In the financial services world, technology is no longer a support function; it is the core of how institutions operate, serve customers and remain competitive.

From online banking platforms and digital insurance services to trading systems and customer databases, the financial industry is more digitally integrated than ever before

But with this transformation comes growing risks: system failures, data breaches, cyberattacks and internal fraud can threaten not only individual institutions but public confidence in the financial system as a whole.

Recognising these risks, South Africa’s financial regulators have stepped in to set a clear legal framework for how financial institutions should manage their technology and the risks associated with it. Enter Joint Standard 2 of 2024, officially titled the Information Technology (IT) Governance and Risk Management Requirements for Financial Institutions. This legal standard, issued jointly by the Financial Sector Conduct Authority (FSCA) and the Prudential Authority under the Financial Sector Regulation Act of 2017, came into effect on 15 November 2024.

The goal of the Joint Standard is simple yet crucial: to ensure that every financial institution – from major banks and insurers to smaller investment firms – has the right systems, people and processes in place to manage technology safely, responsibly and in compliance with modern best practices. But what does this mean in practice?

Risk register

At the heart of the new standard is the requirement for institutions to take a far more deliberate and structured approach to IT risk. One of the most important tools in this effort is what is called a risk register. This is a living document that records all the known risks to an institution’s IT systems, anything from outdated software to cyberthreats. More than just a checklist, the risk register must be actively used to monitor, review and report on these risks, especially those considered high priority. Regular updates are expected, and senior management, as well as the board, must be kept in the loop about what risks exist and what steps have been taken to address them.

To support this, institutions must also develop IT risk metrics and ways to measure and assess the level of exposure across different parts of the IT landscape. These metrics help create an overall risk profile for the organisation, giving leadership a clear, data-informed view of where the institution might be vulnerable. These assessments must consider actual past risk events, regulatory requirements and findings from internal or external audits.

The author, Obsidian Systems' Dawie Labuschagne — The author, Obsidian Systems’ Dawie Labuschagne

People, of course, remain central to how IT is managed and how it can fail. The Joint Standard places strong emphasis on people management, requiring institutions to screen, vet and assess all staff, contractors and service providers who have access to IT systems. It’s not enough for someone to just have a job title – they must be proven to be fit and proper, possess technical know-how, and be legally bound to protect confidential information. Furthermore, institutions must offer regular and relevant training to all these individuals. This training must be reviewed and updated at least once a year to reflect changing technologies and emerging threats. It’s a firm push by regulators to professionalise the IT environment and reduce risk through human accountability and competence.

The standard also demands a formal, structured IT service management framework. This includes how institutions manage software updates and releases, how they track and resolve problems, and how they prepare for and respond to incidents.

Institutions must have documented policies that govern how they run their IT operations day to day. These policies must be supported by processes that define, for example, how to log and monitor activity on critical systems, how to store and manage configuration data, and how to back up and restore systems in the event of failure.

Operational efficiency is a particular focus area. The regulation highlights the need to avoid system failures caused by simple manual errors. That means automating processes where appropriate, monitoring system performance and capacity proactively, and using data to detect and resolve issues before they become serious problems. Every institution is also expected to keep a complete and current inventory of all its IT assets – hardware, software and networks, and to understand how those components connect and depend on one another.

When things do go wrong and, in complex systems, they inevitably will, the Joint Standard requires financial institutions to follow a proper incident and problem management process. That means logging and categorising incidents, prioritising them based on how critical they are to business operations, and investigating the root causes to prevent future incidents. Simply putting out fires won’t be enough. Regulators want institutions to become problem solvers, not just problem responders.

This is not just about ticking compliance boxes. It’s about recognising that in the 21st century, technology risk is business risk and managing it well is the foundation of sustainable financial services. Get started now.