Provides financial services, in South Africa

National Credit Act 34 of 2005, ss. 43, 68, 70 and 72 (credit bureaux) · Read the law's page

• Register as a credit bureau before you offer or conduct business as one, or hold yourself out as authorised to offer any service customarily offered by a credit bureau.
• Protect the confidentiality of the consumer information you receive, compile, retain or report, use it only for a purpose the Act, other national legislation or applicable provincial legislation permits, and release it only to the consumer, as the law permits or requires, as the consumer instructs, or by order of a court or the Tribunal.
• Take reasonable steps to verify the accuracy of the consumer credit information reported to you, and do not knowingly or negligently provide a report that contains inaccurate information.
• Accept without charge the consumer's own filing of consumer credit information to correct or challenge what you hold about that consumer, and promptly expunge any prescribed information that is not permitted in your records.
• Receive, compile and report only consumer credit information the Act or the regulations allow, and receive it only from the persons the regulations prescribe.
• Let a person inspect their file without charge once within any period of twelve months, and when a person challenges information you hold, seek evidence for it and, within the prescribed time, provide the evidence or remove the information and all record of it.
• Do not report information that a person has challenged until the challenge has been resolved.

Directive No. 01 of 2024 (SARB) in respect of cybersecurity and cyber-resilience within the national payment system, para. 5.1 · Read the law's page

• This binds payment institutions (persons designated, authorised, registered or regulated under the National Payment System Act 78 of 1998, including clearing system participants, settlement system participants, third-party payment providers and system operators), operators of payment systems and payment system financial market infrastructures (reached by declaring that you are a bank or a payment provider).
• Develop and maintain a written cybersecurity and cyber-resilience framework with cyber-governance arrangements, under which your board or senior management determines the cyber-risk tolerance, approves the cybersecurity policies and strategy and the framework, and ensures an annual review of them (para. 5.1.1).
• Identify the critical technology, operations, processes, supporting information and assets that require protection against cyber-compromise (para. 5.1.2).
• Put in place security controls that protect the confidentiality, integrity and availability of your services and information, including at a minimum access control, multi-factor authentication or encryption for critical and sensitive information, and apply security patches to address vulnerabilities (para. 5.1.3).
• Have arrangements to resume critical operations within two hours for payment, clearing and settlement systems and payment system financial market infrastructures (or an extended time the SARB approves in advance), and within the timelines the payment system management body or the system operator sets for other payment institutions, which may not exceed eight hours without the SARB's prior approval (para. 5.1.5.1(d)).
• Develop and test response, resumption and recovery plans quarterly, and run internal and external penetration tests and regular vulnerability assessments (paras. 5.1.5.1(g) and 5.1.6.1).
• Let the SARB inspect you onsite or offsite at any time (para. 6.1).

Directive No. 01 of 2024 (SARB), cyber-incident reporting within the national payment system, para. 5.2 · Read the law's page

• This binds payment institutions (persons designated, authorised, registered or regulated under the National Payment System Act 78 of 1998, including clearing system participants, settlement system participants, third-party payment providers and system operators), operators of payment systems and payment system financial market infrastructures (reached by declaring that you are a bank or a payment provider).
• Report a material cyber-incident to the SARB within 24 hours (para. 5.2.1).
• Provide the SARB with a report within 48 hours of the cyber-attack, stating the date and time of the incident, its cause and source, its type and nature, its impact on the provision of services, the expected recovery period, its impact on stakeholders, the improvement action plan, its possible systemic effect on other payment institutions, operators, systems and financial market infrastructures, and anything else the SARB asks for (para. 5.2.1(a) to (i)).
• Give the SARB regular updates, and further details once the incident has been remediated and operations have resumed (para. 5.2.2).

Cybercrimes Act 19 of 2020, s. 54 · Read the law's page

• Section 54 of the Cybercrimes Act is not yet in operation: the proclamation that brought most of the Act into operation on 1 December 2021 excluded it, and the duty below binds only once it is proclaimed and the Cabinet member responsible for policing has prescribed the offences to be reported.
• This binds an electronic communications service provider, being a person who provides an electronic communications service under a licence issued under the Electronic Communications Act, 2005 (or who is deemed licensed or exempt) or a person with lawful authority to control the operation or use of a licence-exempt private electronic communications network used primarily for providing electronic communications services for the owner's own use, and a financial institution as defined in the Financial Sector Regulation Act, 2017 (reached by declaring that you provide telecom services or financial services).
• When you become aware that your electronic communications service or network is involved in an offence in Part I of Chapter 2 of the Act that the Cabinet member responsible for policing has prescribed, report the offence to the South African Police Service in the prescribed form and manner without undue delay and, where feasible, not later than 72 hours after becoming aware of it (section 54(1)(a)).
• Preserve any information which may be of assistance to the South African Police Service in investigating the offence (section 54(1)(b)).