with this Manual and are available through our website and Information Officer. This Manual provides record-access information and does not itself constitute consent or expand the purposes permitted by those notices.

We have set out the required information below.

12.2 Information on how you can request your personal information under POPIA

Under section 23 of POPIA, a data subject who provides adequate proof of identity may ask, free of charge, whether FICME holds personal information about that data subject. Access to the information or a description of it, including the identity of third parties or categories of third parties who have or have had access, is dealt with under section 23 and the applicable PAIA procedures and refusal grounds. Section 13 below explains how to submit an access request. No FICME subscription is required to exercise these rights.

You may also request correction or deletion under section 24 of POPIA or object under section 11(3), whether or not you have first obtained access. Sections 14 and 15 explain these separate, free procedures.

The forms in Appendices C and D are provided for convenience. Substantially similar requests and other accessible methods permitted by the amended POPIA Regulations are accepted.

Where a fee for providing access under section 23 of POPIA is lawfully payable, we provide a written estimate in advance and may request a lawful deposit. Confirmation whether information is held is free. No fee is charged for an objection or a correction, deletion or destruction request under the POPIA Regulations.

12.3 Purpose of processing

POPIA provides that personal information may only be processed lawfully and in a reasonable manner that does not infringe your (the data subject's) privacy.

We process relevant personal information to operate accounts and authorised document sharing; facilitate requested lawful verification checks; administer subscriptions, purchased credits, usage and refunds; provide support; secure our systems; manage employment, recruitment, suppliers and professional advisers; maintain corporate and financial records; comply with law and address legal claims; and communicate with users, including marketing only where legally permitted. The applicable privacy notice explains the purpose and lawful basis. Further processing must comply with POPIA, including purpose compatibility requirements.

12.4 Personal information that is processed; category of data subject; and category of personal information

The information provided under this section refers to broad categories of information.

These categories apply only where relevant, necessary and lawfully justified; they are not a general authorisation to collect every listed item.

Clients - Natural persons: names; contact details; physical and postal addresses; date of birth; ID number; tax related information; nationality; gender; confidential correspondence.

Clients – Juristic persons / entities: names of contact persons; name of legal entity; physical and postal address and contact details; financial information; registration number; founding documents; tax related information; authorised signatories; beneficiaries; ultimate beneficial owners.

Clients – Foreign persons / entities: names; contact details; physical and postal, financial information addresses; date of birth; passport number tax related information; nationality; gender; confidential correspondence; registration number; founding documents; tax related information; authorised signatories, beneficiaries, ultimate beneficial owners

Contracted Service Providers: Names of contact persons; name of legal entity; physical and postal address and contact details; financial information; registration number; founding documents; tax related information; authorised signatories, beneficiaries, ultimate beneficial owners

Intermediary / Advisor: Names of contact persons; name of legal entity; physical and postal address and contact details; financial information; registration number; founding documents; tax related information; authorised signatories, beneficiaries, ultimate beneficial owners

Employees, applicants, directors, shareholders, contractors and relevant dependants or next of kin: identification and contact details; qualifications and employment history; remuneration, tax and banking records; performance, disciplinary and leave records; shareholding and interests; and necessary benefit or emergency-contact information. Health, race, criminal-conduct, trade-union or children's information is processed only where necessary and specifically authorised under POPIA.

Website visitors and application users: relevant account and contact details, device and browser information, IP addresses, authentication and access logs, support correspondence, cookies and usage information as described in the applicable Website Privacy Policy and Cookie Policy. Precise GPS location is not assumed to be collected.

Persons represented in compliance submissions — directors, trustees, beneficiaries, beneficial owners, authorised signatories and other relevant connected persons, including minors where lawfully necessary: identification, relationship, authority, ownership and supporting compliance information. Verification processing may include names, identifiers, company details, query references and relevant response data; displayed reports are not stored by FICME.

12.5 Categories of recipients for purposes of processing personal information

We disclose only relevant personal information, for a lawful and identified purpose, to the following categories where applicable:

Authorised management and personnel who need access for their duties;
Subscribing accountable institutions receiving user-authorised compliance information and requested verification results;
Authorised verification providers and lawfully accessible authorities or data sources, limited to the information needed for the requested check;
Contracted hosting, technical support, communications, payment, payroll or other service providers to the extent needed for the relevant service; and
Professional advisers, auditors, insurers and regulators or other public authorities where a lawful basis supports disclosure.

Disclosure of compliance documents to a subscribing accountable institution is governed by the user's sharing authorisation, unless another lawful basis requires or permits the disclosure. Each institution remains responsible for its own processing and statutory record retention. This user-directed sharing is distinct from necessary service-provider access and lawful disclosures described above; it does not permit unrestricted access by other subscribers.

Group membership, shareholding or a commercial relationship does not itself entitle any person to personal information. Any disclosure to an associated entity requires a specific lawful purpose and appropriate safeguards.

Operators processing information for FICME are bound by written contracts addressing the security obligations required by section 21 of POPIA and confidentiality. Independent responsible parties remain responsible for their own processing. We assess legal demands before disclosing information.

12.6 Actual or planned trans-border flows of personal information

Where we transfer personal information outside South Africa, including through hosting, backups or remote support, we establish an applicable ground under section 72 of POPIA before transfer. Where we rely on the recipient's law, binding corporate rules or binding agreement, the protection must be adequate and substantially similar to POPIA, including restrictions on onward transfers. We give the information about intended transfers and the level of protection required by section 18 through this notice and applicable supplementary notices..

We endeavour to enter into written agreements to ensure that other parties comply with our confidentiality and privacy requirements. Personal information may also be disclosed where we have a legal duty or a legal right to do so.

12.7 General description of information security measures

FICME employs appropriate, reasonable technical and organisational measures to prevent loss of, damage to or unauthorised destruction of personal information and unlawful access to or processing of personal information. These measures include:

Firewalls;
Virus protection software and update protocols;
Logical and physical access control;
Secure setup of hardware and software making up our information technology infrastructure; and
Outsourced service providers who are contracted to implement security controls.

Safeguards also include access permissions limited to duties, confidentiality obligations, secure information transfer, incident-response procedures, appropriate recovery arrangements, and periodic review of risks and controls. These safeguards address confidentiality, integrity and availability; no system is guaranteed to be immune from compromise.

REQUEST PROCEDURE

Completion of the prescribed form

Any request for access to a record from a public body in terms of PAIA must substantially correspond with the form attached hereto marked Appendix A - FORM 2 - Request for access to record of private body (Section 53(1) of PAIA) [Regulation 7].

A request for access to information which does not comply with the formalities as prescribed by PAIA will be returned to you.

Payment of the prescribed fees

A Fee may be payable, depending on the type of information requested, as described under Appendix B - Fees in respect of private bodies.

There are two categories of fees which are payable:

The request fee: R140
The access fee: This is calculated by taking into account reproduction costs, search and preparation costs, as well as postal costs.

Section 54 of PAIA entitles FICME to levy a charge or to request a fee to enable it to recover the cost of processing a request and providing access to records. The fees that may be charged are set out in Regulation 9 promulgated under PAIA.

Where a decision to grant a request has been taken, the record will not be disclosed until the necessary fees have been paid in full.

POPIA provides that a data subject may, upon proof of identity, request FICME to confirm, free of charge, all the information it holds about the data subject and may request access to such information, including information about the identity of third parties who have or have had access to such information.

Under section 23(1)(a) of POPIA, confirmation whether we hold personal information about you is free upon adequate proof of identity. A request for the actual information or a description of it under section 23(1)(b), including relevant third-party access information, is subject to any lawfully permitted access fee and refusal grounds.

POPIA also provides that where the data subject is required to pay a fee for services provided to him/her, FICME must provide the data subject with a written estimate of the payable amount before providing the service and may require that the data subject pays a deposit for all or part of the fee.

If a record cannot be found or is believed not to exist after reasonable steps, we provide the affidavit or affirmation required by section 55, explaining the search. If subsequently found, the request is considered unless lawful refusal grounds apply. We do not destroy, alter or conceal a record to defeat an access request.

OBJECTION

POPIA provides that a data subject may object, at any time, to the processing of personal information by FICME, on reasonable grounds relating to his/her particular situation, unless legislation provides for such processing. The data subject must complete the prescribed form attached hereto as Appendix C - FORM 1 - Objection to the processing of personal information in terms of section 11(3) of POPIA Regulations relating to the protection of personal information, 2018 [Regulation 2] and submit it to the Information Officer at the postal or physical address, facsimile number or electronic mail address set out above.

CORRECTION

A data subject may also request FICME to correct or delete personal information about the data subject in its possession or under its control that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully; or destroy or delete a record of personal information about the data subject that FICME is no longer authorised to retain records in terms of POPIA's retention and restriction of records provisions.

Submit the request free of charge to the Information Officer using Appendix D (POPIA Form 2), a substantially similar form or another reasonably accessible method permitted by the amended Regulations, including email, post, hand delivery or telephone. Telephone requests are recorded and the recording or transcription is available free of charge on request. We act as soon as reasonably practicable under section 24, inform you of the action taken within the period prescribed by Regulation 3(6), and, where required, notify persons to whom affected information was disclosed. Where correction is disputed and requested by the data subject, the record will reflect that dispute as required by section 24.

PROOF OF IDENTITY

We require adequate proof of identity and, where relevant, authority to act for another person before releasing protected records or implementing a rights request. Verification must be proportionate to the request and risk. A certified identity-document copy is not invariably required; the Information Officer will explain acceptable evidence and a secure submission method. Only information reasonably necessary to verify identity or authority will be requested.

TIMELINES FOR CONSIDERATION OF A REQUEST FOR ACCESS

Subject to the special third-party procedure in sections 71–73 of PAIA, we decide a PAIA access request and notify the requester as soon as reasonably possible and within 30 days after receipt of the request or the particulars required by section 53(2).

An extension under section 57 may be taken once, for no more than a further 30 days, only on a statutory ground. We notify you within the initial 30-day period, giving the duration, reasons and remedies. A failure to give a decision within the applicable period is a deemed refusal under section 58. Objections and correction requests under POPIA follow sections 14 and 15 of this Manual rather than being treated automatically as PAIA access requests..

18. GROUNDS FOR REFUSAL OF ACCESS AND PROTECTION OF INFORMATION

Access may or must be refused only where an applicable ground in Chapter 4 of Part 3 of PAIA is established, subject to the statutory exceptions and public-interest override. Relevant grounds include:

the protection of personal information of a third person (who is a natural person) from unreasonable disclosure;
the protection of commercial information of a third party (for example: trade secrets; financial, commercial, scientific or technical information that may harm the commercial or financial interests of a third party);
if disclosure would result in the breach of a duty of confidence owed to a third party;
if disclosure would jeopardise the safety of an individual or prejudice or impair certain property rights of a third person;
if the record was produced during legal proceedings, unless that legal privilege has been waived;
if the record contains trade secrets, financial or sensitive information or any information that would put FICME at a disadvantage in negotiations or prejudice it in commercial competition; and/or
if the record contains information about research being carried out or about to be carried out on behalf of a third party or by FICME.

Section 70 of PAIA contains an overriding provision. Disclosure of a record is compulsory if it would reveal (i) a substantial contravention of, or failure to comply with the law; or (ii) there is an imminent and serious public safety or environmental risk; and (iii) the public interest in the disclosure of the record in question clearly outweighs the harm contemplated by its disclosure.

If the request for access to information affects a third party, then such third party must first be informed within 21 (twenty-one) days of receipt of the request. The third party would then have a further 21 (twenty-one) days to make representations and/or submissions regarding the granting of access to the record.

19. REMEDIES AVAILABLE TO A REQUESTER ON REFUSAL OF ACCESS

We notify the requester of the decision, ordinarily using PAIA Form 3, stating the access arrangements and any lawful fee or, if refused, adequate reasons and the provisions relied upon without revealing protected contents. The notice explains the applicable complaint and court remedies and periods.

FICME is a private body. PAIA does not provide an internal appeal against its decisions. You may contact the Information Officer for clarification or reconsideration, but this is not a prerequisite to a complaint and does not suspend statutory deadlines.

An aggrieved requester may lodge a complaint with the Information Regulator under section 77A, ordinarily within 180 days of the decision or deemed refusal, using PAIA Form 5, available at https://inforegulator.org.za/paia/. Submit it through the Regulator's published complaint channels, including PAIAComplaints@inforegulator.org.za. Complaints may concern refusal, fees, an extension or the form of access. Court relief is subject to sections 78–82, including the applicable exhaustion requirements and 180-day period; obtain prompt advice on the relevant route and deadline. A late complaint may require condonation.

Where access is granted to records subject to third-party notification, section 73 requires notice of the third party's right to challenge the decision within 30 days and postpones access for that period. A complaint or court application lodged within that period prevents release pending the applicable process. The general section 77A complaint period does not mean that release is automatically suspended for 180 days; a third party seeking to prevent release must act within the section 73 period.

20. AVAILABILITY OF THIS MANUAL

This Manual is available free of charge on our website and for public inspection during normal business hours at 3 Rose Street, Wellington, Western Cape, 7655. Copies are available from the Information Officer; any charge for a paper copy is limited to the prescribed reproduction fee. It is supplied to the Information Regulator on request.

21. UPDATING THE MANUAL

The head of FICME, assisted by the Information Officer, reviews this Manual at least annually and updates it promptly when contacts, records, processing, law or access procedures materially change. The version, approval and publication dates are recorded in the document-control section.