Regulatory Alerts2025-09-12
Joint Communication 3 of 2025
The Financial Sector Conduct Authority and Prudential Authority have issued a draft determination mandating a standardized notification template for material IT and cyber incidents under their 2023 and 2024 Joint Standards. Financial institutions must submit incident reports using this template, with stakeholder comments due by 5 October 2025 to designated regulatory email addresses. The directive streamlines compliance reporting and strengthens regulatory oversight of cybersecurity resilience across the financial sector.
Joint Communication 3 of 2025 For consultation - Determination of the notification template in terms of Joint Standard 1 of 2023 – IT Governance and Risk Management for Financial Institutions and Joint Standard 2 of 2024 – Cybersecurity and Cyber Resilience Requirements for Financial Institutions
- BACKGROUND 1.1 On 10 November 2023 and 17 May 2024, the Financial Sector Conduct Authority and the Prudential Authority (hereinafter collectively referred to as the Authorities) published Joint Standard 1 of 2023 – IT Governance and Risk Management for Financial Institutions1 and Joint Standard 2 of 2024 – Cybersecurity and Cyber Resilience Requirements for Financial Institutions2 respectively. 1.2 The Joint Standards enable the determination of notification requirements for financial institutions that are subject to the Joint Standards.
- PURPOSE 2.1 The purpose of this Joint Communication is to notify all interested parties of the publication of the following documentation for consultation: 2.1.1 Draft Determination of the Notification Template for Joint Standard 1 of 2023 – IT Governance and Risk Management for Financial Institutions and Joint Standard 2 of 2024 – Cybersecurity and Cyber Resilience Requirements for Financial Institutions, attached hereto as Annexure A; and 2.1.2 Draft Notification template for material IT and cyber incidents, attached hereto as Annexure B.
- CONSULTATION 3.1 Comments on the draft determination and notification template must be submitted to the Authorities using the comment template attached hereto as Annexure C. 1 Effective 15 November 2024. 2 Effective 1 June 2025.
3.2 Comments are due on 5 October 2025 and must be submitted to PA-Standards@resbank.co.za for the attention of Kalai Naidoo and FSCA.RFDStandards@fsca.co.za for the attention of Andile Mjadu. UNATHI KAMLANA FUNDI TSHAZIBANA Commissioner: Chief Executive Officer: Financial Sector Conduct Authority Prudential Authority DATE: 3/09/2025 DATE:3/09/2025