Africa Fintech Regulatory Atlas · South Africa

South Africa after the grey list: the POPIA, FIC Act and cyber evidence fintechs must be able to show

South Africa left the FATF grey list in October 2025, but supervisors who spent years proving effectiveness to the FATF now expect the same proof from the firms they oversee. The Information Regulator has moved breach reporting online and fines organisations that stay silent, and a binding cybersecurity standard is in force. This guide sets out who is in scope, what the law says, and what evidence a fintech should be able to produce on request.

Last reviewed: 11 October 2026 · Next review: 9 January 2027 · Written by Oluwafemi Ofobutu, founder

This guide is general information, not legal advice. The official text is the authority. Local legal interpretation should come from qualified counsel in South Africa.

Verification status, 11 October 2026: all 87 statements in our claims ledger were matched automatically against their sources before publication: the gazetted Acts and notices on gov.za, the Financial Intelligence Centre, the Information Regulator, the Reserve Bank and the FATF. The text of Joint Standard 2 itself is checked against a legal publisher's reproduction, because the regulators' link to it has moved; we say so wherever we cite it.

Executive summary

Sourced

  • Off the grey list, not off the hook. The FATF removed South Africa from increased monitoring on 24 October 2025 (FATF) and asked it to keep working with ESAAMLG "to sustain its improvements" (FATF). Examiners will keep testing what the action plan fixed.
  • Lenders, remitters, FX and crypto firms are accountable institutions. Schedule 1 of the FIC Act covers credit providers (item 11), money or value transfer providers (item 19), foreign exchange dealers (item 10) and crypto asset service providers (item 22). They must register with the Centre (s. 43B) and run a board-approved programme (s. 42(2B)).
  • Three reporting clocks. Suspicious transaction reports are due within fifteen days at most (reg. 24(3)); cash above R49,999.99 (reg. 22B) and cross-border transfers above R19,999.99 (reg. 23D) within 3 days.
  • POPIA breach reporting is online and has no threshold. Since 1 April 2025 compromises must be reported through the Regulator's eServices portal (Information Regulator), and the Regulator says POPIA "does not have a threshold" for reporting (fact sheet).
  • The cyber standard is live. Joint Standard 2 of 2024 has applied since 1 June 2025 (Joint Notice 1 of 2024). It binds banks, insurers and other listed institutions directly, and fintechs through their contracts with them (para. 4.2.3).

Who is in scope

Sourced, with our reading marked

Three bodies of law reach a South African fintech, and they draw their boundaries differently. The Financial Intelligence Centre Act (the FIC Act) applies its full set of duties to "accountable institutions", the businesses listed in Schedule 1. The list is functional rather than licence-based: it covers anyone carrying on the business of a bank (item 6), a credit provider as defined in the National Credit Act (item 11(a)), a foreign exchange dealer (item 10), a money or value transfer provider (item 19), and a range of crypto asset activities, starting with exchanging a crypto asset for fiat currency or the reverse (item 22). The suspicious transaction duty in section 29 is wider still: it applies to any person who carries on, manages or is employed by a business (s. 29(1)).

The Protection of Personal Information Act (POPIA) applies to every responsible party, with no size exemption. Each must secure the personal information it holds (s. 19(1)), and every public and private body must have an information officer who is registered with the Regulator before taking up the role (s. 55(2)).

Joint Standard 2 of 2024 is narrower. Its own definition of "financial institution" lists banks, insurers, collective investment scheme managers, market infrastructures (para. 2.1), certain financial services providers, pension funds, OTC derivative providers and credit rating agencies. A payments start-up, a lender or a crypto exchange is not on that list in its own right.

StackWeaver view · In practice, a South African lender, wallet, remittance or crypto business should assume it is an accountable institution and a responsible party with a registered information officer, and should treat Joint Standard 2 as a contractual standard it will be measured against by its bank. Write the scoping decision down, name the Schedule 1 item you rely on, and list the partners whose contracts carry Joint Standard obligations.

Vendors such as cloud hosts and KYC providers are usually "operators" under POPIA. They must be bound by written contract to maintain security measures (s. 21(1)) and must report a suspected compromise to their client immediately (s. 21(2)).

The regulators

Sourced

The Financial Intelligence Centre (FIC). The Centre registers accountable institutions (s. 43B(1)), receives suspicious, cash and international transfer reports, and with the supervisory bodies can impose administrative sanctions. Financial penalties reach R10 million for a natural person and R50 million for a legal person (s. 45C(3)).

The Information Regulator. The Regulator enforces POPIA. It receives security compromise reports and information officer registrations through its eServices portal (Information Regulator), issues enforcement notices, and can follow non-compliance with an infringement notice carrying an administrative fine (s. 109(1)). The amended POPIA Regulations took effect on publication on 17 April 2025 (GN 6126).

The Prudential Authority and the Financial Sector Conduct Authority (FSCA). Together they made Joint Standard 2 of 2024 under the Financial Sector Regulation Act. It was tabled in Parliament on 30 November 2023 (Joint Communication 2 of 2024) and its effective date was set at 1 June 2025 by a notice published on 26 June 2024 (Joint Notice 1 of 2024).

The FATF and ESAAMLG. South Africa's action plan addressed deficiencies the FATF identified in February 2023 (FATF). Its exit statement lists eight completed items, including improved risk-based supervision with effective sanctions (item 2) and timely access to beneficial ownership information (item 3). The FATF expects that work to continue alongside ESAAMLG, the regional body.

Obligations and the evidence that demonstrates them

Sourced obligations · evidence column is StackWeaver view

Each row gives the obligation, the provision that creates it, who carries it, the evidence we would expect an examiner or a bank's due diligence team to ask for, and the deadline. Legal sources link to the text we checked; the evidence column is our practical suggestion, not a regulatory list.

South African AML, data protection and cybersecurity obligations for fintechs
Obligation Legal source Applies to Evidence Deadline
Register with the Financial Intelligence Centre and keep registration particulars current. FIC Act s. 43B Schedule 1 accountable institutions FIC registration confirmation; change log Within the prescribed period; changes within 90 days
Run a board-approved Risk Management and Compliance Programme (RMCP) that covers new and existing products and is reviewed regularly. FIC Act s. 42 Accountable institutions Approved RMCP with version history; product risk assessments; review minutes Before onboarding; review regularly
Verify client identity and identify beneficial owners of legal persons. FIC Act ss. 21, 21B Accountable institutions KYC files; beneficial ownership records While establishing the relationship
Apply senior management approval, source of funds checks and enhanced monitoring to foreign PEPs. FIC Act s. 21F Accountable institutions PEP screening; approvals; monitoring logs Before the relationship is established
Report suspicious and unusual transactions to the Financial Intelligence Centre. FIC Act s. 29; Regulations reg. 24(3) Anyone carrying on, managing or employed by a business STR register with awareness and filing dates Not later than fifteen days
Report cash transactions above R49,999.99 to the Centre. FIC Act s. 28; reg. 22B Institutions handling cash directly or through agents Cash threshold report log Within 3 days
Report electronic transfers into or out of South Africa above R19,999.99. FIC Act s. 31; reg. 23D Institutions moving client funds across the border Transfer report log reconciled to payment rails Within 3 days
Keep due diligence, transaction and STR records. FIC Act s. 23 Accountable institutions Retention schedule; restore test At least five years
Secure personal information with appropriate measures based on identified risks, and verify safeguards regularly. POPIA s. 19 Every responsible party Security risk register; control test results Continuous
Bind operators by written contract to keep security measures and report compromises immediately. POPIA s. 21 Responsible parties using vendors Contract register with clause references Before the operator starts
Notify the Information Regulator, through its eServices portal, and affected data subjects of a security compromise. POPIA s. 22 Every responsible party Incident log; portal reference; data subject notices As soon as reasonably possible after discovery
Register the information officer with the Information Regulator. POPIA s. 55(2) Every public and private body Registration confirmation; deputy designations Before the officer acts
Obtain prior authorisation before processing for credit reporting and other listed purposes. POPIA s. 57 Responsible parties planning listed processing Authorisation decision or scoping note Before the processing starts
Transfer personal information abroad only on a section 72 condition, such as a binding agreement with adequate protection. POPIA s. 72 Users of foreign hosting or vendors Transfer register; agreements Before the transfer
Board-approved cyber strategy reviewed at least annually, penetration testing and material incident notification. Joint Standard 2 of 2024 Institutions in the Joint Standard's own definition Strategy minutes; pen test reports; incident records In force from 1 June 2025

Three obligations are where fintechs most often fall short. The first is the Risk Management and Compliance Programme. Section 42 requires a documented programme that lets the institution identify, assess, monitor, mitigate and manage the risk that "new and existing products or services" are used for money laundering (s. 42(2)(a)). The board or the highest authority must approve it (s. 42(2B)) and it must be reviewed at regular intervals (s. 42(2C)). A programme written for launch and never revisited is the classic finding.

The second is breach notification without a number. Section 22 requires notice to the Regulator and to affected people "as soon as reasonably possible after the discovery of the compromise" (s. 22(2)), in writing to the data subject (s. 22(4)). The Regulator reads that strictly: a compromise "does not have to be confirmed before it is reported" (fact sheet), and a late report must explain the delay (fact sheet). Teams used to a fixed window elsewhere sometimes wait for forensic certainty. In South Africa that wait is the risk.

The third is automated decisions. Section 71 protects people from decisions with legal or substantial effect "based solely on the basis of the automated processing of personal information intended to provide a profile" (s. 71(1)), and creditworthiness is named among the profiled traits (s. 71(1)). Separately, processing for credit reporting requires prior authorisation from the Regulator (s. 57(1)(c)). Digital lenders should map every automated approve or decline step and record where a person can intervene.

Joint Standard 2 of 2024: what it asks for

Sourced from the Joint Standard text, with our reading marked

The Joint Standard sets minimum requirements that must be implemented in proportion to "the nature, size, complexity and risk profile" of the institution (para. 3.4). Its governance core is simple: the governing body is ultimately responsible for compliance and for oversight of cyber risk (para. 4.1), and the cybersecurity strategy must be reviewed "regularly, but at least annually" (para. 6.1.2).

The operational requirements read like a security programme checklist. Institutions must establish monitoring through a security operations centre or managed security services (para. 7.3.1(c)); keep backups offline or offsite, which expressly includes cloud storage (para. 7.4.1(d)); penetration-test critical systems (para. 7.7.3), including systems directly accessible from the internet (para. 7.7.3(a)(iii)); and notify the responsible authority of material cyber incidents and information security compromises in the form the Authorities determine (para. 9.1).

StackWeaver view · For a fintech outside the definition, the clause that matters is the one requiring banks and insurers to define security roles in contracts with third-party providers. Expect your sponsor bank's next renewal to ask for a penetration test report, incident notice terms and evidence of monitoring.

Timeline of key dates

Sourced

  1. Most of POPIA commences, including the conditions for lawful processing and the Regulator's powers · source

  2. Sections 110 and 114(4) of POPIA commence, a year after the main commencement · source

  3. Cash threshold reporting amount rises to R49,999.99 · source

  4. FSCA and Prudential Authority publish Joint Standard 2 of 2024 on cybersecurity and cyber resilience · source

  5. Security compromise reports must go through the Information Regulator's eServices portal · source

  6. Amended POPIA Regulations take effect immediately on publication · source

  7. Joint Standard 2 of 2024 takes effect · source

  8. FATF removes South Africa from increased monitoring · source

POPIA gave organisations one year from commencement to bring existing processing into line (s. 114(1)), so there is no transition argument left. Our reading: the next signal to watch is ESAAMLG's follow-up on South Africa's progress after listing, which will shape how hard supervisors push on effectiveness.

Enforcement record and penalties

StackWeaver view, with enforcement facts and penalty schedules sourced

The Information Regulator's enforcement now has a visible pattern. It received 2,374 security compromise reports in the 2024/25 financial year (Information Regulator). It fined Lancet Laboratories R100,000 through an infringement notice after the company failed to comply with an enforcement notice (Information Regulator); the underlying failure was not notifying the Regulator about compromises as section 22 requires (Information Regulator). Earlier it fined the Department of Justice and Constitutional Development R5 million for failing to comply with an enforcement notice (Information Regulator) that required proof that its anti-virus, SIEM and intrusion detection licences had been renewed (Information Regulator).

The penalty schedules:

  • POPIA infringement notice: an administrative fine of up to R10 million (POPIA s. 109(2)(c)).
  • Failing to comply with a POPIA enforcement notice is an offence (s. 103(1)), punishable by a fine or imprisonment of up to 10 years (s. 107(a)).
  • FIC Act administrative sanctions: financial penalties of up to R10 million for natural persons and R50 million for legal persons (FIC Act s. 45C(3)).

StackWeaver view · Show your board the DoJ&CD case. The fine was not for being breached; it was for failing to produce evidence, once ordered, that basic security tooling was licensed and running.

A practical 90-day plan

StackWeaver view

Days 1–14: settle status and registrations

Write the scoping memo naming your Schedule 1 item, or why none applies. Confirm FIC registration and that the particulars are current. Confirm the information officer and deputies are registered with the Information Regulator and that someone can log in to the eServices portal today, not during an incident.

Days 15–45: rebuild the RMCP around your products

Refresh the risk assessment for each product, channel and corridor you operate. Add a pre-launch money laundering risk step to the release process. Take the updated programme to the board for approval and minute the decision.

Days 46–75: prove the reporting

Measure awareness-to-filing time on recent suspicious transaction reports. Reconcile a month of cash threshold and international funds transfer reports to ledger data. Run one incident drill that produces a draft portal report, a data subject notice and, if a partner bank needs it, the cyber incident notice its contract requires.

Days 76–90: assemble the evidence pack

Index evidence against every row of the obligations table. Ask someone outside compliance to pick five rows and find the proof unaided; whatever they cannot find goes on next quarter's plan.

Common mistakes

StackWeaver view

  • Assuming the delisting lowered the bar. The FATF asked South Africa to sustain its improvements. Supervisors who just proved effectiveness internationally will keep asking for it domestically.
  • Waiting for forensic confirmation before reporting a compromise. The Regulator says confirmation is not needed, and there is no low-risk exemption. Report through the portal and update later.
  • Leaving the RMCP as a launch document. It must cover new products, be approved at the top and be reviewed. Link it to the release calendar.
  • Reading Joint Standard 2 as someone else's problem. If your bank or insurer is in scope, its contract with you is how the standard arrives. Prepare the evidence before it asks.
  • Automating declines with no human route. Credit decisions made solely by a model are exactly what section 71 addresses. Document review points and the explanation you give customers.

South Africa POPIA, FIC Act and cyber evidence checklist

StackWeaver view, built on the sourced obligations above

Evidence checklist for South African AML, data protection and cyber readiness
Area Task Owner Evidence to keep
Scope Name the Schedule 1 item that makes you an accountable institution, or record why none applies. Legal / compliance Scoping memo
Scope Decide whether Joint Standard 2 binds you directly or through partner contracts. Legal / CISO Partner and clause list
FIC registration Confirm FIC registration and set a reminder to notify changes. Compliance officer Registration confirmation; change log
RMCP Refresh the RMCP and record board approval. Compliance officer / board Approved RMCP; board minute
RMCP Add a money laundering risk step to the product release process. Product / compliance Completed assessments linked to releases
Due diligence Sample-test client files for identity, beneficial ownership and PEP screening. Compliance / operations Sample test worksheet with exceptions and fixes
Reporting Measure awareness-to-filing time on recent suspicious transaction reports. Compliance officer STR register with both timestamps
Reporting Reconcile one month of cash and cross-border transfer reports to transaction data. Finance / compliance Reconciliation with differences explained
Records Align AML and POPIA retention schedules. Compliance / data Combined retention schedule
POPIA Confirm the information officer and deputies are registered with the Regulator. Information officer Regulator registration confirmation
POPIA Check vendor contracts for security duties and immediate compromise notice. Legal / procurement Contract register with clause references
POPIA Run a breach drill ending in a draft portal report and data subject notice. CISO / information officer Drill report; notice templates
POPIA Inventory automated decisions and decide whether prior authorisation applies. Data / legal Decision inventory; authorisation analysis
POPIA List every foreign hosting location and vendor with its section 72 basis. Information officer Transfer register; agreements
Cyber Keep a current pen test and an approved cyber strategy, even if only your partners are in scope. CISO Pen test report; strategy approval minute

Download the South Africa evidence checklist

An Excel workbook with every obligation, its legal source, an owner and the evidence to keep, plus the draft crosswalk.

We use your details to send the checklist and follow up about it. See our privacy policy.

Control crosswalk: South African obligations to SOC 2 and ISO 27001

Draft mapping, pending named reviewer sign-off. SWC numbers refer to StackWeaver's common controls; SOC 2 references are Trust Services Criteria and ISO references are ISO/IEC 27001:2022 Annex A controls. Use it to reuse evidence, not as a statement that one framework satisfies another.

Draft crosswalk of South African obligations to StackWeaver common controls, SOC 2 and ISO 27001
South African obligation StackWeaver control SOC 2 ISO 27001:2022
FIC registration (FIC Act s. 43B) SWC-29 Regulatory registration and filings CC2.3 A.5.31
Risk Management and Compliance Programme (s. 42) SWC-01 Approved policy set; SWC-02 Named accountable roles; SWC-03 Board and management oversight; SWC-04 Risk assessment CC1.2, CC3.1 A.5.1, A.5.4
Product and technology risk (s. 42(2)(a)) SWC-04 Risk assessment CC3.4 A.5.7, A.8.25
Customer due diligence and beneficial ownership (ss. 21, 21B, 21F) SWC-30 Customer due diligence and risk rating; SWC-31 Enhanced due diligence and PEPs CC3.2 A.5.19
STR, CTR and IFTR reporting (ss. 28, 29, 31) SWC-34 Suspicious and threshold transaction reporting CC7.2, CC7.3 A.5.24, A.5.25
AML record keeping (s. 23) SWC-35 Record keeping CC5.3 A.5.33
Security safeguards (POPIA s. 19) SWC-09 Access provisioning and least privilege; SWC-13 Secure configuration baselines; SWC-17 Network security; SWC-18 Encryption and key management CC3.2, CC5.2, CC6.1 A.5.7, A.8.8
Operator contracts (POPIA s. 21) SWC-07 Third-party and processor management CC9.2 A.5.19, A.5.20
Security compromise notification (POPIA s. 22) SWC-22 Incident response and breach notification CC7.3, CC7.4 A.5.24, A.5.26
Information officer registration (POPIA s. 55) SWC-02 Named accountable roles; SWC-29 Regulatory registration and filings CC1.3 A.5.2
Automated decisions and prior authorisation (POPIA ss. 57, 71) SWC-23 Lawful basis and consent; SWC-29 Regulatory registration and filings P2.1, P3.1 A.5.34
Transborder flows (POPIA s. 72) SWC-28 Cross-border transfer safeguards CC9.2 A.5.14, A.5.23
Cyber strategy, monitoring and testing (Joint Standard 2 of 2024) SWC-03 Board and management oversight; SWC-14 Vulnerability management; SWC-22 Incident response and breach notification CC4.1, CC7.1, CC7.2 A.5.1, A.8.8, A.8.16

Joint Standard 2 overlaps heavily with a SOC 2 or ISO 27001 programme: strategy, monitoring, backups and testing produce evidence both can use. Neither framework covers FIC Act reporting, due diligence or registration, which need AML-specific evidence. Teams operating in other markets can compare our Kenya guide, still under FATF increased monitoring, the Egypt PDPL guide, and our Nigerian pages on CBN AML/CFT and the NDPA.

Frequently asked questions

Is South Africa still on the FATF grey list?

No. At its October 2025 plenary the FATF removed South Africa from its list of jurisdictions under increased monitoring, after it completed an action plan that began in February 2023. The FATF asked it to keep working with ESAAMLG to sustain the improvements, so supervisors are unlikely to relax.

Is my fintech an accountable institution under the FIC Act?

Probably, if you lend, move money or handle crypto. Schedule 1 lists credit providers under the National Credit Act, money or value transfer providers, foreign exchange dealers, banks and crypto asset service providers. A pure software vendor usually is not, but it should record that conclusion in a scoping memo.

How quickly must a suspicious transaction report be filed?

The regulations require a section 29 report to reach the Financial Intelligence Centre as soon as possible and not later than fifteen days after the business became aware of the facts behind the suspicion. Treat fifteen days as a ceiling, and keep timestamps that show when awareness began.

What are the cash and cross-border reporting thresholds?

Cash transactions above R49,999.99 must be reported within three days of awareness. Electronic transfers into or out of South Africa above R19,999.99 must also be reported, within three days. Remittance and wallet businesses should reconcile these reports to their payment rails every month to catch gaps early.

Does POPIA set a 72-hour breach deadline?

No fixed number of hours appears in section 22. Notification must be made as soon as reasonably possible after discovery. The Information Regulator says there is no reporting threshold and that a compromise need not be confirmed before it is reported. Reports go through its eServices portal since April 2025.

Do we need to register our information officer?

Yes. Section 55 says information officers may take up their duties only after the responsible party has registered them with the Information Regulator. Registration now runs through the Regulator's eServices portal, which is also where security compromises are reported, so get access set up before an incident.

Does Joint Standard 2 of 2024 apply to fintechs?

Directly, only to the financial institutions it defines, such as banks, insurers, market infrastructures, pension funds and some financial services providers. Many fintechs still feel it, because their bank or insurer partners must define security roles in contracts with third-party service providers. It has been in effect since 1 June 2025.

Can we use credit scoring or automated onboarding decisions?

Yes, with care. Section 71 restricts decisions with legal or substantial effect based solely on automated profiling, and creditworthiness is named. Processing for credit reporting also needs prior authorisation from the Regulator under section 57. Document human review points and your legal analysis before launch.

Can customer data be hosted outside South Africa?

Yes, if a section 72 condition is met. The most common is that the recipient is bound by law, binding corporate rules or a binding agreement that gives an adequate level of protection. Keep a transfer register listing every foreign location, vendor and the condition you rely on.

What penalties apply?

Under POPIA, ignoring an enforcement notice is an offence and the Regulator can issue infringement notices with administrative fines of up to R10 million. Under the FIC Act, administrative penalties reach R10 million for natural persons and R50 million for legal persons. The Regulator has already fined organisations that failed to report compromises.

How StackWeaver helps

StackWeaver gives your compliance officer, information officer and security lead one workspace to request, collect and review the evidence behind each obligation above. Every file is fingerprinted, every review decision is recorded, and reviewed evidence exports as an Evidence Package your counsel, auditor or sponsor bank can check offline. We are remote-first; we work with local counsel and advisory partners, and our Evidence Readiness Assessment is the place to start if you want help assembling the pack.

Next steps

  1. 1. Download the South Africa evidence checklist (Excel, free)
  2. 2. Book a 20-minute call
  3. 3. Partner with us

Advisory, audit or legal firm in South Africa? Partner with us

Firms that advise South African fintechs can run client evidence in StackWeaver workspaces and keep their own advice and audit work. Tell us about your practice and we will be in touch.

Partner with us

Sources and method

We cite POPIA as gazetted and its commencement proclamation on gov.za; the FIC Act and its regulations as consolidated by the Financial Intelligence Centre, with the 2022 cash threshold amendment from the Government Gazette; Information Regulator statements and fact sheet; and the Joint Standard 2 notices hosted by the Reserve Bank. The regulators' link to the Joint Standard text no longer resolves, so we quote it as reproduced by Juta Compli News. FATF material is the Internet Archive's unaltered copy of its 24 October 2025 statement, because the FATF site blocks automated checks.

Every statement of law on this page is recorded in a public claims ledger with its source, section, retrieval date and the exact supporting words, and our build checks each source before publication. Facts are labelled “Sourced”; opinions and recommendations are labelled “StackWeaver view”, as our editorial policy explains. AI tools helped research and draft this guide; a named person at StackWeaver is accountable for it, and every legal statement was checked against the text cited.

Spotted an error? Email [email protected]. More countries are in the Africa Fintech Regulatory Atlas.