The Financial Sector Conduct Authority (FSCA) and the Prudential Authority (PA) have published a draft Determination of the Notification Template for Material IT and Cyber Incidents for consultation. This step follows the implementation of Joint Standard 1 of 2023 (IT Governance and Risk Management) and Joint Standard 2 of 2024 Cybersecurity and Cyber Resilience Requirements), which set out foundational expectations for financial institutions’ IT and cyber risk management. For financial services providers (FSPs) and other impacted financial institutions, these developments represent a significant shift toward more structured, timely, and consistent reporting of cyber and IT disruptions.
The Authorities have released three key documents:
- A draft Determination of the Notification Template for reporting material IT and cyber incidents.
- A draft Notification Template itself, which standardises the information institutions must provide when reporting.
- A Comment Template for stakeholders to provide feedback. The template standardises incident reporting and ensures Authorities receive consistent, actionable information.
Under the draft notice, material IT and cyber incidents must be reported using the official notification template. The reporting channels differ in that banks, insurers, and market infrastructures will submit via the Umoja Portal hosted by the Prudential Authority, and FSPs, CIS managers, pension funds, administrators, and OTC derivative providers will submit directly to the FSCA via a dedicated email address: ITandCybernotification@fsca.co.za. The notification timelines consist of immediate notification, which requires certain contact details and incident information to be shared within 24 hours of the discovery of a material incident. Thereafter, a subsequent update (within 14 calendar days from date of notification) and then a full incident report, must be submitted based on the agreed timelines with the responsible authority.
The draft determination is currently open for consultation, with comments due by 5 October 2025. Once finalised, the determination will become legally binding and will take effect in 2025.
The draft notification determination is an important step in South Africa’s efforts to build a more cyber-resilient financial sector. For FSPs, it reinforces the regulatory expectation that IT and cyber risk management is not optional, but it is a core component of governance and risk management for financial institutions.