South AfricaSARB Directive on Cybersecurity and Cyber-Resilience within the National Payment System
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds payment institutions (persons designated, authorised, registered or regulated under the National Payment System Act 78 of 1998, including clearing system participants, settlement system participants, third-party payment providers and system operators), operators of payment systems and payment system financial market infrastructures (reached by declaring that you are a bank or a payment provider).
- Develop and maintain a written cybersecurity and cyber-resilience framework with cyber-governance arrangements, under which your board or senior management determines the cyber-risk tolerance, approves the cybersecurity policies and strategy and the framework, and ensures an annual review of them (para. 5.1.1).
- Identify the critical technology, operations, processes, supporting information and assets that require protection against cyber-compromise (para. 5.1.2).
- Put in place security controls that protect the confidentiality, integrity and availability of your services and information, including at a minimum access control, multi-factor authentication or encryption for critical and sensitive information, and apply security patches to address vulnerabilities (para. 5.1.3).
- Have arrangements to resume critical operations within two hours for payment, clearing and settlement systems and payment system financial market infrastructures (or an extended time the SARB approves in advance), and within the timelines the payment system management body or the system operator sets for other payment institutions, which may not exceed eight hours without the SARB's prior approval (para. 5.1.5.1(d)).
- Develop and test response, resumption and recovery plans quarterly, and run internal and external penetration tests and regular vulnerability assessments (paras. 5.1.5.1(g) and 5.1.6.1).
- Let the SARB inspect you onsite or offsite at any time (para. 6.1).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Contravening the directive is an offence under section 12(8) of the National Payment System Act (para. 7.3 of the directive), punishable under section 14(a) of that Act by a fine not exceeding R1 million, imprisonment not exceeding five years, or both.
Penalty structure
Section 14(a) of the National Payment System Act punishes a person convicted of an offence under section 12(8), which paragraph 7.3 of the directive applies to a contravention of the directive, with a fine not exceeding R1 million, imprisonment not exceeding five years, or both.
- Rule
- Fixed only
- As of
- Currency
- ZAR
- Fixed cap
- 1,000,000
Who enforces it
Enforcement body
The South African Reserve Bank, through its National Payment System Department.
Settledness
- As of
- Open questions
- Which timelines does the payment system management body set for its members' resumption of critical operations, given that paragraph 5.1.5.1(d) defers to them?
What this law does
Paragraph 5.1 of Directive 01 of 2024 requires payment institutions and operators to develop and maintain cybersecurity and cyber-resilience frameworks covering cyber-governance, critical assets, security measures, detection, response and recovery, testing, information sharing, situational awareness and learning. Paragraph 4.1 applies Directive 01 of 2024 to payment institutions, operators and payment system financial market infrastructures.
Paragraph 1.1.14 defines a payment institution as a person designated, authorised, registered or regulated under the National Payment System Act 78 of 1998, including clearing system participants, settlement system participants, third-party payment providers and system operators.
Paragraph 5.1.5.1(d) requires arrangements to resume critical operations within two hours, or an extended timeline the SARB approves in advance, for payment, clearing and settlement systems and payment system financial market infrastructures. Paragraph 5.1.6.1(b) requires internal and external penetration testing of systems and processes through the simulation of cyber-attacks.
Paragraph 6.1 allows the SARB to conduct a supervisory onsite or offsite inspection of payment institutions or operators at any time. Section 12(1) of the National Payment System Act lets the Reserve Bank, after consultation with the payment system management body, issue directives to any person regarding a payment system. Paragraph 7.3 makes contravention of Directive 01 of 2024 an offence under section 12(8) of the National Payment System Act.
Section 14 of the National Payment System Act punishes a person convicted of an offence under section 12(8) with a fine not exceeding R1 million, imprisonment not exceeding five years, or both. Paragraph 7.1 makes Directive 01 of 2024 effective three months after its publication. Government Gazette No. 50665 of published the South African Reserve Bank's notice of Directive 01 of 2024.
When LexLint raises it
When your app profile says your app is a bank or is a payment provider.