South AfricaSARB Directive on Cyber-Incident Reporting within the National Payment System
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds payment institutions (persons designated, authorised, registered or regulated under the National Payment System Act 78 of 1998, including clearing system participants, settlement system participants, third-party payment providers and system operators), operators of payment systems and payment system financial market infrastructures (reached by declaring that you are a bank or a payment provider).
- Report a material cyber-incident to the SARB within 24 hours (para. 5.2.1).
- Provide the SARB with a report within 48 hours of the cyber-attack, stating the date and time of the incident, its cause and source, its type and nature, its impact on the provision of services, the expected recovery period, its impact on stakeholders, the improvement action plan, its possible systemic effect on other payment institutions, operators, systems and financial market infrastructures, and anything else the SARB asks for (para. 5.2.1(a) to (i)).
- Give the SARB regular updates, and further details once the incident has been remediated and operations have resumed (para. 5.2.2).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Contravening the directive is an offence under section 12(8) of the National Payment System Act (para. 7.3 of the directive), punishable under section 14(a) of that Act by a fine not exceeding R1 million, imprisonment not exceeding five years, or both.
Penalty structure
Section 14(a) of the National Payment System Act punishes a person convicted of an offence under section 12(8), which paragraph 7.3 of the directive applies to a contravention of the directive, with a fine not exceeding R1 million, imprisonment not exceeding five years, or both.
- Rule
- Fixed only
- As of
- Currency
- ZAR
- Fixed cap
- 1,000,000
Who enforces it
Enforcement body
The South African Reserve Bank, through its National Payment System Department.
Settledness
- As of
- Open questions
- Which cyber-incidents are material for the report under paragraph 5.2.1, given that the directive defines a cyber-incident but not a material one?
- From what moment does the 24-hour period in paragraph 5.2.1 run, given that the paragraph states the period without naming the starting point?
What this law does
Paragraph 5.2.1 of Directive 01 of 2024 requires payment institutions and operators to report material cyber-incidents to the SARB within 24 hours and to provide the SARB with a report within 48 hours of the cyber-attack.
The report must state the date and time of the incident, its cause and source, its type and nature, its impact on the provision of services, the expected recovery period, its impact on stakeholders, the improvement action plan, its possible systemic effect on other payment institutions and systems, and any other information the SARB requests.
Paragraph 5.2.2 requires payment institutions and operators to provide regular updates to the SARB, and further details once the incident has been remediated and operations have resumed.
Paragraph 1.1.5 defines a cyber-incident as a cyber-event that adversely affects the cybersecurity of an information system or the information it processes, stores or transmits, or that violates the institution's security policies, security procedures or acceptable use policies, whether or not it results from malicious activity. Paragraph 4.1 applies Directive 01 of 2024 to payment institutions, operators and payment system financial market infrastructures.
Paragraph 1.1.14 defines a payment institution as a person designated, authorised, registered or regulated under the National Payment System Act 78 of 1998, including clearing system participants, settlement system participants, third-party payment providers and system operators. Section 12(1) of the National Payment System Act lets the Reserve Bank, after consultation with the payment system management body, issue directives to any person regarding a payment system.
Paragraph 7.3 makes contravention of Directive 01 of 2024 an offence under section 12(8) of the National Payment System Act. Section 14 of the National Payment System Act punishes a person convicted of an offence under section 12(8) with a fine not exceeding R1 million, imprisonment not exceeding five years, or both. Paragraph 7.1 makes Directive 01 of 2024 effective three months after its publication. Government Gazette No. 50665 of published the South African Reserve Bank's notice of Directive 01 of 2024.
When LexLint raises it
When your app profile says your app is a bank or is a payment provider.