AI governance for South African financial institutions

The Prudential Authority and the Financial Sector Conduct Authority have not written AI-specific rules for South African financial institutions. They have published their first assessment of how the sector uses AI, and the instruments they already enforce reach AI systems. This guide sets out what the regulators have said, what already applies and the work that will hold up when sector guidance arrives.

What the regulators have said

On 24 November 2025 the FSCA and the PA published Artificial Intelligence in the South African Financial Sector, their first joint report on AI. Based on a 2024 survey of banks, insurers and investment managers, it found that 52% of banking institutions were actively using AI, followed by payment providers at 50%. It named data privacy, bias and discrimination, reputational risk and systemic vulnerabilities as the main risks, and regulatory uncertainty, skills shortages and difficulty with explainability and governance as constraints on adoption.

The report’s lessons learnt are the clearest statement of supervisory expectations so far.

• Explainability and transparency. Institutions are encouraged to use recognised explainability methods such as SHAP and LIME so that AI-driven decisions are understandable and auditable.
• Governance frameworks. Institutions should consider comprehensive governance structures, including strong data governance, model risk management and board-level oversight.
• Disclosure. Institutions should clearly disclose when AI is used in consumer-impacting decisions, such as credit assessments or insurance pricing.
• Regulatory coordination. The FSCA and PA want to work with the Information Regulator on alignment with POPIA.
• Ethical standards. Sector-wide guidance for ethical, fair and responsible AI is envisaged, with enhanced oversight to mitigate bias, inaccuracies and consumer harm.

What already applies

Three sets of existing rules reach AI systems in regulated institutions.

Joint Standard 1 of 2023 on IT governance and risk management, issued by the PA and FSCA under the Financial Sector Regulation Act and in force since 15 November 2024, makes the governing body responsible for IT governance and requires IT risk management. AI systems are IT systems, so their risks belong in that framework.

Joint Standard 2 of 2024 on cybersecurity and cyber resilience, in force since 1 June 2025, applies to AI systems and the data they use like any other system. Model inputs, training data and AI vendors are part of the attack surface.

POPIA applies wherever AI uses personal information. Section 71 limits decisions with legal consequences or a substantial effect that are based solely on automated profiling, and creditworthiness is one of the profiles it names. Section 72 governs sending personal information to offshore AI services, and section 22 requires security compromises to be reported. The POPIA and AI guide covers the rest.

Build the inventory first

Every expectation in the report, from board oversight to disclosure, depends on knowing what AI the institution runs. List every AI system and model, including those inside vendor products such as credit decisioning, fraud and AML monitoring, claims triage, chatbots and underwriting tools. For each, record the owner, the model and provider, the data it uses, the customers or decisions it affects and how much a person is involved. The AI system register guide covers the fields.

Put model risk and fairness on a footing

The report’s call for model risk management and its concern with bias point to the same work. Validate each material model before use and after material change, test outcomes across customer groups, and watch for drift once it is live. Write down who is accountable for each model and how often it is reviewed. The bias assessment guide and the drift monitoring guide cover the methods. Where a model decides on credit, cover or claims without a person involved, check it against section 71 and record which exception applies.

Tell customers and the board

The report expects clear disclosure when AI is used in consumer-impacting decisions. Decide, for each customer-facing system, what customers are told, when and how they can query an outcome. For the board, a short regular report on which AI systems are in use, which affect customers, what validation and monitoring found, and which third parties the institution depends on gives it the oversight the report describes. The board reporting guide covers what to include.

Manage the vendors

Most AI in financial institutions is bought. Joint Standard 1 makes the governing body responsible for IT risk, and AI bought from a vendor is part of that risk. POPIA section 21 requires a written contract making an operator maintain security measures. For each AI vendor, know the model behind the product, where data is processed, what notice you get of model changes and incidents, and how you would exit. The vendor AI risk guide covers the questions.

Where Aicura fits

Aicura is an AI governance platform. The AI register holds every system and model with its owner, vendor and the decisions it affects. Assessments record risk, impact and bias, monitoring watches drift and performance, vendor records sit beside the systems that rely on them, and incidents track each event to a final report. At Pro, assessment against ISO/IEC 42001 and the NIST AI RMF sits on the same records. Aicura does not assess against the Joint Standards or POPIA. It gives you the record the regulators’ expectations depend on, and the decisions stay with you.

Aicura is hosted on AWS in Sydney, Australia. POPIA section 72 governs transferring personal information there, and our data processing agreement sets out the safeguards that cover it.

A note on this page

This is Aicura’s reading of the FSCA and PA’s AI report and the instruments that apply to AI in South African financial institutions. It is not legal or regulatory advice. Read the report and the Joint Standards as published, and discuss how they apply to your institution with your advisers and your supervisor.