SA: New IT Risk Standard Takes Effect for South Africa’s Financial Sector

South Africa’s financial sector faces a transformative moment as the Financial Sector Conduct Authority (FSCA) and the Prudential Authority implement the Joint Standard for IT Governance and Risk Management, effective 15 November 2024. This regulation addresses the escalating dependency on third-party software suppliers and the accompanying risks, ensuring the country’s financial institutions align with global IT governance and risk management protocols.

Strengthening IT Governance and Risk Management

The new Joint Standard requires banks, asset managers, and insurers to adopt stringent measures to safeguard operations and maintain service delivery. Institutions must address IT-related risks and demonstrate compliance within one year of the regulation’s enforcement. Non-compliance may lead to financial penalties or even the suspension of operating licenses.

Building Resilience Through Robust Measures

The regulation emphasizes a comprehensive approach to managing IT risks, including:

• Identifying and mitigating third-party vulnerabilities.
• Maintaining an inventory of critical service providers.
• Establishing and testing clear business continuity plans.

One key provision is ensuring continued access to essential software applications, even if a vendor fails. This underscores the growing importance of software escrow solutions, which provide financial institutions with a safety net for critical software.

Guy Krige, Executive Risk Consultant at ESCROWSURE, highlights the relevance of software escrow in addressing these requirements:
“Given the current scale of third-party risks, the regulation’s emphasis on business continuity is vital. Software escrow not only aids in compliance but offers financial institutions a lifeline during service disruptions or vendor insolvencies. Similar measures are mandated in markets like Singapore and India, where software escrow plays a central role in IT risk management.”

Software Escrow: A Strategic Compliance Tool

Software escrow involves depositing source code with a trusted third party, ensuring institutions retain access to critical software if a supplier defaults. By adopting escrow agreements, South African financial entities can safeguard operational continuity and meet regulatory obligations under the Joint Standard.

Krige adds:
“Incorporating software escrow into IT governance is a proactive step. It mitigates risks associated with supplier failure and ensures financial institutions can sustain operations while remaining compliant with the new regulations.”

Preparing for the Joint Standard on Cybersecurity

As financial institutions adapt to the IT Governance and Risk Management Joint Standard, they must also prepare for the upcoming Joint Standard on Cybersecurity and Cyber Resilience, effective 1 June 2025. This forthcoming regulation will focus on protecting financial entities from cyber threats, with a continued emphasis on third-party risk management.

Krige underscores the dual benefits of software escrow in addressing both current and future compliance needs:
“Software escrow positions institutions to handle evolving challenges, from IT governance to cybersecurity risks. By investing in these solutions now, companies enhance resilience, safeguard IT assets, and ensure continuity amidst an increasingly complex threat landscape.”

Conclusion

The implementation of the Joint Standard for IT Governance marks a pivotal step in fortifying South Africa’s financial sector. As institutions navigate this regulatory shift, solutions like software escrow offer a practical, cost-effective path to compliance and resilience. Looking ahead to 2025, the emphasis on cybersecurity will further elevate the importance of proactive risk management tools, ensuring financial institutions are well-equipped to thrive in an increasingly digital and interconnected world.