South African financial services

Compliance and data protection for financial services.

Client records, advice files and transaction systems need protection and a workable recovery plan. Start with the business's licence, activities and regulatory scope before choosing the controls or evidence an MSP will provide.

The regulatory context

A financial business needs an applicability assessment.

Banks, insurers, advisers, administrators and other financial businesses do not all have identical duties. An ordinary finance department is not automatically subject to every financial-sector standard.

FSCA and Prudential Authority

Check the cyber standard's defined scope.

Joint Standard 2 of 2024 took effect on 1 June 2025. It addresses governance, cyber controls, resilience and reporting for financial institutions as specifically defined in the standard.

Its definition includes specified institutions and FSP categories; it does not include every Category I adviser merely because the firm holds an FSP licence. Confirm the definition, any applicable exemptions and related IT-governance requirements with the compliance function.

Sources: Joint Standard 2 of 2024; commencement notice.

FAIS and FIC responsibilities

Identify licence and activity-specific duties.

FAIS authorisation, recordkeeping, applicable codes and licence conditions need their own review. FIC accountable-institution duties depend on the relevant Schedule 1 category and activities; do not assume that every financial business has identical FIC obligations.

Where applicable, due diligence, recordkeeping, reporting and an approved risk management and compliance programme remain business responsibilities. A backup report cannot evidence a client-risk decision.

Sources: FAIS Act; FIC Guidance Note 7B.

POPIA

Protect client and workforce information.

POPIA addresses lawful processing as well as security. Review personal information in advice files, identity records, recordings, email and third-party platforms, with appropriate access and retention.

Written operator arrangements, incident escalation and cross-border transfer conditions need to fit the actual services and suppliers.

Sources: POPIA.

This guide covers selected information and IT matters. It is not a complete legal checklist or a finding that your organisation complies. Confirm applicability with the people responsible for your legal, regulatory and operational duties. See the general Compliance page for the wider context, including PAIA.

Keep what is required, for the right reason

Separate advice, FIC and operational evidence.

Keep the source rule and retention trigger beside each record category. Different duties can apply to the same file; a generic backup period is insufficient.

Selected records to include in your retention schedule
Record category	Rule or decision to confirm	Useful evidence
FAIS records and advice documentation	Section 18 requires specified provider records, including complaints and compliance matters, for at least five years, subject to applicable exemptions. Assess advice records and communications against the applicable codes and licence conditions separately; this is not one period for every client file. Sources: FAIS Act.	Record inventory mapped to applicable provisions, accessible files and retrieval checks.
FIC records where accountable-institution duties apply	Guidance Note 7B distinguishes at least five years from relationship termination, transaction conclusion or report submission for the relevant categories. Assess the category, longer holds and continuing access before deletion. Sources: FIC Guidance Note 7B.	Category and trigger register, access controls and tested retrieval.
Cyber, access and recovery evidence	Where the Joint Standard applies, map evidence to the applicable governance, control, testing and reporting requirements. Agree useful log retention with the compliance and security functions; no universal five-year log rule is asserted here. Sources: Joint Standard 2 of 2024.	Dated reviews, test results, approved exceptions and remediation tracking.

A backup retention setting is not a complete records policy. Record the owner, retention trigger, access rules, storage location, legal holds and authorised disposal for each category. Test retrieval, including the application or licence needed to read it. POPIA section 14 requires a lawful reason for continued retention; avoid keeping personal information indefinitely by default.

From risks to working controls

Make the evidence specific to the control.

These are practical measures to assess against your environment and agreed service scope. Evidence should show what was checked, when, by whom and what still needs attention.

Privileged or client-platform access is misused

Review named users, privileged access, multi-factor authentication and leaver removal against the applicable requirements. Include outsourced administrators and supplier accounts.

Possible evidence: Access approvals, review dates, exceptions and removal records.

A critical service cannot be recovered

Identify dependencies, acceptable data loss and recovery priorities with the business owner. Test representative recovery, record the results and track gaps; distinguish an agreed objective from a demonstrated recovery time.

Possible evidence: Approved recovery plan, timed exercise results and unresolved actions.

A supplier's claim is treated as assurance

Confirm covered workloads, exclusions, data locations, operator arrangements, escalation and exit provisions. Request evidence appropriate to the institution's supplier-risk assessment.

Possible evidence: Approved scope, supplier review, recovery evidence and exit plan.

Security exceptions never reach management

Assign owners and review dates to unsupported systems, failed backups and access exceptions. Report status in a form that the responsible management and compliance teams can use.

Possible evidence: Risk and exception register, escalation records and decisions.

An incident is assessed too late

Agree technical escalation contacts, materiality assessment owners and reporting routes in advance. Exercise the handover between IT, management, compliance and relevant suppliers.

Possible evidence: Incident procedure, exercise records, timeline and notification decision log.

The control examples draw on Joint Standard 2 of 2024 and NIST CSF 2.0. Technical guidance is not itself South African legislation or a compliance certificate.

What to check

Check the reporting route before an incident.

Joint Notice 2 of 2026 took effect on 1 September 2026. For institutions in scope, it prescribes the material IT/cyber incident template and submission routes under Joint Standard 1 of 2023 and Joint Standard 2 of 2024. Submission periods are set on the template cover page; use the current official template.

The financial-sector material-incident assessment and POPIA's security-compromise trigger are different tests. Keep both in the incident procedure. Meeting one reporting requirement does not discharge the other.

Prepare before an incident

Assess both sector reporting and personal-data duties.

The responsible compliance function should assess whether a material IT or cyber incident must be reported under the applicable standards and current notice. Preserve the timeline, affected systems, service impact and available evidence. The linked 2026 notice is the starting point for the current template and route.

Under POPIA section 22, reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person trigger notification duties. The responsible party must notify the Information Regulator and affected data subjects as soon as reasonably possible, subject to the Act's provisions. An operator must notify the responsible party immediately under section 21(2). There is no general 72-hour POPIA deadline. Sources: POPIA; Regulator guidance.

Agree who assesses the facts, preserves relevant evidence, makes notifications and authorises recovery. A technical incident report supports those decisions; it does not replace them.

Bastion Backups' role

Agree the evidence your compliance team needs.

Subject to an agreed scope, Bastion provides managed backup, recovery planning and testing, security checks and reporting, and controlled remote support. Start with your systems, record locations, authorised users and recovery priorities.

We can map the agreed technical services to selected controls and evidence requested by your compliance team. Regulatory assurance, independent audit, penetration testing and a managed security operations centre are not implied by the four confirmed service categories.

Agree coverage, exclusions, responsibilities, storage and supplier arrangements, reporting, testing, support availability and any costs in writing before work begins. Where we process personal information as an operator, the written arrangement must address the applicable POPIA duties.

The institution retains governance, risk acceptance, regulatory interpretation and submissions. Its appointed compliance and assurance functions retain their roles. We do not certify regulatory compliance, promise that incidents will be prevented or guarantee recovery times without a specific agreed commitment.

Explore our supported solutions

Common questions

Decisions to make before selecting a service.

Does Joint Standard 2 of 2024 apply to every adviser?

No. Apply the standard's own definition of financial institution. It includes discretionary and administrative FSPs and Category I FSPs that provide investment fund administration services, among other specified institutions. Do not extend it to every Category I adviser without an applicability assessment; other duties can still apply.

Does an MSP agreement transfer regulatory accountability?

It assigns agreed service responsibilities. The institution still needs governance, oversight and the applicable regulatory decisions. Specify evidence, escalation, supplier dependencies and exclusions so those responsibilities can be managed.

Legislation and guidance

Check the source and its scope.

Content reviewed 16 October 2026.

FSCA and Prudential Authority: Joint Standard 2 of 2024 — official publication page with the final standard in the attached ZIP. Its own definition of financial institution controls its scope; sections 4–9 cover governance, controls and reporting.
Joint Notice 1 of 2024 — sets 1 June 2025 as the commencement date for Joint Standard 2 of 2024.
Joint Notice 2 of 2026 and Joint Communication 5 of 2026 — effective 1 September 2026: prescribed material IT/cyber incident template and submission routes. The reporting period is set on the template cover page.
Financial Advisory and Intermediary Services Act 37 of 2002 — authorisation and provider responsibilities; section 18 addresses specified records. Applicable codes and licence conditions also need review.
FIC Guidance Note 7B — issued 3 August 2026; customer due diligence, recordkeeping and risk management and compliance programmes for accountable institutions.
Protection of Personal Information Act 4 of 2013 — sections 14, 19–22, 26–33 and 72: retention, safeguards, operators, incidents, special personal information and cross-border transfers.
Information Regulator: handling security compromises — notification roles and reporting process; read with POPIA sections 21 and 22.
NIST Cybersecurity Framework 2.0 — voluntary guidance for risk management, access, protection, recovery and evidence; not South African legislation.

Check current legislation, regulator notices and your own contracts before acting. The practical examples describe matters to review; they are not a statement that every listed control is legally required for every business.

View all industry guides

Discuss your financial-services systems

Begin with your regulatory scope and critical records.

Tell us which systems you use and what you need to review. Please do not send client files, identity documents, sensitive system configurations, passwords or access codes with an initial enquiry.

Email us Call +27 83 651 6444