From CompliNEWS | Financial Services Intelligence Watch

Material IT and cyber incidents: The 24-hour clock is now a practical compliance test

The Financial Sector Conduct Authority (FSCA) and Prudential Authority have finalised the prescribed template and submission arrangements for reporting material IT and cyber incidents. Joint Notice 2 of 2026 took effect on 1 September 2026, supporting the existing IT governance and cybersecurity Joint Standards.

For financial services providers, the scope includes discretionary FSPs, encompassing Category II investment managers and Category IIA hedge fund managers, as well as Category I FSPs providing investment fund administration services. Ordinary Category I advisers and intermediaries are not automatically included solely because they hold an FSP licence. Other specified financial institutions are also covered.

The reporting process is staged. Initial notification is required within 24 hours following classification of an incident as material. A subsequent update must follow within 14 calendar days of notification to the responsible authority, with the full incident report submitted within an agreed timeframe. Affected FSPs must use the FSCA Joint Standards Submission Portal.

The template addresses operational disruption, compromised information, customer impact, third-party involvement, governance escalation and recovery. Firms should review their internal escalation arrangements, portal access and responsibilities now, including their ability to obtain timely information from outsourced IT providers.

There are practical points to manage carefully. The workbook records the detection timestamp but does not provide a dedicated field for the material-classification timestamp that starts the reporting clock. Firms should therefore retain both in their internal incident records. Early reports should also distinguish confirmed facts from preliminary assessments and information still under investigation.

The introduction of a standard template should improve reporting consistency, but completing it requires coordinated input from management, IT and compliance. Waiting for a final investigation before making the initial notification would undermine the staged reporting process.

The final notice, template and explanatory documents are available in the official FSCA–PA publication pack.

Cyber incident reporting: the 24-hour clock is now a practical compliance test

South Africa’s financial regulators have finalised the reporting arrangements for material IT and cyber incidents, turning an existing regulatory obligation into a defined operational process. For affected firms, the immediate question is whether their incident-response arrangements can deliver a regulatory notification while an incident is still unfolding.

Joint Notice 2 of 2026 took effect on 1 September 2026. Announced through FSCA–PA Joint Communication 5 of 2026, it prescribes the reporting template and submission channels supporting Joint Standard 1 of 2023 on IT governance and risk management and Joint Standard 2 of 2024 on cybersecurity and cyber resilience. These underlying standards were already effective from 15 November 2024 and 1 June 2025 respectively. September 2026 is therefore not the starting date for the broader governance obligations. Official communication and publication pack.

Asset managers are in scope—but not every Category I FSP
For the FAIS sector, the distinction matters. Discretionary FSPs are covered, bringing Category II investment managers and Category IIA hedge fund managers within the relevant scope. Category I FSPs providing investment fund administration services are also expressly identified.

It would nevertheless be incorrect to tell every Category I adviser or broker that this reporting requirement automatically applies. A Category I licence alone is not the test: the institution’s activities and any other regulated status must be considered.
The regime extends beyond asset managers to other specified institutions, including banks, insurers, collective investment scheme managers, market infrastructures, administrative FSPs, pension funds, pension fund administrators, OTC derivative providers and registered credit rating agencies. The final notice identifies the applicable submission routes. Joint Notice 2 of 2026.

The clock starts at material classification
The final Annexure A template requires initial notification within 24 hours following classification of an IT or cyber and information-security incident as material. A subsequent update is required within 14 calendar days of notification to the responsible authority. The full incident report follows within a timeframe agreed with that authority.

This is a staged process. The initial notification captures contact details and information about the incident, with additional cyber-specific information where relevant. Later reporting addresses impact, investigation, recovery and lessons learnt. A completed forensic investigation is not a prerequisite for the first notification. Final reporting template, available in the official publication pack.

Materiality remains a judgment requiring evidence. The notice focuses on disruption with actual or likely severe and widespread consequences for operations, customer services or the wider financial system. The authorities’ consultation responses confirm that classification rests with the institution and must reflect its circumstances. Firms should therefore document both the assessment and its timing; the classification trigger should not become an excuse to postpone assessment. Consultation report.

Readiness means more than saving the spreadsheet
For affected FSPs, submission is through the FSCA Joint Standards Submission Portal—not merely an email to the contact person named in the announcement.

Compli-Serve recommends testing the complete reporting process before an incident occurs. Who assesses materiality? Who authorises and submits the notification? Who acts if that person is unavailable? Can the IT provider supply reliable information quickly enough?

The template’s questions also make customer consequences important: compromised information, interrupted services, financial losses, customer communications and support all feature in the reporting process. A technical recovery does not, by itself, explain whether customers have been adequately protected.

The practical message is straightforward: review portal access, escalation arrangements, provider contracts and reporting responsibilities now. When a material incident occurs, investigating the problem and meeting regulatory deadlines must proceed together.