South Africa Financial Sector Assessment Program Technical Note On Cybersecurity Risk Supervision And Oversight

Cybersecurity risk continues to grow both in complexity and severity and is a function of an increasingly open and interconnected cyber and financial ecosystem. The South African financial system has a long history of incorporating technology and as for many financial systems across the globe, digitalization has become a strategic priority. For risk management to keep pace with the dynamic nature of cyber threats and threat agents, systemically important financial institutions (SIFIs) have made substantial investments in cyber resilience programs (e.g., establishing cyber strategies, frameworks, and governance structures). Consistent with many jurisdictions, and partly a result of widespread remote working arrangements implemented in response to the global pandemic, cybersecurity threats to financial stability increased. However, high standards of risk management meant threats did not materialize into significant losses and/or disruptions.

Sweden: Financial Sector Assessment Program-Technical Note on Cybersecurity Risk Supervision and Oversight

South Africa has made significant progress in strengthening its macroprudential policy framework and foundations since the 2014 FSAP. Institutional arrangements were overhauled by the 2017 Financial Sector Regulations Act that, among others, introduced the current ‘Twin Peaks’ structure, provided SARB with a strong financial stability mandate, and sought to foster interagency coordination and collaboration (including via the establishment of the Financial System Council of Regulators. As a result, South Africa has a hybrid macroprudential policy framework that combines a ‘strong’ decision maker in the SARB Governor, but that is importantly supported by an advisory committee structure, fostering effective cooperation and coordination. Systemic risk monitoring has also been enhanced and some macroprudential policy tools phased-in.

This Technical Note discusses recommendations made during the Financial Sector Assessment Program (FSAP) for South Africa in the areas of contingency planning, crisis management, and bank resolution. The proposed scope of the new resolution regime and of the South African Reserve Bank’s (SARB) jurisdiction as the resolution authority remains unclear. It is suggested that authorities should consider focusing on all deposit-taking institutions and only those other financial institutions that are currently deemed systemic. Non-deposit-taking financial institutions that are not found to be systemic should be resolved by the Prudential Authority or the Market Conduct Authority, whichever is the lead regulator.

The Icelandic financial system is large, concentrated and interconnected - banks and Non-Bank Financial Institutions (NBFIs) - domestically and internationally. There are 10 banks: 4 commercial banks and 6 savings banks, but the system is dominated by just three of the commercial banks (Arion banki, Íslandsbanki and Landsbankinn) that together account for 95 percent of banking assets. Cash use is declining as a percentage of point of sale (POS) transactions, leading to an increasing dependence on electronic payment means. The debit and credit cards used for most retail transactions rely on international communications with Visa and Mastercard.

The implementation of a twin peaks model represents a significant change to the South African financial supervisory architecture. The Prudential Authority (PA), operating within the administration of the South African Reserve Bank (SARB), is responsible for promoting and enhancing the safety and soundness of financial institutions that provide financial products and securities services. A separate authority, the Financial Sector Conduct Authority2 (FSCA), is responsible for market conduct regulation and supervision. The introduction of the twin peaks architecture was motivated by a need to increase the robustness of the financial sector regulatory and supervisory system, reinforce financial stability, improve protection of customers, and enhance cooperation among the regulators.

This Technical Note sets out the findings and recommendations of the Financial Sector Assessment Program (FSAP) for South Africa on financial safety net and crisis-management arrangements. It primarily focuses on the arrangements for early intervention, recovery, resolution, and financial safety nets for banks in South Africa. To a lesser extent, the note also addresses issues relating to recovery and resolution applicable to insurers and Financial Market Infrastructure (FMI).

This Technical Note analyzes over-the-counter (OTC) derivatives market reforms in South Africa and identifies vulnerabilities that may potentially impact financial stability. South Africa is committed to reform its OTC derivatives market to reduce vulnerabilities and increase transparency. Reforms are being implemented through the Financial Market Act and Regulations for banks, reflecting the Basel III capital requirements. Swift progress on the consultation and issuance of FMA regulations, trade repository regulations, and related notices are warranted to proceed with reforming the OTC derivatives market. Secondary legislation still needs to be finalized and will contain requirements for financial market infrastructures.