The FSCA Regulatory Examinations FAQ identifies RE4 as the examination for FSPs and Key Individuals in Category III, focused on the Category III Code of Conduct; it states that RE4 has 30 multiple-choice questions and is written in addition to RE1, while compliance officers in Categories I, II, IIA, III and IV are listed under RE1. The title “RE4 Regulatory Exam - Compliance Officers” and the compliance-function topics here are therefore not presented as an official RE4 description; use them as subject-review knowledge for compliance roles in South Africa’s FAIS environment. Do not treat the topics, 20 MCQs or any exam details as official weightings, current availability, fees, deadlines or a comprehensive syllabus—verify them with the FSCA or the examination body. This knowledge preview is not a simulation of the official exam. Scope alert: The supplied FSCA FAQ makes RE4 the Category III examination for FSPs and key individuals, written in addition to RE1. Compliance officers are listed under RE1. Use this guide as subject-review support, not as an official RE4 syllabus or exam simulation.
Scope Correction: What RE4 Is and Is Not
RE4 is a Category III regulatory examination for FSPs and key individuals, not a general compliance-officer credential.
The FSCA Regulatory Examinations FAQ identifies four regulatory examinations. According to that FAQ, RE4 applies only to FSPs and Key Individuals in Category III, focuses on the Category III Code of Conduct, consists of 30 questions, and must be written in addition to RE1. The same FAQ lists compliance officers in Categories I, II, IIA, III and IV under RE1. That means the title “RE4 Regulatory Exam - Compliance Officers” is not supported by the FAQ. If you are a compliance officer, first check whether RE1 is the applicable baseline; if you are a Category III FSP or key individual, treat RE4 as an additional, category-specific examination.
The FAQ describes the regulatory examinations as multiple-choice with four options and one selected answer, and states a 65% pass mark. Because that information may be legacy and examination availability can change, treat those details as subject review rather than a permanent promise. Verify current registration, format, fee and official requirements with the FSCA or the examination body before relying on them.
The four study domains in this knowledge preview—compliance independence, monitoring and records, FAIS risk and governance, and breach remediation—are compliance topics for subject review. They are useful supporting knowledge for a compliance role, but they are not asserted as official RE4 weightings or as a substitute for the Category III Code. If you are preparing for the actual RE4, current official material remains the controlling source.
Preparation Priorities: Role Boundaries First
Start with role boundaries and definitions, then move to evidence-based monitoring and remediation.
Because the supplied FAQ describes RE4 as a narrow 30-question paper, precision matters more than volume. Learn the difference between an FSP, a key individual, a representative and a compliance officer. Know who is accountable for what, who renders services to clients, who provides independent oversight, and who must act when a finding is escalated. Do not treat these titles as interchangeable.
Study in layers. First, identity and scope: which examination applies to which role. Second, independence and escalation: reporting lines, access, conflicts and governance forums. Third, monitoring, reporting and records: risk-based sampling, evidence, findings and closure. Fourth, risk and governance: key-individual accountability, fit-and-proper oversight, supervision and risk registers. Fifth, breaches and regulator engagement: containment, root cause, remediation, records and truthful cooperation.
Prioritise scenarios containing pressure. Ask: who is speaking, what obligation is engaged, what evidence exists, who must be told, and what record must be preserved? A useful test is to explain why a sales-linked compliance bonus is a conflict, why an email saying “fixed” is not proof of closure, and why a regulator response must be complete and truthful rather than selectively favourable. No study sequence can guarantee a pass.
Compliance Function and Independence
Independence is operational: reporting lines, access, mandate and freedom from sales pressure must make objective oversight possible.
The compliance officer is an oversight role distinct from representatives and key individuals. The compliance officer monitors and reports; the representative renders financial services to clients; the key individual remains accountable for the provider’s ongoing compliance and supervision. Independence does not mean working remotely or being invisible. It means having a mandate, direct access to management, records and governance forums, and freedom from conflicts that would make objective judgment impossible.
Worked scenario: an FSP owner tells the compliance officer to remove a finding that advice files lack evidence of disclosure because it may affect the owner’s bonus. The correct mechanism is to preserve the original finding and evidence, record the request and the disagreement, escalate to the key individual or governing body through the documented route, and consider whether the conflict itself must be reported. The compliance officer should not alter records or quietly close the issue. If the compliance officer also manages sales, the roles should be separated or documented safeguards should be implemented; if the conflict cannot be managed, escalation is required.
A common error is thinking a compliance officer can “close” a finding without management action. Closure needs evidence that the corrective action happened and was tested. Another error is assuming that a key individual’s seniority makes a compliance finding optional. Seniority may change the escalation route, but it does not erase the need for an evidenced response.
Monitoring, Reporting and Records
A monitoring plan should be risk-based, evidence-led and closed only after verification.
A practical monitoring cycle is: define scope, rate activities by risk, set frequency and sample size, test against requirements, record the sample and result, classify findings, assign an owner and deadline, require corrective action, retest, and close only with evidence. Reports to management should show the finding, risk, root cause, client impact, action, owner, deadline and evidence. Records should make advice, disclosures, monitoring, findings, remediation and correspondence attributable, timely and retrievable. Do not assume a specific retention period from this guide; use current legal and business requirements.
Worked calculation: an FSP has 300 advice files. It samples 30 high-risk files and 20 random files. It finds 4 defects in the high-risk sample and 1 defect in the random sample. The high-risk sample defect rate is 4 ÷ 30 = 13.3%. The random sample rate is 1 ÷ 20 = 5%. The overall sample rate is 5 ÷ 50 = 10%. The overall rate does not automatically equal the population defect rate because the high-risk sample was deliberately weighted. Use the subgroup rates to prioritise work. If the high-risk rate exceeds tolerance, expand the high-risk sample and examine root cause rather than averaging the subgroups without weights.
A simple closure test prevents weak remediation. Is there evidence? Does the action address the root cause rather than only the symptom? Has a sample been retested? Is the owner and date recorded? If any answer is no, the finding remains open.
FAIS Risk and Governance
Governance turns risk identification into assigned controls, supervision and evidence.
Key individuals are accountable for ongoing compliance and supervision within the provider. Fit-and-proper oversight is not a one-off qualification check; it includes competence, integrity, supervision needs and ongoing conduct. Representatives, especially new or high-risk representatives, need a documented supervision plan. Risk management should identify risks, rate likelihood and impact, assign controls and owners, monitor results and report into governance. Compliance risk should be embedded in how the business is run, not left as a separate paperwork exercise.
Worked scenario: a new representative will advise on a high-risk product. A credible supervision plan includes pre-approval of advice for an initial period, documented file reviews against a checklist, evidence of competence, escalation of deficiencies, and clear sign-off before unsupervised activity. If two of five reviewed files lack proper disclosure, do not simply send a generic reminder. Inspect the template and process, increase the sample, verify understanding, and retest before reducing supervision.
Illustrative risk scoring: use a 3×3 likelihood-by-impact matrix. A risk scored 3×3 = 9 is high. A control reduces likelihood to 1 while impact remains 3, giving 1×3 = 3. That is a lower residual score and should be monitored. This matrix is a teaching device, not an official prescribed matrix. The governance lesson is that controls must change assessed risk and must be evidenced.
Breaches, Remediation and Regulator Engagement
Treat a breach as an event to contain, understand, remedy and learn from—not just a report to file.
A breach process should detect, record, classify by nature and severity, contain the issue, assess client impact, notify internally through governance, determine whether regulator notification is required under current law, remediate affected clients, fix the root cause, retest and preserve records. Root-cause analysis asks why the control failed: design, execution, competence, incentives or system. Corrective action needs an owner, deadline, evidence and verification. This guide does not invent statutory time limits or notification thresholds.
Worked scenario: a template error means 12 clients did not receive a required disclosure. Contain the issue by stopping use of the defective template and identifying all affected clients. Preserve versions and correspondence. Assess impact and remedy it. A likely root cause is failed template approval or change control. Corrective action could include a corrected template, independent approval, a monitoring sample, staff briefing and retesting. Report internally with facts, and respond truthfully if the regulator requests information.
Regulator engagement means cooperation, truthfulness, timeliness and completeness, with a documented record of requests and responses. Do not send speculative statements as fact or select only favourable information. If a fact is uncertain, say what is known, what is being checked and who is responsible for the response.
Integrated Practice Task and Self-Check Rubric
Use a one-page compliance memo to connect scope, monitoring, governance and remediation.
Practice scenario: a Category III FSP has 240 advice files, of which 60 are high-risk. Monitoring samples 36 high-risk files and 24 random files. It finds 6 high-risk defects involving missing disclosure evidence and 2 random defects. One defect recurs after a prior “remediation”. The compliance officer reports to a CFO who also oversees sales. There is no documented escalation forum. The regulator later asks for information. Draft a one-page memo to the governing body covering: the compliance officer’s role and independence issue; the defect rates; risk and governance actions; breach remediation; the regulator-response plan; and records to preserve. Calculate: high-risk 6 ÷ 36 = 16.7%; random 2 ÷ 24 = 8.3%; overall 8 ÷ 60 = 13.3%.
Self-check rubric, scored 0–2 for each of five criteria: role and scope accuracy; independence and escalation analysis; monitoring arithmetic and evidence; governance, root cause and remediation; regulator engagement and records. A total of 8–10 means the memo is ready for review; 5–7 means revise the weak rows; 0–4 means return to definitions and rebuild the analysis. This is an open practice task, not a simulated examination, and it is not marked by an official body.
For an oral or written task, explain your reasoning aloud in the same order: facts, role, obligation, evidence, escalation, remediation and record. The 20 MCQs below check supporting knowledge only; they are not a simulation of the full RE4 paper.
Common Errors and MCQ Technique
Most errors come from role confusion and from choosing a dramatic action instead of a controlled, evidenced process.
Frequent errors include assuming RE4 is the compliance-officer examination; confusing a key individual with a compliance officer; treating independence as a location rather than a governance arrangement; calling a finding closed without retesting; averaging subgroup defect rates without regard to sample design; rushing to a regulator before facts are established; accepting verbal assurance; and failing to preserve records. Another error is treating a policy document as proof that a control operates.
For multiple-choice questions, first identify who is speaking: FSP, key individual, compliance officer, representative or regulator. Then identify the mechanism being tested: role boundary, independence, monitoring, record, risk, breach or engagement. Eliminate options that are absolute, unsupported by the facts or inconsistent with evidence preservation. For calculations, use only the numbers stated, check the denominator and keep subgroups separate. Prefer the answer that preserves records, escalates through governance and verifies remediation.
If an option cites a specific period, threshold or legal section that is not covered in this preview, do not select it merely from memory. Use current verified legislation for the real examination. This guide deliberately avoids inventing precise legal deadlines.
Practical Study Sequence
A six-pass sequence works: scope, roles, monitoring, risk, breach, integration.
Pass 1: read the supplied scope and current official material; draw a one-page map of FSP, key individual, representative and compliance officer. Pass 2: study independence and escalation; write three conflict scenarios and the correct escalation route for each. Pass 3: study monitoring, reporting and records; design a sample plan, a finding template and a closure checklist. Pass 4: study risk and governance; build an illustrative 3×3 risk register and a supervision plan for a new representative. Pass 5: study breaches and regulator engagement; draft a remediation memo with root cause, client remedy, owner, deadline and retest. Pass 6: complete the integrated task and the 20 MCQs; for every wrong answer, write down the mechanism you missed.
Use active recall rather than re-reading. Explain concepts aloud, calculate sample rates, draft short memos and compare them with current legislation and FSCA material. Review after 24 hours, one week and one month. Before booking, verify examination availability, format and official requirements with the FSCA or the examination body. Do not rely on fixed study-hour claims or pass guarantees.
References and further reading
Use these references to explore the concepts and check the latest information from the relevant organizations.