Regulatory Updates & Industry News – August 2026
August and early September 2026 saw several important regulatory developments affecting South Africa’s financial services sector. Key themes included heightened focus on information security and data protection, proposed new requirements relating to beneficial ownership, and the publication of regulatory updates impacting financial institutions and insurers.
These developments reflect regulators’ continued emphasis on transparency, accountability and effective risk management.
Information Regulator Warns of Growing Data Breach Risks
The Information Regulator has raised concerns about South Africa’s increasingly hostile cybersecurity environment and the growing number of security compromises and cyberattacks exposing personal information. During its media briefing on 31 August 2026, the Regulator reported that it had received more than 8,000 security compromise notifications to date, with more than 1,220 received since 1 April 2026 – less than five months into the 2026/27 financial year.
The Regulator warned that, if the current trend continues, more than 3,000 security compromises could be reported by the end of the financial year. It further noted that the impact of a security compromise is not limited to the unauthorised disclosure of personal information. Depending on the circumstances, security incidents can affect an organisation’s operations and place additional pressure on resources, governance processes and stakeholder relationships.
The scale of the reported incidents highlights the importance of effective information security measures for organisations that hold personal information. For financial services businesses in particular, where organisations may process significant volumes of personal and sensitive information, data protection and information security remain important areas of ongoing compliance and operational risk.
The Regulator’s broader comments also reinforce the importance of embedding privacy protection across an organisation, rather than treating it as the sole responsibility of the Information Officer or compliance function. Organisations entrusted with personal information need to ensure that appropriate safeguards are implemented to protect that information and reduce the potential impact of security compromises.
Proposed Beneficial Ownership Rules Bring Greater Regulatory Scrutiny
The Financial Sector Conduct Authority (FSCA) and Prudential Authority (PA) published the Draft Joint Standard 1: Requirements pertaining to beneficial owners for public consultation on 14 August 2026.
The proposed Joint Standard introduces more detailed requirements for financial institutions to identify, verify and monitor their beneficial owners. Among other requirements, institutions would need to maintain an accurate and up-to-date beneficial ownership register, assess beneficial owners against honesty and integrity requirements, and review those assessments at least every two years using a risk-based approach.
Institutions would also be required to provide beneficial ownership information when applying for a licence or authorisation and notify the relevant Authority within 30 calendar days when a person becomes, may become, or ceases to be a beneficial owner.
The proposed framework goes beyond simply establishing who ultimately owns an institution. The draft provides for consideration of direct and indirect ownership and effective control, including circumstances where an individual can materially influence management, operations, strategic decisions or the use of an institution’s capital, assets or liabilities.
The proposed requirements are intended to address deficiencies identified in South Africa’s 2021 FATF Mutual Evaluation Report and to reduce the risk that criminals or their associates obtain significant ownership or control of financial institutions. The draft Standard contemplates enhanced due diligence and honesty and integrity assessments of beneficial owners, which may require institutions to consider information relevant to criminal conduct, sanctions exposure, politically exposed person status and other risk indicators.
Although the requirements are still in draft form, organisations should monitor the consultation process and consider whether their existing beneficial ownership identification, verification, record-keeping and governance processes will be sufficient to meet the proposed requirements.
Final FSCA Levies Gazetted for 2026/27
National Treasury has gazetted the final FSCA levies for the 2026/27 levy year. The final amounts remain unchanged from the draft proposals published in June 2026.
For most Category I and IV FSPs, the levy consists of a fixed amount of R4,111.39, together with a variable amount based on the average number of key individuals and representatives. Different levy structures apply to Category II, IIA and III FSPs, as well as other regulated entities.
The increase in the Schedule 2 levy also results in higher contributions to the Ombud Council and Financial Services Tribunal, which are calculated as percentages of the FSCA levy. The FAIS Ombud levy remains separately calculated.
FSPs should ensure that the final levy requirements are incorporated into their regulatory budgeting and payment processes.
2026 Demarcation Regulations Benefit Escalation
The National Treasury has published the 2026 policy benefit escalations under the Demarcation Regulations on 01 September 2026. The maximum policy benefit limits have been increased by 3.2%, in line with the 2025 CPI inflation rate published by Statistics South Africa.
The annual adjustment ensures that the maximum benefit amounts applicable to certain health, and accident and health insurance policies remain aligned with inflation and provides clarity to insurers, intermediaries and policyholders.
The updated benefit amounts are reflected in:
Annexure A: Regulation 7.2(2) (LTIA)
Annexure B: Regulation 7.2(2) (STIA)
Final Thoughts
The recent regulatory developments highlight a continued focus on effective governance, accountability and risk management within the financial services sector. From increased scrutiny of information security and data protection to proposed beneficial ownership requirements and ongoing regulatory obligations such as levies and benefit adjustments, organisations should ensure that their governance frameworks, controls and compliance processes remain fit for purpose in an evolving regulatory environment.
Regulatory change is inevitable. Being prepared is a choice.
