South Africa: Limited time left for retirement funds to comply with cybersecurity and cyber resilience requirements

On 17 May 2024, the Financial Sector Conduct Authority (FSCA) and the Prudential Authority (Authorities) published Joint Standard 2 of 2024: Cybersecurity and Cyber Resilience (Joint Standard available here). 

All financial institutions specified in the Joint Standard, including retirement funds, must comply with the requirements set out in the Joint Standard by 1 June 2025.  Financial institutions are required to, among other things, establish a:

• Cybersecurity Strategy and Framework
• Cybersecurity Policy
• Data Loss Prevention Policy
• Cryptographic Key Management Policy
• Cyber Incident Management Policy
• Security Access Control Policy

The FSCA said in its recently published Regulatory Strategy for 2025-2028 (available here), that it remains focused on what matters most, ‘protecting customers and strengthening the integrity and resilience of the financial system’.  Cybersecurity and cyber resilience remain among some of the key risks and vulnerabilities in the financial system.