Know-your-customer rules were written to keep bad money out of the financial system. They were not written for a customer whose documents are correct today and unrecoverable next week. That is the pressure now bearing on South African banks and fintechs: returnees and displaced migrants report permit-renewal and documentation problems, and every documentation gap runs straight into a KYC control designed to treat gaps as risk. The result is a quiet mechanism by which a due-diligence process meant to protect the system starts pushing lawful customers out of it.
Reporting on the situation of returnees and their paperwork points to a specific failure surface: not fraud, but friction. A permit lapses in the disruption of leaving or being pushed to leave; a renewal stalls in an administrative system under strain; a document is lost. The customer has done nothing wrong, but the account flags, freezes or requires re-verification the customer cannot complete — and customer flight follows, often into the informal economy the KYC regime was built to keep money out of.
When a Control Becomes an Exit
The design assumption behind enhanced due diligence is that a documentation problem signals elevated risk. Usually it does. Under a displacement event, that assumption inverts: documentation problems cluster among exactly the lawful, long-banked customers whose lives have been disrupted, not among bad actors. A control calibrated for the ordinary case now misfires systematically against a specific population.
The misfire has a name in the industry: de-risking — exiting whole customer categories that look, on paper, harder to verify. It is the path of least resistance for a compliance function under pressure, and it is precisely the wrong response here, because it converts an administrative problem into a permanent loss of banked customers and hands them to informal channels beyond any supervisor’s sight. The Financial Times has framed the anti-migrant surge as a macroeconomic risk; indiscriminate de-risking is how the financial sector would import that risk onto its own books.
A control that cannot tell disruption from wrongdoing will punish the disrupted.
Enhanced Due Diligence Without Indiscriminate De-Risking
The intelligence task is to hold both obligations at once: maintain genuine due diligence and avoid indiscriminate de-risking. These are not in conflict if the process is designed with care.
The starting move is to distinguish documentation friction from actual risk. A long-standing customer with a consistent transaction history and a stalled permit renewal is a different risk object from a new, unverifiable account, and the system should treat them differently. Tenure, transaction consistency and prior verification are risk-relevant evidence that a blunt document check discards.
The second move is graduated response. A lapsed or pending document should trigger a servicing pathway — a defined renewal grace approach, a supported re-verification route, a document-recovery process drawing on records the institution already holds — before it triggers a freeze or exit. The aim is to give a lawful customer a way back to good standing rather than an automatic off-ramp out of the bank.
The third move is to treat the administrative environment as a known variable. If permit renewals are slowing at Home Affairs, a compliance function that models renewal timelines and builds tolerance for administrative delay is reading its operating conditions accurately. Ignoring the delay and enforcing as if the system were normal is a modelling error, not prudence.
Enhanced due diligence should sharpen judgement, not replace it with a document checkbox.
The So-What for the Desk
The action is to review enhanced due diligence now, deliberately separating documentation friction from genuine risk and refusing the reflex of indiscriminate de-risking. That means weighting customer tenure and transaction history against a single lapsed document, building graduated servicing pathways and document-recovery routes before any freeze, and modelling administrative delay as a known condition rather than a red flag. The regulatory posture supports this: proportionate, risk-based due diligence has always been the standard, and this is where the standard earns its keep.
KYC exists to keep the system clean. Applied without judgement in a displacement event, it does the opposite — cleaning lawful customers out and washing money toward the informal channels no one can see. The banks that keep the judgement in due diligence keep both their compliance integrity and their customers.
