Regulatory Reporting

The Reporting API lets you draft regulatory reports; Suspicious Transaction Reports and related FIC filings directly from the data you already send to Orca.

How submission works

The Reporting API does not file anything with the FIC.

Every report created through the API is created as a draft. It enters the approval queue in the Orca dashboard, where a person in your compliance team must open it, check it, complete anything the API could not supply, and submit it. Submission to the Financial Intelligence Centre happens only from the Orca dashboard, and only on an explicit human action.

This is deliberate. A report under section 29 of the Financial Intelligence Centre Act 38 of 2001 is a statement by your institution that it holds a suspicion. That judgement belongs to your reporting officer, not to an API call. So Orca splits the work:

The API autopopulates. Everything Orca can derive: the subject’s identity and KYC detail, the transaction and account particulars, the reporting entity block, the reporting person and location, the reason narrative, the indicator codes etc is filled in from the user, transaction and merchant objects you have already sent, plus your client configuration.
A human decides and files. Your reporting officer reviews the populated draft in the dashboard, edits it, and submits. Nothing reaches the FIC without that step.

In practice this means a report that would otherwise be assembled by hand from spreadsheets arrives already written, and the reviewer spends their time on the suspicion rather than on data entry.

The FIC and goAML

South African accountable and reporting institutions file with the Financial Intelligence Centre through goAML, the FIC’s electronic registration and reporting platform. Filing is only possible for a registered reporting entity, identified by its reporting entity ID (rentityId). Orca holds your rentityId, reporting person and reporting location in your client configuration and stamps them onto every draft, so you never send them on the request.

goAML gives every report type one standard structure: a report header identifying the report type, the reporting entity, the filing date and the responsible compliance officer; one or more transactions; and, on each transaction, a from and to side that resolves to a person, an entity and an account. Orca maps your Orca-level objects onto that structure for you.

Report types

Type	FIC Act	Description
`STR`	Section 29	Suspicious Transaction Report: a transaction that was concluded
`SAR`	Section 29	Suspicious Activity Report: suspicious conduct or an attempted transaction with no concluded transaction
`CTR`	Section 28	Cash Threshold Report: cash above the prescribed threshold
`IFTR`	Section 31	International Funds Transfer Report: reportable cross-border electronic transfers
`Other`	—	Any other report type your configuration supports

Section 29 reports must reach the FIC as soon as possible, and no later than 15 days after the suspicion arises. Because the API only produces drafts, the 15-day clock is met by your reviewer submitting from the dashboard, creating the draft does not stop it. Draft age is visible in the approval queue for this reason.

Reporting indicators

goAML classifies the grounds for a report using the FIC’s published indicator codes (RIND***), for example:

Code	Indicator
`RIND002`	Activity does not match client profile or expected transacting patterns
`RIND049`	Increased account activity
`RIND094`	Suspicious Transaction Report (STR): s29 FIC Act 38 of 2001
`RIND104`	Transfer of funds between accounts
`RIND105`	Unexplained account activity
`RIND124`	Unusual transaction (or series of transactions): s29 FIC Act 38 of 2001

You may supply indicator codes on the request, and your reviewer can add or remove them in the dashboard. The full indicator list is available in the dashboard and from the FIC.

Confidentiality

Section 29 of the FIC Act attaches confidentiality to the fact that a report was made. Disclosing that a report exists, outside a lawful purpose, is an offence (“tipping off”). Two consequences for integrations:

Never surface report state to the subject. Do not expose report status, existence, or the outcome of GET /v1/reports in any customer-facing surface, notification, or support view.
Report reads are audited. Access to a report through the API and the dashboard is written to the report audit trail, including who read it and when.

Report lifecycle

Status	Meaning
`draft`	Created by the API, by a rule action, or by hand. Awaiting review.
`pending_review`	Picked up by a reviewer in the dashboard.
`submitted`	Filed with the FIC. An FIU reference number is recorded when goAML returns one.
`rejected`	Rejected by the FIC. The rejection reason is recorded on the report.
`resubmission_required`	Rejected and requires correction and refiling.
`amended`	Resubmitted after correction, carrying the previous reference number.
`archived`	Closed out. Retained for audit.

Reports created over the API always begin at draft. The API cannot set any other status.

Enablement

Reporting is enabled per client. Your rentityId, reporting person, reporting location, report templates and available indicators are all configured by Orca. Contact support@orca-fraud.com to enable reporting or to change your reporting entity details.