Legal & Risk: What Businesses Need to Watch
2026‑09‑05
---
1. Crypto‑related share manipulation – a cautionary tale from the FSCA
The Financial Sector Conduct Authority’s (FSCA) decision to impose R10 million in penalties and a 20‑year debarment on Warren Wheatley over alleged share manipulation around Altvest shares is more than a headline. It underlines that any entity trading in digital assets, or even promoting them, must adhere to a rigorous KYC/AML regime under the Financial Intelligence Centre Act (FICA) and the FSCA’s own Code of Conduct.
What most businesses miss
- Ownership transparency – The debarment stemmed from undisclosed ownership structures that could facilitate illicit transfer. Companies offering crypto trading or investment products must disclose beneficial owners to both regulators and their clients, aligning with FICA’s “Know Your Customer” (KYC) obligations.
- Record‑keeping & reporting – Under the FSCA's regulatory framework, firms must maintain detailed transaction logs for a minimum of five years. A lapse can trigger enforcement action even if no actual loss is incurred by customers.
- Cross‑border compliance – Many South African fintechs source software or platforms from overseas providers. Without aligning with both SA and foreign data‑protection regimes (e.g., EU GDPR), they risk double sanctions for non‑compliance.
Compliance actions a CLO should flag
- Audit KYC/AML workflows to ensure that each customer’s identity, beneficial ownership, and source of funds are verifiable and logged per FICA standards.
- Implement an automated transaction monitoring system that flags anomalous patterns (e.g., rapid buying/selling of large block sizes) for review by compliance staff.
- Review all vendor agreements to embed clauses requiring suppliers to meet SA data‑protection requirements and to provide audit rights in the event of a regulatory investigation.
---
2. Fintech + insurance – the hybrid frontier
Hollard’s strategy to build “innovative insurance products for niche industries” within fintech platforms illustrates a growing trend: financial technology companies bundling coverage into their user journeys. While this offers customers greater convenience, it also places the firm at the intersection of two highly regulated sectors.
What most businesses overlook
- Dual regulatory obligations – Fintechs providing payment or lending services must comply with the Financial Advisory and Intermediary Services Act (FAIS) and the Payment System Operators Act, whereas insurers are governed by the Insurance Act 1 of 2007. Failure to satisfy both sets of rules can result in licence revocation for either activity.
- Data protection across product lines – Under the POPIA Act 4 of 2013, customer data used for underwriting and claims must be protected at a level commensurate with its sensitivity. Integrating this into a single digital platform often requires sophisticated consent mechanisms that capture granular purposes (e.g., “underwriting”, “claims processing”).
- Product liability & consumer protection – The Consumer Protection Act (CPA) imposes strict obligations on clear disclosure of coverage terms, pricing and claim procedures. A mis‑stated policy feature in a fintech UI can trigger civil claims for misleading advertising.
Compliance actions a CLO should flag
- Map regulatory touchpoints: Conduct a dual‑review exercise to confirm that the firm’s licensing structure covers both fintech services and insurance offerings.
- Strengthen data governance: Ensure that consent capture is granular, revocable, and that personal information is segregated or anonymised where possible before being shared with underwriting partners.
- Embed consumer‑rights checks into the product development lifecycle – e.g., automated testing for CPA‑required disclosures before a feature goes live.
---
3. Central bank independence – a macro‑risk for businesses
Andrew Bailey’s warning that populism poses a “serious challenge to independent central banks” is not just political rhetoric; it foreshadows potential volatility in monetary policy, interest rates and credit availability. For firms heavily exposed to short‑term funding or currency risk, this could mean sudden increases in borrowing costs or tighter lending standards.
Compliance actions a CLO should flag
- Scenario planning: Run stress tests that incorporate higher interest rate environments and reduced liquidity conditions.
- Currency hedging review: Verify that existing hedges remain cost‑effective if market volatility spikes.
- Capital adequacy monitoring: Ensure that projected regulatory capital ratios stay above thresholds even under tighter monetary policy.
---
Review Note
The post highlights regulatory trends and compliance gaps based on the articles cited. Interpretation of FSCA enforcement, cross‑sector licensing obligations, and macro‑policy implications should be verified with a qualified South African counsel or specialist regulator liaison to confirm applicability and to tailor remedial measures precisely for your business structure.
Sources