South African financial institutions now have 24 hours to tell their regulators about a material IT or cyber incident, and they must do it on a prescribed template. The determination published by the FSCA and the Prudential Authority took effect on 1 September 2026. It requires an immediate notification within 24 hours of an incident being classified as material, updates within 14 calendar days, and a full report on agreed timelines. The deadline is achievable. What will catch firms out is the content: the template asks about root cause, third-party involvement and exploited weaknesses, and those answers depend on preparation done long before the incident.
What did the FSCA and Prudential Authority publish?
FSCA-PA Joint Communication 5 of 2026, signed on 31 August 2026, announced three documents:
- Joint Notice 2 of 2026, the determination of the form, manner and period for notifying material IT and cyber incidents under Joint Standard 1 of 2023 on IT governance and Joint Standard 2 of 2024 on cybersecurity and cyber resilience;
- Annexure A, the Reporting of Material IT and Cyber Incident Template; and
- a consultation report responding to comments on the draft, which was first published on 12 September 2025.
The communication also states that the Prudential Authority will begin withdrawing Directive 2 of 2019, issued to banks under the Banks Act.
The determination defines a material incident as “a disruption of a business activity, process or function which has, or is likely to have, a severe and widespread impact on the financial institution’s operations, services to its customers, or the broader financial system and economy”.
What are the reporting deadlines?
The template’s instructions set out three stages:
- Immediate notification within 24 hours following the classification of an incident as material, covering contact details and incident details, plus a cyber-specific tab for cyber incidents.
- Subsequent updates within 14 calendar days from the date of notification, covering the impact of the incident.
- A full incident report on timelines agreed with the responsible authority, comprising all tabs and the final investigation report.
The clock runs from classification, not from detection. That makes the classification decision itself a governance control. An institution that has no documented materiality criteria, or no named person authorised to apply them, will either classify late or classify inconsistently. Both will be visible to the supervisor.
Which institutions must use it, and how?
Banks, mutual banks, insurers and their controlling companies submit through the Prudential Authority’s Umoja Portal. Collective investment scheme managers, market infrastructures, discretionary and administrative FSPs, Category I FSPs providing investment fund administration, pension funds and approved administrators, OTC derivative providers and registered credit rating agencies submit through the FSCA’s Joint Standards Submission Portal.
Access to these portals should be confirmed now. Discovering during an incident that the only registered user is on leave, or has left, is an avoidable failure.
What does the template ask that firms struggle to answer?
For cyber incidents, the template asks who discovered the incident and how, the origin of the threat, the cause, the category of attacker, the type of attack, whether it was a third-party compromise, and which vulnerabilities or weaknesses were exploited. It also asks what criteria were used to assess materiality and whether any other authority, such as the Information Regulator, has been notified.
None of these can be answered reliably without logs, an asset inventory and a working relationship with key suppliers. Recent evidence suggests many South African organisations are not there yet. In Sophos’s State of Ransomware in South Africa 2026, a survey of 135 organisations hit by ransomware, compromised credentials were the most common technical root cause (27% of attacks), followed by exploited vulnerabilities (25%) and malicious email (22%). A lack of protection was the most common operational root cause at 47%, the highest of any country surveyed, and only 40% of South African respondents recovered within a week, the lowest of any country surveyed.
Why does POPIA still apply alongside the Joint Standards?
The Joint Standards reporting regime is about operational and systemic impact. Section 22 of POPIA is about personal information. A ransomware incident at an insurer or administrator will usually engage both, on different thresholds and through different portals. The template’s question about notifying the Information Regulator is a reminder that supervisors expect both processes to run together. We covered the Regulator’s approach to post-breach assessments in our analysis of its SABS finding.
How does this connect to the Prudential Authority’s frontier AI warning?
In April the Prudential Authority told institutions that frontier AI compresses the time between vulnerability discovery and exploitation, and that boards should pre-define decision rights for containment and recovery. The 24-hour reporting window is the regulatory counterpart: incidents will move faster, and supervisors expect to hear about them faster. Our April analysis sets out those expectations.
What to do this quarter
- Document materiality criteria aligned to the determination’s definition, and name who may classify an incident as material, including out of hours.
- Confirm portal access for the Umoja Portal or the FSCA Joint Standards Submission Portal, with at least two registered users.
- Pre-populate the template with static information such as contacts, system descriptions and critical suppliers.
- Align the regulator and POPIA workflows so one incident team runs both notification decisions from the same facts.
- Close the root-cause gaps the template exposes: logging, asset inventory, multi-factor authentication and supplier notification clauses.
- Exercise the process end to end, finishing with a completed draft template inside 24 hours.
Frequently asked questions
What is the deadline for reporting a material cyber incident to the FSCA and Prudential Authority?
The immediate notification is due within 24 hours of classifying an incident as material. Updates follow within 14 calendar days, and a full report on timelines agreed with the authority.
What is a material incident under the Joint Standards determination?
A disruption of a business activity, process or function that has, or is likely to have, a severe and widespread impact on the institution’s operations, its customers, or the broader financial system and economy.
Which financial institutions must use the template?
Banks, insurers and their controlling companies, mutual banks, CIS managers, market infrastructures, discretionary and administrative FSPs, certain Category I FSPs, pension funds and administrators, OTC derivative providers and registered credit rating agencies.
Does reporting to the FSCA or Prudential Authority replace POPIA notification?
No. Where personal information may be compromised, section 22 of POPIA applies as well, and the template itself asks whether the Information Regulator has been notified.
How Rhentech can help
Our incident response service prepares materiality criteria, decision rights and pre-populated reporting packs, and supports classification and notification during a live incident. Our managed IT and cybersecurity service provides the logging and monitoring the template assumes you have.
To test whether your organisation could complete the template in 24 hours, book a free initial consultation. The consultation costs nothing; response planning and managed services are paid engagements scoped to your organisation.
Sources
- FSCA and Prudential Authority, Joint Communication 5 of 2026, signed 31 August 2026, published 1 September 2026.
- FSCA and Prudential Authority, Joint Notice 2 of 2026 and Annexure A, Reporting of Material IT and Cyber Incident Template, effective 1 September 2026.
- Sophos, The State of Ransomware in South Africa 2026, whitepaper dated July 2026.
- Engineering News, “Ransomware incident recovery times improve, but remain lengthy in South Africa”, 21 September 2026.
- Prudential Authority, Preparing for Frontier AI and AI-Accelerated Cyber Risk, 24 April 2026.
This article is for informational purposes. It does not constitute legal or regulatory advice. Consult qualified advisers for matters specific to your organisation.
Reviewed 20 October 2026.