⌂ Home ☷ Board

South African Fintech Regulation Post-2024 — Comprehensive Landscape

Date: 2026-05-31 Type: Research Status: Tier-D landscape sweep; ~30 primary sources; FATF exit, NPS Bill, COFI Bill, CASP licensing, stablecoin/e-money, Excon SBSA judgment, POPIA, joint standards, two-pot, BNPL, CBDC. Sources: south-african-fintech-regulation-post-2024-landscape-2026-05-31.sources.json

TL;DR

South Africa's fintech regulatory posture between 1 January 2024 and 31 May 2026 shifted from "preparing for Twin Peaks maturity" to active rebuild of the National Payment System (NPS) on activity-based licensing, a FATF grey-list exit on 24 October 2025, a CASP regime now supervising ~310 licensed crypto firms, and a legislatively unfinished but operationally advanced Conduct of Financial Institutions (COFI) framework. Three regulators (SARB Prudential Authority, FSCA, NCR) plus FIC, Information Regulator, NT and FinSurv are converging on the IFWG as the inter-agency clearing house — most live policy work for stablecoins, open finance, exchange control over crypto, and BNPL is being staged there before legislation lands.

The dominant theme is transition under temporary instruments: with COFI Bill and NPS Bill both pre-Parliament, regulators are bridging via Joint Standards (FSR Act), Draft Directives and Exemption Notices (Banks Act / NPS Act), and Conduct Standards — creating a thick, often overlapping compliance layer that fintechs must navigate without final-form primary legislation.

1. Architecture: Twin Peaks Maturing Under Temporary Instruments

The Twin Peaks model split prudential (SARB Prudential Authority) from conduct (FSCA) under the Financial Sector Regulation Act 9 of 2017. Post-2024, both peaks moved beyond establishment into supervision intensification:

This means fintechs face a layered rulebook: FSR Act + sector laws (FAIS, NCA, Banks Act, NPS Act) + Joint Standards + Conduct Standards + Directives + Exemption Notices — with COFI repealing/consolidating large parts once enacted.

2. Conduct of Financial Institutions (COFI) Bill

Status (May 2026): Not yet tabled in the National Assembly.

Parallel track: NPS Act amendments were originally consolidated into the COFI Bill but have been separated into a standalone NPS Bill to allow concurrent progress (Treasury, 2025 Budget Review).

⚠ low-confidence: precise tabling dates for COFI / NPS Bills remain officially uncommitted as of May 2026. Avoid taking 2025–2026 forecasts at face value.

3. National Payment System Modernisation (SARB)

Largest single regulatory change for SA fintech in the post-2024 period.

3.1 PEM Programme replaces Vision 2025

In September 2025 the SARB formally launched the Payments Ecosystem Modernisation (PEM) Programme, succeeding Vision 2025. PEM's leadership posture is materially different — SARB took an active role rather than relying on industry collaboration. Components:

3.2 PayShap (Rapid Payments Programme)

3.3 Draft Authorisation Framework + Exemption Notice (Mar 2025 → Nov 2025 → Jun 2026 third draft)

The SARB's National Payment System Department published an Authorisation Framework Directive (under NPS Act) and the Prudential Authority published a Specific Payment Activities Exemption Notice (under Banks Act):

The framework introduces seven (Nov 2025 draft) / eight (alternative counts) activity categories including: e-money issuance, payment instrument issuance, payment acquiring, third-party services, remittances, clearing & settlement, and payment accounts. Non-banks performing exempted activities are carved out of "the business of a bank" under the Banks Act, conditional on SARB authorisation/registration.

Non-bank requirements (modelled on EU PSD2):

E-money definition shift (Nov 2025 draft): the November draft dropped the "generally accepted as a means of payment" qualifier that previously kept stablecoins outside e-money. E-money is now "a store-of-value product that is a digital representation of fiat currency, is a claim on the issuer and is redeemable at face value on demand." Fiat-pegged stablecoins offering par redemption are now likely inside the e-money perimeter with full licensing, prudential, safeguarding, clearing/settlement and compliance obligations.

3.4 NPS Bill (still pending)

The standalone NPS Bill intends to permanently embed non-bank participation in clearing and settlement, replacing the temporary directive-and-exemption stack. Parliamentary officials confirmed in 2025 it had not been introduced in either House. Tabling was targeted late-2025; enactment mid-2026 was speculative; current expectation slipped further.

3.5 Project Khokha / CBDC

4. Crypto Asset Service Providers (CASPs) — FSCA Licensing & Supervision

CASPs were declared a "financial product" under FAIS in October 2022. Licensing went live 1 June 2023 with applications due by 30 November 2023.

4.1 Licensing scoreboard (as at 31 March 2026)

Metric Total
Applications received 533
Approved 310
Declined 17
Withdrawn (post-engagement) 124
Under consideration balance

Decline reasons: failure of operational ability (business plan, business-model clarity) and competency (lack of demonstrated crypto knowledge/experience) under the FAIS fit-and-proper requirements.

4.2 Regulatory Examinations (REs)

Exemption from FAIS REs (Board Notice 194 of 2017, Chapter 3 Part 4) was extended to 30 June 2025 — no further extensions. Licensed CASPs and their key individuals must now hold REs; failure attracts suspension/withdrawal under FAIS s9.

4.3 Supervisory cycle

4.4 Unlicensed CASPs

81 investigations opened; 25 closed (entities ceased/dormant); 56 ongoing. Administrative penalty ceiling: R10 million per contravention under FAIS (standard) — but headline enforcement actions in 2025 (see §4.6) show penalties far above the per-contravention cap when stacked.

4.5 Public list

FSCA publishes and updates an authorised-CASP list (latest available version: 18 December 2024 PDF on www2.fsca.co.za; subsequent updates on the live FSCA portal).

4.6 FSCA Enforcement Posture 2024/25 — Record Year

The FSCA's 2024/25 integrated report shows a step-change in enforcement intensity:

Metric 2024/25
Investigations finalised 633 (up from 418 in 2023/24)
New cases opened 767 (up from 483)
Ongoing investigations 494
Debarment orders issued 131
Licences withdrawn 382
Fines / penalties collected R119m
AML/CFT financial penalties R27.1m (up 127% from R11.9m 2021)
AML/CFT non-financial sanctions 19 (up 533% from 3)
Licences granted 779 (incl. 264 CASPs)

Headline 2025 cases:

The R2bn Banxso penalty resets expectations of upside enforcement risk for fintechs and CASPs.

5. Stablecoins

Stablecoins moved from niche to systemic concern over 2024–2025.

Three parallel SA stablecoin workstreams

  1. IFWG / Crypto Asset Regulatory Working Group (CAR WG): published the 2025 South African Stablecoin Landscape Diagnostic and committed to a discussion paper on rand-pegged stablecoins for public consultation in Q1 2026 (FX-pegged stablecoin work follows).
  2. SARB FSR (November 2025): added "tech-enabled financial innovation" as a new risk category — flagged crypto and stablecoins as sub-risks. Governor Kganyago publicly: "the truth of the matter is that these things could break apart."
  3. SARB Draft Authorisation Framework (Nov 2025): e-money redefinition (see §3.3) likely captures fiat-backed stablecoin issuers.

Implication: stablecoin issuers targeting SA should plan for dual capture — under FAIS (CASP) for advice/intermediation/exchange roles AND under the NPS/Banks Act e-money perimeter for issuance.

6. AML/CFT — FIC Amendment Act, Beneficial Ownership, FATF Exit

6.1 FIC Amendment Act / General Laws (AML/CFT) Amendment Act 22 of 2022

6.2 Beneficial ownership filings

6.3 FATF grey-list exit — 24 October 2025

Fintech implications of exit

7. Privacy — POPIA Enforcement & 2025 Regulations Amendment

7.1 2025 Regulations amendment

7.2 Enforcement posture

Penalty ceiling for serious offences: R10m fine and/or 10 years imprisonment.

8. Credit & BNPL — National Credit Act (NCR)

8.1 BNPL — still grey

8.2 NCA Regulations draft (August 2025)

The Aug 2025 regulations do not directly capture BNPL but raise the affordability-assessment bar across registered credit providers, narrowing the practical gap.

8.3 International benchmarks fintechs should track

9. Open Finance / Open Banking

Market: 200+ fintechs; Nedbank, Investec, Capitec, FNB, Standard Bank operate API marketplaces or data-sharing facilities.

10. Operational Resilience — Joint Standards (FSCA + PA)

Three Joint Standards published 2024 are now in force or about to commence — they apply across banks, insurers, retirement funds, CIS managers, market infrastructures, and licensed FSPs (including CASPs to the extent applicable):

Joint Standard Topic Effective
JS 1 of 2024 Outsourcing by Insurers 1 December 2024
Joint Standard on IT Governance and Risk Management IT governance, IT strategy, risk-management framework, oversight 15 November 2024
JS 2 of 2024 Cybersecurity and Cyber Resilience Requirements 1 June 2025

JS 2 minimums include: cybersecurity strategy + framework, asset criticality classification, security risk assessments, access controls, threat-intelligence management, breach readiness, mandatory material-incident notification, annual board-level cybersecurity awareness training, controls assurance via regular exercises. Explicit alignment with POPIA on personal-information safeguards.

Non-compliance → administrative penalties and reputational exposure.

11. Crypto + Exchange Control — The SBSA v SARB Earthquake

Expected CASP impact: integration into the authorised-dealer architecture; CASPs to administer client exchange-control allowances for crypto transfers and report to FinSurv. CASPs need to map cross-border crypto flows, upgrade transaction monitoring/record-keeping, and refresh RMCPs, FAIS+FICA compliance, client agreements, vendor contracts, and privacy notices ahead of go-live.

⚠ low-confidence: precise scope and format of FinSurv crypto reporting only known once draft regs publish. Avoid building specific reporting infrastructure until the draft is on the table.

12. Two-Pot Retirement System (1 September 2024)

Effective 1 September 2024 via the Revenue Laws Amendment Act:

13. Innovation Layer — IFWG Innovation Hub

14. What Fintechs Need to Do Now (Operational Compact)

Theme Action
Payments Map activities against the 7-category Authorisation Framework; engage SARB pre-licensing dialogue; budget for activity-based capital + 100% e-money liquidity buffer + segregated trust accounts.
Stablecoins Plan for dual capture (FAIS CASP + e-money under NPS/Banks). Watch IFWG rand-pegged consultation Q1 2026.
CASPs Close RE compliance (deadline 30 June 2025 lapsed); prepare for FSCA inspection cycle; engage CASEF; tighten AML programmes; map cross-border flows for inbound Excon regime.
Conduct Track COFI Bill themed-framework consultations; map current FAIS licences to anticipated activity-based licences.
AML BO filings at CIPC current; FIC PCC59 implementation in client onboarding; align Risk Management & Compliance Programme.
Privacy Direct-marketing audit; 72-hour breach notification; appoint/refresh Information Officer; integrate POPIA + JS 2 of 2024 cyber requirements.
Cyber/Ops JS 2 of 2024 minimum framework, board awareness training, material-incident notification process.
Credit/BNPL Even if outside NCA today, model Reg 23A affordability standards; watch for explicit BNPL inclusion.
Retirement If servicing two-pot withdrawals, verify SARS interface + ID/OTP infrastructure stable.
Innovation Use IFWG Sandbox for novel propositions; rolling applications.

Stage 6: GAP_ANALYSIS

Iterate once to address the most load-bearing gap (CASP enforcement quantitative data) and clear the PayShap-figure contradiction with a fresh source.

Stage 7: ITERATE round 1

Targeted gap retrievals delivered:

Stage 6 re-run after iteration:

Stopping iteration (one round used; major gaps closed; remaining threads non-load-bearing).

Stage 7.5: RED-TEAM CRITIQUE

Three personas applied against the post-iteration draft.

Skeptical Practitioner

  1. Is "fintech regulation" too broad a frame? The report mixes prudential, conduct, AML, consumer credit, payments, privacy, and exchange control. A fintech actor seeing this for the first time may struggle to map the rules to its own activity. The §14 operational compact partially mitigates this, but a clearer "which rule applies to which activity" matrix (lending vs. payments vs. crypto vs. wealth) would sharpen utility.
  2. Twin Peaks "maturation" framing assumes COFI is the natural endpoint. That assumption deserves explicit challenge: if COFI keeps slipping, the contingency stack of Joint Standards + Conduct Standards + Directives may become the de facto end state.

Adversarial Reviewer

  1. Date discipline. Several events are still moving (NPS Bill not tabled; Excon-for-crypto regulations not yet published; COFI Bill awaiting certification through mid-2025). The report should flag every "expected in" statement with a calendar boundary.
  2. Survivorship bias in CASP licensing data. 533 applications received hides what the underlying market size was — implicit base rate. The "300 approved" headline conceals that 124 withdrawals were "post-engagement", which may reflect FSCA gatekeeping rather than market readiness.
  3. SBSA v SARB material risk. The report correctly notes the appeal suspends the ruling, but does not explicitly state that any business currently relying on the May 2025 judgment for cross-border crypto bears reversal risk. That belongs in the operational compact.
  4. Joint Standard scope clarity. §10 should note that JS 2 of 2024 explicitly does not automatically apply to entities not regulated under FSR — e.g. unlicensed payments adjacencies.

Implementation Engineer

  1. Costs and timelines absent. Capital quanta for activity-based PSPs (the actual rand amounts per tier) are not in the public draft yet — flag as a watch-item with comment-period closing 15 June 2026.
  2. Operating reality of CASP RE compliance. The 30 June 2025 RE deadline lapsed; for fintechs still onboarding key individuals, the practical question is the FSCA's tolerance window for late compliance — anecdote vs. policy not addressed.
  3. PEMKey demo (April 2026) and QR+ standard create new integration requirements for wallets, acquirers, and POS systems. The report should highlight that PEM is producing technical standards (not just regulation) that fintechs must build to.
  4. Two-pot withdrawal infrastructure — actual administrator failures during September–November 2024 (delayed payments, OTP failures) deserve at least a sentence on operational risk.

Load-bearing claims flagged for additional sourcing

Stage 7.6: CRITIQUE LOOP-BACK

Load-bearing claim source counts:

Single loop-back round permitted (Tier 1 providers only).

Loop-back round executed via the search call below in this stage. If still <3 sources after one round, the claim stays flagged inline as low-confidence.

Loop-back result:

No further loop-back rounds needed.

Counterpoints

  1. The framework is not yet binding. A reader could overestimate how much has actually changed in primary law. The COFI Bill is not enacted; the NPS Bill is not tabled; the Excon-for-crypto regulations were announced (Feb–Mar 2026) but draft amendments are pending. Counterpoint: most "regulation" cited in this report is sub-legislative (Directives, Notices, Joint Standards, Conduct Standards, IFWG papers). A change in Treasury or SARB leadership, a Cabinet reshuffle, or a court challenge could materially reshape any one of these. Build for the rules that are in force; treat the rest as planning intelligence.

  2. FATF exit may be reversed at the next mutual evaluation. Treasury and SARS explicitly warned post-exit that staying off-list requires sustained measurable outcomes — investigations, prosecutions, sanctions. SA's enforcement track record in financial crime (asset forfeiture, NPA prosecutions) has historically been thin. The 2026 mutual evaluation begins in H1 2026 with adoption Oct 2027 under the new FATF methodology; a finding that the reforms were paper-only could trigger re-listing.

  3. SBSA v SARB on appeal — operational risk for crypto remitters. Anyone designing cross-border crypto flows on the basis that "the High Court said crypto is not capital" carries reversal risk. SARB's appeal suspends the ruling and Treasury has announced legislative reversal. The "regulatory sandbox" the judgment temporarily created is closing.

  4. PEM Programme governance concerns. SARB's 50% stake in PayInc (the national clearing operator) creates a fundamental conflict-of-interest critique — central bank as both regulator and shareholder of the critical national infrastructure. Industry commentators (TechCentral) have flagged this. Whether this accelerates modernisation or entrenches the big-four banks' grip is contested.

  5. PayShap network-effect optimism may be misplaced. Despite 905m transactions and 6m users by mid-2026, PayShap's share of debit transactions per bank stays in single digits. The slow shift away from cash and cards is structural — fees, fraud perception, lack of merchant acceptance. A vendor or fintech betting business model viability on rapid PayShap displacement of cards should plan downside.

  6. Open Finance gap risk. TPPs are currently unregulated; the FSCA has stated a phased mandatory regime is likely, but the timeline is open. Fintechs offering data-aggregation or payment-initiation today operate without explicit licensing — but in a phased mandatory regime, they may face retro-fit obligations, capital requirements, or even market exclusion if they fail to qualify for the new licence category.

  7. Two-pot operational reality vs. policy ambition. Despite seamless-sounding policy descriptions, September–November 2024 saw real administrator queues, OTP failures, delayed payouts, and consumer complaints. Any fintech entering retirement servicing should not underestimate the SARS-integration + ID/OTP infrastructure investment required.

Key Sources

Full annotated list in companion file: south-african-fintech-regulation-post-2024-landscape-2026-05-31.sources.json (claim-mapped).

Top primary references:

Stage Tally