The legacy of South African apartheid has endured long after its official end in 1994, and high inequality, poverty, unemployment and food insecurity rates persist—generally along racial and gender lines. In 2019, the World Bank named South Africa the most unequal country in the world, with the country’s top 1% owning 70.9% of its wealth.1 Although South Africa has instituted some structural reforms, social and economic development stalled even before the onset of the COVID-19 pandemic. The pandemic drove a 7% contraction in South Africa’s 2020 economy, 2 million people have been plunged into poverty2 and unemployment soared to 32.6% in the first quarter of 2021.3
Meanwhile, South Africa has made strides in its digital transformation, but progress has been applied unevenly. The digital divide has thus widened,4 and the pandemic further exacerbated inequality in access to digital services. Seven and a half million low-income South Africans pay 80 times more for internet access than do middle- and high-income people, and amidst the pandemic, 750,000 South African children dropped out of school because they lacked access to remote education.5 Internet penetration is at a mere 56%.6 In spearheading further digitalization initiatives, regulators must first and foremost invest in high-quality and comprehensive digital infrastructure, especially in vulnerable communities.
A more strategic and inclusive approach to digitalization will be crucial in expanding access to financial services, accelerating development and driving the post-pandemic recovery. Fintech in particular could pave the way for financial inclusion and attract the foreign direct investment that South Africa desperately needs. South Africans have already shown an openness to innovative technologies. In reaction to the pandemic, they have increasingly flocked to digital payments, a trend that is expected to continue. The Mastercard New Payment Index revealed that South Africans are overwhelmingly open to innovative payment methods that involve QR codes, biometric identity verification and contactless.7
This year, South African regulators are focused on a cross-border central bank digital currency (CBDC) trial under a retail CBDC model; cybersecurity; a cryptoassets regulatory framework; and the enforcement of the data protection framework. The Automated Biometric Identification System (ABIS), a national digital ID project launched in 2017, is still underway, but continues to face setbacks.8
Financial Regulatory Authorities
The South African Reserve Bank (SARB) is the central bank of South Africa.
The Financial Sector Conduct Authority (FSCA) supervises and regulates financial institutions’ market conduct.
The Information Regulator oversees compliance with the Protection of Personal Information Act (POPIA).
The Prudential Authority, housed within the South African Reserve Bank, regulates banks, insurers, co-operative financial institutions, financial conglomerates and certain market infrastructures.
Policy, Laws and Regulations
Cross-Border CBDC Trial, 02 September 2021
The Bank for International Settlements Innovation Hub has partnered with the central banks of South Africa, Australia, Malaysia and Singapore to trial the use of CBDCs in cross-border transactions. According to the Bank for International Settlements’ press release, “Led by the Innovation Hub's Singapore Centre, Project Dunbar aims to develop prototype shared platforms for cross-border transactions using multiple CBDCs. These multi-CBDC platforms will allow financial institutions to transact directly with each other in the digital currencies issued by participating central banks, eliminating the need for intermediaries and cutting the time and cost of transactions. The project will work with multiple partners to develop technical prototypes on different distributed ledger technology platforms. It will also explore various governance and operating designs that would enable central banks to share CBDC infrastructures, benefitting from the collaboration between public and private sector experts in different jurisdictions and areas of operation.”9 The results are slated for an early 2022 publication date. A cross-border CBDC would be crucial in making remittances faster and cheaper. South Africa is the continent’s largest remittance send-market, at a volume of USD$921 million in 2020. Approximately 50% of its remittances are sent via informal channels.10
Enforcement of Protection of Personal Information Act, 01 July 2021
Enforcement of the Protection of Personal Information Act (POPIA) 2013 went into effect. Certain provisions pertaining to oversight of access to information went into effect 30 June 2021. POPIA, signed into law in 2013, has only been partially enforced until now. The Act applies to all organizations that process personal information in South Africa, and codifies data protection rights for individuals, companies and trusts. It imposes reporting obligations in the case of data breaches and requirements on the cross-border transfer of personal data.11 Cross-border transfers of personal data are prohibited unless the recipient is subject to equal data protection standards; the data subject has provided consent; the transfer must be performed in executing a contract to which the data subject is a party; or the transfer benefits the data subject and consent is likely to be given.12 Organizations in non-compliance could face fines of up to ZAR 10 million (approximately USD$580,000).13
Position Paper on Cryptoassets, 06 June 2021
Following a spate of crypto scams—including South Africa’s largest Ponzi scheme in history, which saw the disappearance of USD$3.6 billion in Bitcoin—financial regulators are eager to regulate cryptoassets. The Crypto Assets Regulatory Working Group (CAR WG), part of the Intergovernmental Fintech Working Group (IFWG), published the Position Paper on Crypto Assets, which outlines recommendations towards a national cryptoassets regulatory framework. The three primary recommendations include the application of the AML/CFT framework to cryptoasset service providers (CASPs), the development of a framework for monitoring cross-border financial flows and the application of financial sector laws to CASPs.
Per the paper, “This would require CASPs to become licenced intermediaries and provide for the rendering of advice by such entities. This allows for regulatory oversight and will assist in addressing the immediate exploitation of consumers by unscrupulous entities.”14 Regulators hope to solidify a timeline for the implementation of the framework within three to six months. Kuben Naidoo, chief executive officer of the Prudential Authority, stated, “Now we are defining this as a financial product and if there are scams where the public is being duped, given incorrect or false information, it is certainly a market conduct issue that should be taken seriously.”15 Crypto investment has become wildly popular in South Africa, with daily trading values topping USD$145 million in January 2021.16
Cybercrimes and Cybersecurity Act, 26 May 2021
President Cyril Ramaphosa signed the Cybercrimes and Cybersecurity Act into law. The Act requires electronic communications service providers and financial institutions to report cybersecurity breaches to the SA Police Service, within 72 hours of becoming aware. The Act also criminalizes cyber fraud, extortion, forgery, the sending of harmful data messages and the unauthorized access of personal data, a data storage medium or computer system. Perpetrators face fines and prison sentences of up to 15 years.17
1. Beaubien, Jason. “The Country With The World's Worst Inequality Is ...” NPR, 02 April 2018. https://www.npr.org/sections/goatsandsoda/2018/04/02/598864666/the-country-with-the-worlds-worst-inequality-is.
2. “The World Bank in South Africa.” The World Bank, 18 March 2021. https://www.worldbank.org/en/country/southafrica/overview.
3. Warah, Rasna. “COVID-19 has exposed South Africa’s glaring and enduring inequalities.” One, 02 August 2021. https://www.one.org/africa/blog/covid19-exposed-south-africa-inequalities/.
4. Devermont, Judd and Marielle Harris. “Digital Africa: Leveling Up through Governance and Trade.” Center for Strategic & International Studies, 09 June 2021. https://www.csis.org/analysis/digital-africa-leveling-through-governance-and-trade.
5. Mlaba, Khanyi. “How Is South Africa's Digital Divide Making Inequality Worse in the Country?” Global Citizen, 03 August 2021. https://www.globalcitizen.org/en/content/south-africa-digital-divide-makes-inequality-worse/.
6. Ventura, Luca. “World's Most Unbanked Countries 2021.” Global Finance, 17 February 2021. https://www.gfmag.com/global-data/economic-data/worlds-most-unbanked-countries.
7. “South Africa's consumer appetite for digital payments takes off, Mastercard study finds.” The Paypers, 07 May 2021. https://thepaypers.com/mobile-payments/south-africas-consumer-appetite-for-digital-payments-takes-off-mastercard-study-finds--1248865#.
8. Macdonald, Ayang. “Delays persist in South Africa’s automated biometric identification project completion.” Biometric Update, 16 March 2021. https://www.biometricupdate.com/202103/delays-persist-in-south-africas-automated-biometric-identification-project-completion.
9. “BIS Innovation Hub and central banks of Australia, Malaysia, Singapore and South Africa will test CBDCs for international settlements.” Bank for International Settlements, 02 September 2021. https://www.bis.org/press/p210902.htm.
10. “South Africa.” Remitscope. https://remitscope.org/africa/south_africa.
11. Bowan, Nerushka. “After 7-year wait, South Africa's Data Protection Act enters into force.” International Association of Privacy Professionals, 01 July 2020. https://iapp.org/news/a/after-a-7-year-wait-south-africas-data-protection-act-enters-into-force/.
12. “Transfer of Personal Information out of South Africa.” POPI Act Compliance. https://www.popiact-compliance.co.za/popia-information/14-transfer-of-personal-information-out-of-south-africa.
13. Bowan, Nerushka. “After 7-year wait, South Africa's Data Protection Act enters into force.” International Association of Privacy Professionals, 01 July 2020. https://iapp.org/news/a/after-a-7-year-wait-south-africas-data-protection-act-enters-into-force/.
14. “Position Paper on Crypto Assets.” Intergovernmental Fintech Working Group – Crypto Assets Regulatory Working Group, 11 June 2021. https://www.resbank.co.za/content/dam/sarb/publications/media-releases/2021/fintech/IFWG%20CAR%20WG%20Position%20paper%20on%20crypto%20assets.pdf.
15. Henderson, Roxanne and Prinesha Naidoo. “South Africa Moves to Tighten Crypto Regulation After Scams.” Bloomberg, 29 June 2021. https://www.bloomberg.com/news/articles/2021-06-29/regulatory-clock-ticks-for-cryptocurrency-assets-in-south-africa.
16. Karombo, Tawanda. “In crypto, South Africa is forging a different path than the rest of Africa.” Quartz Africa, 17 June 2021. https://qz.com/africa/2021680/south-africa-approach-to-bitcoin-regulation-is-unique-in-africa/.
17. Pickworth, Evan. “PODCAST | What are the implications of the recently enacted Cybercrimes and Cybersecurity Act?” Business Day, 02 July 2021. https://www.businesslive.co.za/bd/companies/telecoms-and-technology/2021-07-02-podcast-what-are-the-implications-of-the-recently-enacted-cybercrimes-and-cybersecurity-act/.
*DISCLAIMER: This information is OneSpan's interpretation of the compliance requirements as of the date of publication. Please note that not all interpretations or requirements of the applicable laws are well-settled and its application is fact- and context-specific. The information contained in this document should not be relied upon as legal advice or to determine how the law applies to your business or organization. We encourage you to seek guidance from your legal counsel with regard to law applying specifically to your business or organization and how to ensure compliance. This information is provided “as-is” and may be updated or changed without notice. OneSpan does not accept liability for the contents of these materials.
Last updated: November 2021