Outsourcing by insurers and banks in South Africa: the joint standard, the Prudential Authority and FICA

Outsourcing moves the work, never the regulatory duty. An insurer that outsources a material function follows Joint Standard 1 of 2024: a board-approved policy, due diligence, notice to both regulators at least 30 days before it signs, which may object, and a written contract with set terms. A bank follows the Prudential Authority's guidance note on outsourcing, Guidance Note 5/2014, which the Authority confirmed as still effective in March 2026. In our reading, a bank can outsource a call centre, but it must notify the Authority at least 20 working days before it outsources a material function. Under FICA, a provider may collect and process onboarding documents to a limited extent, but the institution cannot outsource its customer due diligence obligation and stays liable for compliance failures. Under POPIA, the provider is usually an operator and needs a written contract.

• Insurers: Joint Standard 1 of 2024, Outsourcing by Insurers, made jointly by the Financial Sector Conduct Authority and the Prudential Authority.
• Banks: the Prudential Authority's guidance note on outsourcing of functions within banks, and, for cloud services and data stored abroad, Directive 3 of 2018.
• FICA: every accountable institution. The list includes a person who carries on the business of a bank and a person who carries on a life insurance business, excluding reinsurance. Our document processing guide covers which other insurers and advisers the list names.
• POPIA: every business that hands personal information to a provider.

The FSCA and the Prudential Authority are developing a cross-cutting third-party risk management standard for all supervised financial institutions. Until it is published, the outsourcing instruments below are the main ones. Banks also have Directive 8/2016, which directs them to report specified information on their material outsourced service providers, and Guidance Note 5/2018 on cloud computing and the offshoring of data, which the Prudential Authority lists as still effective.

The insurers' standard was published on 17 May 2024 and came into operation on 1 December 2024. It is not the IT standard: Joint Standard 1 of 2023 covers information technology governance and risk management.

It applies to all insurers licensed under the Insurance Act, other than Lloyd's and branches of foreign reinsurers, and only to the outsourcing of material functions. A material function is one that has the potential to have a significant impact on the insurer's business operations or its ability to manage risks effectively, should it be disrupted. All functions of senior management and the control functions are material by definition.

For everything else the insurer decides, weighing factors the standard lists: the impact if the provider fails, the cost of the arrangement as a share of the insurer's costs, how hard it would be to replace the provider or bring the work back, the effect on meeting regulatory requirements, the sharing of sensitive customer information, the potential losses to policyholders, and any relationship between the insurer and the provider. In our reading, a claims call centre, a policy administration team or a claims capture function will often pass that test, because policyholders feel a failure at once. The standard leaves the call to the insurer.

What the insurer must do for a material function:

• Policy. A board-approved outsourcing policy that sets limits on what is outsourced and to whom, and gives guidance on the risks to assess, from access and concentration risk to country and exit risk.
• Due diligence. Appropriate due diligence before it signs, objective selection, and a check that the provider has sound governance and controls, the capability and money to keep performing, contingency plans, and key persons who meet the fit and proper requirements.
• Limits. The insurer must not outsource where doing so may materially increase its risks, impair its governance, impair the regulators' ability to monitor it, or compromise the fair treatment of policyholders.
• Notice. Notify both regulators at least 30 days before entering the arrangement, with a confirmation and details: that the arrangement fits the insurer's policy and risk appetite, who the provider is, the fee or how it is calculated, and the key risks and how they are mitigated. The regulators may object to a material arrangement they are convinced is inconsistent with the standard.
• Contract. In writing, covering at least the standard's list, which includes the duration, the service standard to the insurer and to policyholders, the fee or its basis, reporting, performance reviews, continued access to information, confidentiality and security, subcontracting, ownership of intellectual property, continuity if the provider fails or enters business rescue, access to the provider's premises and documents for the insurer and, if needed, the regulators, termination rights, indemnities, dispute resolution and a reasonable termination period.
• Fees. Remuneration may not be linked to the value of claims repudiated, paid, not paid or partially paid, and a function already paid for through commission or a binder fee may not be paid for again.
• Monitoring and exit. Ongoing review of the provider and contingency plans. If the arrangement ends, the insurer notifies the regulators within 7 days of termination, with its reasons and how the work will continue.

Above all of this sits one line: the insurer retains responsibility and accountability for all regulatory obligations relating to a function, outsourced or not.

The joint standard repeals Prudential Standard GOI 5: Outsourcing by Insurers and replaces its references in the other governance standards. Insurers had 6 months from commencement to comply, following the old standard in the meantime. An arrangement made before the standard began must comply by 1 December 2026, or on renewal or renegotiation if that comes first. If a contract with an outsourced provider predates the standard and has not been renegotiated, that deadline is close.

For banks, the instrument is Guidance Note 5/2014, Outsourcing of functions within banks, issued under the Banks Act and still listed as effective in the Authority's March 2026 list of guidance notes. It is a guidance note rather than a directive, and it rests on the Regulations relating to Banks, which make the board responsible for managing the risks of outsourcing material business activities.

Outsourcing, in the note, is the use of a service provider, whether an affiliate or a third party, to perform on a continuing basis an activity the bank could undertake, and it includes IT systems and services. The note applies to material business activities, defined in the same words the insurers' standard later used, with factors that include customer losses, reputation and the difficulty of finding another provider.

The note names three groups:

• Not supported. The Authority views management oversight, governance and risk management as material functions and does not support outsourcing them.
• Prior written approval. Internal audit, core banking IT systems and the financial reporting IT system need the Authority's written approval first, and internal audit may never go to the bank's current external auditor.
• Everything else that is material. The bank notifies the Authority at least 20 working days before entering the agreement, and notifies it before offshoring material business activities.

A call centre is in none of the first two groups, so in our reading a bank can outsource one. Whether it must notify depends on materiality, and for a bank's customer service line the factors above may point that way. The note also treats the critical functions and critical shared services in a bank's recovery plan as material. The note's key requirements then apply: a board-approved policy, a risk assessment, due diligence, a legal contract, monitoring, contingency plans, and the ability to show the Authority how the provider's performance was verified.

On the contract, the note asks for a documented, legally binding agreement, reviewed by the bank's legal counsel, with no work starting before all parties sign. Its minimum list runs to thirty aspects, including audit rights, customer complaints, confidentiality and security of information, offshoring arrangements, notification of financial difficulty and significant incidents, remedies including early exit, service levels and subcontracting. The note accepts that some of the aspects may not apply in every case, but expects the bank to address every issue relevant to the risks of the arrangement. A subcontractor's failure stays the provider's responsibility, and the provider may not cancel the agreement because the bank enters recovery or resolution. The agreement should also give the Authority the right to access information, including on-site visits at the provider.

Cloud services and data held abroad have their own directive. Under Directive 3 of 2018, a bank must keep data in a usable, readable and portable state, even when the contract is terminated, put every arrangement in a legally binding agreement, and never let it block regulatory access. The regulators have said a joint standard on cloud computing and data offshoring is being prepared for the wider financial sector.

The FIC Act requires an accountable institution, in the course of establishing a business relationship and in accordance with its Risk Management and Compliance Programme, to establish and verify the client's identity. If it cannot complete customer due diligence, it may not establish the relationship.

The Financial Intelligence Centre's guidance on outsourcing, Public Compliance Communication 12A, draws the line:

• The institution remains liable for compliance failures caused by an outsourcing arrangement, and that liability cannot be transferred to the provider, even if the provider is an accountable institution itself.
• A provider may help, to a limited extent, with the collection and processing of documentation and information for customer due diligence. The institution must still decide whether what was collected is acceptable under the Act and its own programme, and must have controls to check it.
• Reporting to the Centre, registration, approving the risk assessment and senior management approval for politically exposed persons cannot be outsourced. Screening clients against sanctions lists can be, but the provider must pass any match to the institution for reporting.
• The arrangement belongs in a formal agreement, clearly indicated in the institution's Risk Management and Compliance Programme.
• Relying on another accountable institution for a shared client is a different arrangement from outsourcing, and work done within a group is not treated as outsourcing.

The Act puts the design in the institution's hands. Its programme must set out how identities are established and verified, and where records are kept, the board or senior management approves the programme, and the board must ensure compliance by the institution and its employees.

In practice: let the provider collect, check documents for completeness and key the data, and keep the decision to accept the client, every report to the Centre and every politically exposed person approval inside the institution, with a sample of the provider's files reviewed by your own compliance staff.

A provider may keep FICA records for you. Under section 24, you need free and easy access to them, they must be readily available to the Centre and your supervisor, and you remain liable if the provider fails. The records may be kept in electronic form if they can be reproduced legibly. Our document processing guide covers how long each kind of record is kept.

When you appoint the provider, the Money Laundering and Terrorist Financing Control Regulations require you to give the Centre and your supervisor, without delay, the provider's particulars: its name, the person who controls access to the records, the address where they are kept and the address from which they are controlled, and the person at your institution who deals with the provider about them. The Centre advises against outsourcing the keeping of records of reports made to it.

Put the access route, a retrieval time, the storage location and the handover at the end of the contract into the agreement, so the duty holds whatever happens to the provider.

A provider that processes personal information for you is an operator: it processes in terms of a contract or mandate, without coming under the direct authority of the responsible party, which remains you.

• Section 21(1) requires a written contract that makes the operator maintain the security measures in section 19.
• Under section 20, the operator processes only with your knowledge or authorisation and treats the information as confidential.
• The operator must tell you immediately when it suspects unauthorised access. You, not the operator, notify the Information Regulator and the people affected.
• If the provider sends information to another country, section 72 applies, and for a bank so does the cloud directive above.

One contract can carry the joint standard's or the guidance note's terms, the FICA access terms and the POPIA operator terms. Our guide to choosing an outsourcing partner sets out the operator clauses in full.

Before you sign, ask the provider for:

1. A written description of the service that your compliance team can test against your materiality factors.
2. Agreement to every term your standard or guidance note lists that applies to the arrangement, including access for the regulators to its premises and documents.
3. A named list of subcontractors, and its acceptance of responsibility for each.
4. Where your customers' information and FICA records will be held, and how fast a record can be retrieved.
5. A FICA process in which it collects and checks, and your staff decide.
6. Reports you can verify, and the right to review a sample of its files.
7. Its contingency plan, tested, and a plan for handing the work back or to another provider.
8. Fees that do not depend on the value of claims paid or declined, if you are an insurer.

This is not legal advice. Checked against the insurers' outsourcing joint standard as first published, the Prudential Authority's outsourcing guidance note, cloud directive and outsourcing reporting directive for banks, the FIC Act and the Financial Intelligence Centre's guidance on outsourcing on 12 October 2026. These texts change, so have an attorney check your own arrangement against the current versions.

IAMX offers business process outsourcing of all types through BPO partners: customer support, back-office work, collections and recoveries, and managed teams that scale with you, behind one accountable front door to a vetted network of specialist partners. For insurers, brokers and financial services firms, IAMX's Document processing and data capture service handles onboarding and claims documents, with completeness checks against FICA and FAIS document requirements and anything unusual sent to a person for a decision. The obligations in this guide stay with you whichever provider you choose, so bring your outsourcing policy and its required terms to the first conversation.

• Has the joint standard replaced the old GOI outsourcing standard?

  Yes. Joint Standard 1 of 2024 repeals Prudential Standard GOI 5. Arrangements made before it began must comply by 1 December 2026, or on renewal or renegotiation if that comes first.

• Is the insurers' outsourcing joint standard the same as the IT governance standard?

  No. Joint Standard 1 of 2024 covers outsourcing by insurers. Joint Standard 1 of 2023 covers IT governance and risk management for financial institutions.

• Can a bank in South Africa outsource its call centre?

  Yes, in our reading of Guidance Note 5/2014: a call centre is not among the functions the Prudential Authority does not support or must approve first. If the call centre is material, the bank notifies the Authority at least 20 working days before signing, and the contract must give the Authority access to information.

• Can a bank or life insurer outsource FICA customer due diligence?

  It can outsource the work of collecting and processing documents, not the obligation. The Financial Intelligence Centre says the institution cannot outsource its customer due diligence obligation, must decide whether what was collected is acceptable, and remains liable for any failure.

• Who is liable if an outsourced provider loses our FICA records?

  You are. Under section 24 of the FIC Act, the accountable institution is liable if the third party keeping its records fails to comply, and it must have free and easy access to them throughout.

• Does an insurer have to tell the regulators before it outsources?

  For a material function, yes: at least 30 days before entering the arrangement, with details of the provider, the fee or its basis and the key risks. If the arrangement ends, the insurer reports the reasons within 7 days of termination.

• Financial Sector Conduct Authority and Prudential Authority: Joint Standard 1 of 2024, Outsourcing by Insurers, was made by the Financial Sector Conduct Authority and the Prudential Authority under section 107, read with sections 105, 106 and 108, of the Financial Sector Regulation Act, 2017, with a date of publication of 17 May 2024. Checked 12 October 2026.
• Prudential Authority and Financial Sector Conduct Authority: An insurer must notify the Authorities of a proposed material outsourcing arrangement at least 30 days before entering into it. Checked 9 October 2026.
• Financial Sector Conduct Authority and Prudential Authority: Clause 7.3 of Joint Standard 1 of 2024 says the Authorities may object to any arrangement to outsource a material function if they are convinced that the proposed outsourcing is inconsistent with the Joint Standard. Checked 12 October 2026.
• South African Reserve Bank, Prudential Authority (issued by the Office of the Registrar of Banks): Banks Act Guidance Note 5/2014, Outsourcing of functions within banks, dated 8 July 2014, was issued by the Registrar of Banks under section 6(5) of the Banks Act, 1990, and replaces Guidance Note 3/2008. Checked 12 October 2026.
• South African Reserve Bank, Prudential Authority: Banks Act Guidance Note 1/2026, dated 6 March 2026, says all previously issued guidance notes are deemed withdrawn unless confirmed in it, and lists Guidance Note 5/2014 (Outsourcing of functions within banks) and Guidance Note 5/2018 (Cloud computing and the offshoring of data) as remaining effective. Checked 12 October 2026.
• South African Reserve Bank, Prudential Authority (issued by the Office of the Registrar of Banks): Paragraph 5.1 of Guidance Note 5/2014 lists key requirements including a board-approved outsourcing policy, risk assessments, due diligence, a legal contract, monitoring, contingency and business continuity plans, being able to demonstrate verification of a provider's performance, prior written approval for internal audit, core banking IT and the financial reporting IT system, and notice to the Office at least 20 working days before entering into agreements to outsource other material business activities or functions. Checked 12 October 2026.
• Financial Intelligence Centre: Paragraphs 4.2 to 4.5 of Public Compliance Communication 12A say an accountable institution cannot outsource its customer due diligence obligation, may use a provider for operational functions such as the collection and processing of documentation and information (its summary says to a limited extent), must have sufficient controls to ensure its obligations are met, and must determine whether what was collected is acceptable under the Act and its programme. Checked 12 October 2026.
• South African Reserve Bank: The South African Reserve Bank's annual report for 2024/25 says Joint Standard 1 of 2024 was developed specifically for insurers, and that the Prudential Authority and the FSCA are in the process of developing a cross-cutting third-party risk management standard for all supervised financial institutions. Checked 12 October 2026.
• South African Reserve Bank, Prudential Authority (issued by the Office of the Registrar of Banks): Banks Act Directive 8/2016, Reporting requirements relating to material outsourced service providers and critical third-party service providers, dated 13 December 2016 and issued under section 6(6) of the Banks Act, directs all banks to submit specified information in respect of their outsourcing arrangements within set timelines, and replaces Directive 8/2015. Checked 12 October 2026.
• South African Reserve Bank, Prudential Authority: Directive 3 of 2018, Cloud computing and the offshoring of data, issued under section 6(6) of the Banks Act and dated 5 September 2018, requires banks from 1 October 2018 to keep data in a usable, readable and portable state even when the contract is terminated, to put every cloud or data offshoring arrangement in a documented, legally binding agreement, and not to let such arrangements prevent regulatory access to information. Checked 12 October 2026.
• Financial Intelligence Centre: Item 6 of Schedule 1 to the Financial Intelligence Centre Act lists as an accountable institution a person who carries on the business of a bank as defined in the Banks Act, 1990; items 7 and 7A list mutual banks and co-operative banks. Checked 12 October 2026.
• Financial Intelligence Centre: Item 8 of Schedule 1 to the Financial Intelligence Centre Act lists as an accountable institution a person who carries on a life insurance business as defined in the Insurance Act, 2017, but excludes reinsurance business; at the date checked, no item of the schedule named short-term (non-life) insurance business. Section 29(1) separately requires a person who carries on, manages or is employed by any business to report suspicious and unusual transactions. Checked 12 October 2026.
• Prudential Authority and Financial Sector Conduct Authority: Joint Standard 1 of 2024 came into operation on 1 December 2024. Checked 9 October 2026.
• Financial Sector Conduct Authority and Prudential Authority: Joint Communication 4 of 2023 announced the publication of Joint Standard 1 of 2023, Information Technology (IT) Governance and Risk Management, which sets principles for IT governance and risk management that financial institutions must comply with, and commences on 15 November 2024. Checked 12 October 2026.
• Financial Sector Conduct Authority and Prudential Authority: Clause 3 of Joint Standard 1 of 2024 says it applies to all insurers licensed under the Insurance Act, other than Lloyd's and branches of foreign reinsurers, and only to the outsourcing of material functions. Checked 12 October 2026.
• Financial Sector Conduct Authority and Prudential Authority: Clause 2 of Joint Standard 1 of 2024 defines a material function as a function or activity relating to an insurer's business that has the potential to have a significant impact on the insurer's business operations or its ability to manage risks effectively, should it be disrupted. Checked 12 October 2026.
• Financial Sector Conduct Authority and Prudential Authority: Clause 7.2 of Joint Standard 1 of 2024 says all functions of senior management and control functions, including heads of control functions, as set out in the Governance and Operational Standards for Insurers, are material functions. Checked 12 October 2026.
• Financial Sector Conduct Authority and Prudential Authority: Clause 7.1 of Joint Standard 1 of 2024 says that in assessing materiality an insurer should have regard to factors such as the impact of a provider's failure, the cost of the arrangement as a share of the insurer's total cost base, the difficulty of finding another provider or bringing the work in-house, the ability to meet regulatory requirements, the sharing of sensitive customer information, potential losses to policyholders, and any affiliation between insurer and provider. Checked 12 October 2026.
• Financial Sector Conduct Authority and Prudential Authority: Clause 5.8 of Joint Standard 1 of 2024 says an insurer retains responsibility and accountability for all regulatory obligations relating to a function or activity, whether or not it is outsourced. Checked 12 October 2026.
• Financial Sector Conduct Authority and Prudential Authority: Clauses 5.1 and 6 of Joint Standard 1 of 2024 require a board-approved outsourcing policy that sets limits on the types and overall level of outsourced functions and on outsourcing to the same person, sets criteria for appointing, renewing and terminating providers, and gives guidance on access, credit, compliance, conduct, contractual, concentration, country, exit, operational, reputation and strategic risk. Checked 12 October 2026.
• Financial Sector Conduct Authority and Prudential Authority: Clauses 5.3, 7.5 and 7.6 of Joint Standard 1 of 2024 require appropriate due diligence before an outsourcing arrangement is entered into, objective procurement and selection, and, for a material function, a provider with appropriate governance, risk management and internal controls, adequate operational capability and financial resources, appropriate contingency plans, and key persons who meet the fit and proper requirements of Prudential Standard GOI 4. Checked 12 October 2026.
• Financial Sector Conduct Authority and Prudential Authority: Clause 5.4 of Joint Standard 1 of 2024 says an insurer must not outsource a function, or maintain an outsourcing arrangement, if it may materially increase risks to the insurer, materially impair the quality of its governance framework, impair the Authorities' ability to monitor its compliance, or compromise the fair treatment of, or continuous and satisfactory service to, policyholders. Checked 12 October 2026.
• Financial Sector Conduct Authority and Prudential Authority: Clause 8.2 of Joint Standard 1 of 2024 says the notification of a material outsourcing arrangement must confirm that it complies with the insurer's outsourcing policy and is within the board's risk appetite, and give details of the arrangement, the provider, the remuneration or the basis on which it will be calculated, and the key risks and their mitigation. Checked 12 October 2026.
• Financial Sector Conduct Authority and Prudential Authority: Clause 9.1 of Joint Standard 1 of 2024 says an arrangement for a material function must be in writing and at least specify or provide for, among other items, its duration, the level and standard of service, the remuneration or its basis, reporting, monitoring, periodic performance reviews, continued access to information, confidentiality, privacy and security, sub-contracting, ownership of intellectual property, continuity if the provider enters curatorship, business rescue, insolvency or liquidation, access to the provider's premises and documents for the insurer and the Authorities, termination, indemnity and liability, dispute resolution and a reasonable termination period. Checked 12 October 2026.
• Financial Sector Conduct Authority and Prudential Authority: Clause 5.7 of Joint Standard 1 of 2024 says remuneration for outsourcing must not result in a function for which commission or a binder fee is payable being remunerated again, and must not be linked to the monetary value of insurance claims repudiated, paid, not paid or partially paid. Checked 12 October 2026.
• Financial Sector Conduct Authority and Prudential Authority: Clauses 10.5, 10.6 and 10.8 of Joint Standard 1 of 2024 require an insurer to notify the Authorities as soon as reasonably possible of material developments in a material outsourcing arrangement and, if it is terminated, within 7 days of termination, giving the reasons and explaining how the function will be performed afterwards. Checked 12 October 2026.
• Financial Sector Conduct Authority and Prudential Authority: Clause 12 of Joint Standard 1 of 2024 repeals Prudential Standard GOI 5: Outsourcing by Insurers and amends the other regulatory instruments listed in its Attachment 2. Checked 12 October 2026.
• Financial Sector Conduct Authority and Prudential Authority: Clause 11.4 of Joint Standard 1 of 2024 says that, subject to clause 11.3, an insurer must comply within 6 months from the commencement date, during which it must continue to comply with Prudential Standard GOI 5 as if it had not been repealed. Checked 12 October 2026.
• Prudential Authority and Financial Sector Conduct Authority: An outsourcing arrangement entered into before the commencement date (1 December 2024) must comply within 24 months of that date, that is by 1 December 2026, or on renewal or renegotiation, whichever comes first (clause 11.3). Checked 9 October 2026.
• South African Reserve Bank, Prudential Authority (issued by the Office of the Registrar of Banks): Paragraph 6.1 of Guidance Note 5/2014 says that under regulation 39 of the Regulations relating to Banks the board is ultimately responsible for corporate governance, which includes managing the risks of outsourcing material business activities (regulation 39(3)(p)), and that the board retains ultimate responsibility for an outsourced material function while the bank remains responsible for the related prudential requirements. Checked 12 October 2026.
• South African Reserve Bank, Prudential Authority (issued by the Office of the Registrar of Banks): Paragraphs 2.1 and 2.2 of Guidance Note 5/2014 define outsourcing as the use of a service provider, whether an affiliate within a corporate group or a third party, to perform on a continuing basis a business activity, service, function or process which could be undertaken by the bank, and say it includes the provision of IT systems or other IT services. Checked 12 October 2026.
• South African Reserve Bank, Prudential Authority (issued by the Office of the Registrar of Banks): Paragraph 3.1 of Guidance Note 5/2014 defines a material business activity or function as one that has the potential to have a significant impact on the bank's business operations or its ability to manage risks effectively should it be disrupted, and lists factors including financial, operational and reputational impact, cost, the difficulty of finding another provider and potential losses to customers; the wording matches the material function definition in Joint Standard 1 of 2024 (our comparison). Checked 12 October 2026.
• South African Reserve Bank, Prudential Authority (issued by the Office of the Registrar of Banks): Paragraph 4.6 of Guidance Note 5/2014 says the Office views critical functions and critical shared services, as defined in the note and set out in the bank's recovery plan, as material business activities for the purposes of the note. Checked 12 October 2026.
• South African Reserve Bank, Prudential Authority (issued by the Office of the Registrar of Banks): Paragraphs 6.5.1 and 6.5.2 of Guidance Note 5/2014 say all outsourcing arrangements should be in a documented, legally binding agreement reviewed by the bank's legal counsel, that the arrangement may not start before all parties sign, and list thirty minimum aspects for the contract and service level agreements, among them audit rights, customer complaints, confidentiality and security of information, offshoring arrangements, notification of financial difficulty and significant incidents, remedies including early exit, service levels and subcontracting; paragraph 6.5.3 says some of the aspects may not be applicable in all circumstances, but banks are expected to address all issues relevant to managing the risks of each arrangement to a feasible and reasonable extent. Checked 12 October 2026.
• South African Reserve Bank, Prudential Authority (issued by the Office of the Registrar of Banks): Paragraphs 6.5.3 and 6.5.4 of Guidance Note 5/2014 say the agreement for a material function must include an indemnity making subcontracting the provider's responsibility, including liability for a subcontractor's failure, and must not let the provider unilaterally cancel if a recovery or resolution action is taken. Checked 12 October 2026.
• South African Reserve Bank, Prudential Authority (issued by the Office of the Registrar of Banks): Paragraph 6.9.1 of Guidance Note 5/2014 says the outsourcing agreement should include the right for the Office to access information, including on-site visits at the service provider. Checked 12 October 2026.
• Financial Sector Conduct Authority and Prudential Authority: Joint Communication 2 of 2025, dated 25 July 2025, says the only cloud computing instruments published so far are the Prudential Authority's Directive 3 of 2018 and Guidance Note 5 of 2018 for banks, and that the Authorities are developing a cloud computing and data offshoring Joint Standard to be published for public comment. Checked 12 October 2026.
• South African Reserve Bank, Prudential Authority (issued by the Office of the Registrar of Banks): Paragraphs 4.2 to 4.4 of Guidance Note 5/2014 say the Office does not support outsourcing management oversight, governance and risk management; would not generally support outsourcing internal audit, which may be approved case by case but never to the current external auditor; and would prefer core banking and financial reporting IT systems not be outsourced, considering applications for prior written approval case by case. Checked 12 October 2026.
• South African Reserve Bank, Prudential Authority (issued by the Office of the Registrar of Banks): Paragraphs 2.4 and 4.5 of Guidance Note 5/2014 define offshoring as outsourcing a material business activity to a provider that conducts it outside South Africa, and say banks should notify the Office prior to offshoring material business activities. Checked 12 October 2026.
• Financial Intelligence Centre: Section 21(1) of the Financial Intelligence Centre Act requires an accountable institution, in the course of concluding a single transaction or establishing a business relationship and in accordance with its Risk Management and Compliance Programme, to establish and verify the identity of the client. Checked 12 October 2026.
• Financial Intelligence Centre: Section 21E of the Financial Intelligence Centre Act says an institution unable to complete customer due diligence may not establish a business relationship or conclude a single transaction, must terminate an existing relationship in accordance with its programme, and must consider making a report under section 29. Checked 12 October 2026.
• Financial Intelligence Centre: Public Compliance Communication 12A, Guidance on outsourcing of compliance activities to third-party service providers (24 March 2021), says accountable institutions remain fully accountable, responsible and liable for compliance failures resulting from an outsourcing arrangement, that this liability cannot be transferred to the provider, and that a provider which is itself an accountable institution does not absolve the institution. Checked 12 October 2026.
• Financial Intelligence Centre: Section 42(2)(d) and (n) of the Financial Intelligence Centre Act require the Risk Management and Compliance Programme to provide for the manner and processes by which identities are established and verified, and the manner in which and place at which records are kept; section 42(2B) requires the board, senior management or highest authority to approve the programme. Checked 12 October 2026.
• Financial Intelligence Centre: Section 42A(1) of the Financial Intelligence Centre Act requires the board of directors, or senior management where there is no board, to ensure compliance by the institution and its employees with the Act and the Risk Management and Compliance Programme. Checked 12 October 2026.
• Financial Intelligence Centre: Public Compliance Communication 12A says an institution may not use a provider to discharge its customer due diligence, reporting and registration obligations or its section 27 and 32 obligations, may not outsource senior management approval under sections 21F to 21H or the final approval of its risk assessment, and may outsource sanctions screening of client information provided the provider passes any match to the institution for reporting. Checked 12 October 2026.
• Financial Intelligence Centre: Paragraphs 2.6.3, 2.7 and 2.9 of Public Compliance Communication 12A say an outsourcing arrangement should be in a formal agreement and clearly indicated in the institution's Risk Management and Compliance Programme, that outsourcing differs from placing reliance on another accountable institution for shared clients (covered in PCC 43), and that compliance work between institutions in one group structure is not treated as outsourcing. Checked 12 October 2026.
• Financial Intelligence Centre: Section 24(1) to (3) of the Financial Intelligence Centre Act lets a third party keep the records on an accountable institution's behalf as long as the institution has free and easy access to them and they are readily available to the Centre and the supervisory body; the institution is liable if the third party fails, and must forthwith give the Centre and the supervisory body the prescribed particulars of the third party. Checked 12 October 2026.
• Financial Intelligence Centre: Section 24(4) of the Financial Intelligence Centre Act says records kept in terms of sections 22 and 22A may be kept in electronic form and must be capable of being reproduced in a legible format. Checked 12 October 2026.
• Financial Intelligence Centre: Paragraphs 6.2 and 6.4 of Public Compliance Communication 12A set out regulation 20 of the Money Laundering and Terrorist Financing Control Regulations, under which an institution that appoints a third party to keep records must without delay give the Centre and its supervisory body the third party's name, the person controlling access to the records, the address where they are kept and from which they are controlled, and the institution's liaison person; and advise against outsourcing the keeping of records of reports made under sections 28, 28A and 29. Checked 12 October 2026.
• South African Government (gov.za): Section 1 of POPIA defines an operator as a person who processes personal information for a responsible party in terms of a contract or mandate, without coming under the direct authority of that party. Checked 9 October 2026.
• South African Government (gov.za): Section 21(1) of POPIA requires a written contract between the responsible party and the operator that ensures the operator establishes and maintains the security measures in section 19. Checked 9 October 2026.
• South African Government (gov.za): Section 19 of POPIA requires the responsible party to identify all reasonably foreseeable internal and external risks to personal information and to establish, verify and update safeguards against them. Checked 9 October 2026.
• South African Government (gov.za): Section 20 of POPIA says an operator must process personal information only with the knowledge or authorisation of the responsible party and must treat it as confidential. Checked 9 October 2026.
• South African Government (gov.za): Section 21(2) of POPIA says the operator must notify the responsible party immediately where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person. Checked 9 October 2026.
• South African Government (gov.za): Section 22 of POPIA requires the responsible party to notify the Information Regulator and the data subject of a security compromise as soon as reasonably possible after it is discovered. Checked 9 October 2026.
• South African Government (gov.za): Section 72 of POPIA bars transferring personal information to a third party in a foreign country unless a listed ground applies, such as a recipient bound by a law, binding corporate rules or binding agreement giving adequate protection, or the data subject's consent. Checked 9 October 2026.
• Financial Sector Conduct Authority and Prudential Authority: Joint Standard 1 of 2024 (version 1), Banks Act Guidance Notes 5/2014 and 1/2026, Directive 3 of 2018, Directive 8 of 2016, Joint Communications 4 of 2023 and 2 of 2025, the FIC Act in the Centre's 2024 edition and Public Compliance Communication 12A were read for this guide on 12 October 2026. Checked 12 October 2026.