Interesting Developments in Financial Technologies and Data Security in South Africa- A Three Part Series

World Wide Web day provides an opportunity to recognize the internet’s ability to connect people, ideas, and information all the while acknowledging persistent challenges like online privacy, cybersecurity, misinformation, and the digital divide. Addressing these issues will ensure the continued facilitation of convenient communication and  accessibility to information and communication on a global scale. We will be doing our part in raising awareness for financial institutions and customers alike of the risks carried by emerging financial technologies, specifically open finance, due to limited control over data sharing by third parties, including privacy breaches, contractual violations, and fraud. Over the month of August we will publish our three part series discussing interesting developments in financial technologies as it relates to data security.

Part 1: Open Finance FSCA Recommendations

Last year we published an article on the Implications of Open Finance on Data Protection in which we discussed the concept of open finance and its implications on data protection which is identified as one of the risks that would require legislative intervention.

At the time, the concept of open finance was still in its early development stage in South Africa. Fast forward a year, and the Financial Sector Conduct Authority (FSCA) has published the Open Finance – FSCA Policy Recommendations 2024 report (Open Finance Policy) which outlines the FSCA’s policy approach regarding Open Finance.

The FSCA recognised that data sharing is already taking place across the sector, and is likely to grow as financial institutions and FinTech’s evolve. The Open Finance Policy seeks to address the risks flowing from data-sharing and data-use which are not specifically addressed in any tailored regulatory framework for financial institutions already participating in the emerging open finance ecosystem in South Africa.

These risks are exacerbated by the fact that most third-party providers are not licensed as financial institutions, and therefore fall outside of the FSCA's regulatory framework.

The recommendations in the Open Finance Policy can be summarised as follows:

1. Participants in open finance should be regulated, and a mandatory approach implemented.
2. Participants in open finance should be licensed.
3. A suitable data-protection and consent framework must be put in place.
4. Appropriate risk management and disclosure frameworks must be developed.
5. Data protection and sharing standards must be developed.
6. Consumers must have access to information and recourse mechanisms.
7. An advisory group for open finance comprising of industry participants and other experts, should be established.

The Information Regulator, which is cited as one of the critical stakeholders engaging with the FSCA, submitted the following recommendations which seeks to align open finance with South Africa’s privacy laws:

1. Building on an existing POPI Act principle, the proposed framework on giving consent should ensure that when data subjects are presented with the option to share personal information for open finance purposes.
2. The requirement to undertake an impact assessment by Third Party Providers (TPPs) must be detailed to assist in identifying, understanding and mitigating all risks associated with processing personal information of data subjects in open finance.
3. Section 22 of the POPI Act on handling security compromises should be dissected to identify how risks which are likely to occur will be managed.
4. The POPI Act complaints procedure should be incorporated as one of important mechanisms in handling complaints and dispute resolution arising from open finance.
5. The requirement on TPPs to provide evidence that any form of algorithmic decision-making does not exploit data subjects’ vulnerabilities, biases should be included.

The FSCA is set to host a series of engagements and workshops with stakeholders to further explore submissions made by the relevant stakeholders with respect to developing open Application Programming Interface (API) standards, developing suitable consent, risk management and disclosure frameworks, assessing the legal framework for weaknesses and gaps, building knowledge and awareness of responsible open finance in the sector, seeking insights relating to what the sector expects from the regulator, empowering consumers to respond to opportunities and risks in open finance, institutional arrangements between all relevant regulators and developing the enabling environment and infrastructure such as sandbox environments, open finance directories, and monitoring and data collection. The outcome of this exercise likely to result in legislative interventions in the open finance environment which will be implemented incrementally.

If you are a Fintech start-up or any other licensed financial services provider and want to know more about the topic or managing the data privacy risks associated with open finance, you can get in touch with our Technology, Media, and Telecommunications team, who can assist you with any queries.

Stay tuned for part two of the series.