South Africa's banks and fintech firms are facing tighter regulatory scrutiny, as the Prudential Authority (PA) steps up oversight of artificial intelligence (AI), cloud computing, cyber security and digital operational resilience amid the sector's rapid digital transformation.
This is according to the PA’s recently released 2025/26 Annual Report, which shows that technology risks in the financial sector have moved beyond the domain of IT departments and are now firmly embedded in prudential supervision.
The annual report outlines how the regulator is strengthening oversight of banks, insurers and other financial institutions, with a growing focus on technology risks such as AI, cloud computing, cyber security and operational resilience to safeguard SA’s financial stability.
Over the past year, the regulator introduced new standards covering cyber security and cyber resilience, cloud computing and data offshoring, while also conducting its first nationwide survey into AI adoption across the financial sector, notes the report.
It states the PA is increasingly concerned with how banks and insurers manage emerging technologies, third-party technology providers, data governance and cyber resilience, alongside more traditional financial risks such as capital adequacy and liquidity.
It also highlights growing supervisory attention on governance, skills shortages and model risk as institutions adopt increasingly sophisticated digital technologies.
"The PA uses supervisory judgement and forward-looking analysis to assess the resilience of financial institutions, how well they are governed and what risks they may pose to the wider financial system. Supervisory work is risk-based and proportionate, focused on identifying problems and detecting weaknesses early to act timeously and appropriately.”
The report notes that while SA’s financial system remains stable, technological change is increasing the complexity of supervision and the skills required at both board and executive level.
The PA, which operates within the South African Reserve Bank (SARB), is responsible for supervising banks, insurers, cooperative financial institutions, financial conglomerates and certain financial market infrastructures.
Its role is to ensure these institutions remain financially sound and resilient, while safeguarding financial stability and protecting depositors, policyholders and the broader financial system. As financial services become increasingly digital, the regulator is expanding its focus beyond traditional prudential risks to include cyber security, AI, cloud computing and operational resilience.
AI reshaping supervision
SA’s major banks Standard Bank, First National Bank, Absa, Capitec and Nedbank previously told ITWeb they are entering a new phase in their AI journey in 2026, shifting from pilot projects and isolated experiments, to large-scale deployment across core operations.
After years of testing machine learning and data-driven tools, the banks are now accelerating investment and integration of AI into fraud detection, customer service, risk management and digital platforms, signalling the technology is becoming central to competitiveness in the financial sector.
In the report, the PA says its AI survey conducted across financial institutions identified significant barriers to AI adoption.
“Among the biggest constraints are regulatory uncertainty, shortages of specialised AI skills and governance challenges as institutions attempt to deploy increasingly sophisticated technologies while maintaining compliance with prudential requirements.”
These findings reinforce a growing global trend in which financial regulators are encouraging innovation, while demanding stronger governance over AI systems that could influence lending decisions, fraud detection, insurance underwriting and customer interactions.
Rather than regulating technology in isolation, the PA says it is embedding digital risk into every aspect of prudential oversight.
“Effective supervision increasingly depends on understanding how financial institutions operate, the technologies underpinning their businesses and whether governance structures can keep pace with innovation.
“Digital transformation is also changing the risk profile of banks. As institutions expand across Africa, modernise legacy systems and adopt AI-enabled technologies, boards are expected to oversee increasingly complex operating environments while maintaining sound governance and risk controls.”
According to the report, strategic initiatives such as Pan-African expansion, restructuring programmes and acquisitions are increasing execution risk. These developments, combined with rapid digitalisation, mean boards require new technology capabilities and stronger governance frameworks.
"Governance, strategy and the robustness of risk management frameworks are areas that require continued attention. These reflect the growing complexity of banking groups, changing risk profiles and greater regulatory requirements.
“Supervisory engagement should focus on whether boards and senior management can maintain effective governance given the increasing intricacy of models, digitalisation and the swift adoption of new technologies requiring different skills.”
The report further states that retirement among experienced executives, combined with shortages of specialist skills, is affecting governance capacity. Skills gaps also remain in key risk and control functions, potentially limiting institutions' ability to oversee increasingly technology-driven business models.
According to the PA, strategic initiatives such as digitalisation, acquisitions and Pan-African expansion have increased execution risk, making governance capabilities more important than ever.
"Board- and executive-level retirement challenges to independence and shortages of experienced talent, especially in Africa region operations, remain areas of ongoing supervisory focus. Skills gaps in key risk and control functions persisted across some banks."
Data offshoring scrutiny
The growing reliance on cloud computing has also prompted the PA and the Financial Sector Conduct Authority to issue new regulatory guidance aimed at helping financial institutions manage the risks associated with outsourcing critical systems and storing data outside South Africa.
In July 2025, the regulators published Joint Communication 2 of 2025: Cloud Computing and Data Offshoring, signalling a more proactive approach to supervising technology infrastructure that increasingly sits outside financial institutions' own data centres, notes the PA report.
“The guidance reflects the rapid migration of banking and insurance workloads to cloud environments, where institutions benefit from greater scalability and computing power but also face new operational, security and jurisdictional risks. The communication encourages institutions to strengthen governance over outsourced technology services, understand where critical data resides and implement appropriate risk mitigation measures before migrating sensitive workloads.”
While the report does not prescribe specific cloud providers or technologies, it makes clear that cloud governance is becoming an integral component of prudential supervision as financial institutions increasingly depend on external technology partners to deliver critical services.
The regulator says it is participating in international work streams examining cyber resilience, climate risk and emerging technologies to ensure SA’s supervisory framework keeps pace with global developments.
As financial institutions continue their digital transformation journeys, the PA has made it clear that technology oversight will remain a central pillar of prudential supervision.
“For banks, insurers and fintechs, the message is clear: adopting AI, cloud computing and other digital technologies can improve efficiency and innovation, but those benefits must be matched by stronger governance, effective risk management and greater operational resilience,” notes the report.
The regulator says it intends publishing a discussion paper outlining its findings to promote greater consistency in model governance across the banking sector.
Share
