South Africa

Act No. 9 of 2017, or simply the Financial Sector Regulation Act, abbreviated as the FSR Act, is among the most vital statutes of South Africa. This groundbreaking piece of legislation transformed the regulatory framework of South Africa through the creation of the "Twin Peaks" system. For the purposes of ensuring the stability of the system and providing proper consumer protection, and learning from the 2008 global financial crisis, the Act separated the regulatory function into two institutions, namely the Prudential Authority (PA), located within the South African Reserve Bank, in charge of the welfare and soundness of entities, and the Financial Sector Conduct Authority (FSCA), which regulates market conduct and ensures the protection of the rights of financial consumers. FSR Act was continuously amended to deal with risks, and the last major amendments entered into force on 1 April 2024.

The Protection of Personal Information Act, Act Number 4 of 2013, commonly referred to as POPIA, is a South African data protection act that was put into place to safeguard the privacy of personal information by ensuring a balance between the constitutional right to privacy and business needs. Enforced by the independent Information Regulator, POPIA requires any entity, public or private, that processes the personal information of natural or juristic persons to follow eight lawful processing conditions, including accountability, purpose specification, and security. These entities face serious penalties for contravening the Act, including fines of up to R10 million or imprisonment for up to 10 years. The legislative framework for regulation is still evolving to keep up with the changing times of data, with significant changes introduced through the 2025 Amendment Regulations, which scrapped passive opt-out in direct marketing, and the 2026 March regulations regarding the processing of health information.

Companies Act, Act No. 71 of 2008, is the main corporate law of South Africa, providing for the creation of modern corporate legislation governing corporate governance, business rescue, and flexible regulation of private and public corporations. The Act is implemented mainly by the Companies and Intellectual Property Commission (CIPC) together with specialized regulatory authorities such as the Companies Tribunal and Takeover Regulation Panel, and provides a fine combination of commercial flexibility and directorial responsibility. Although the main Companies Act came into force as far back as 1 May 2011, it has undergone considerable modernization through numerous statutory amendments; the first stage of corporate amendments was introduced on 27 December 2024 concerning changes in operational provisions, including financial assistance to subsidiaries and share buy-backs, whereas a long-awaited transparency stage became fully operative on 22 May 2026.

The Financial Advisory and Intermediary Services Act (Act No. 37 of 2002), known across the board as the FAIS Act, is the primary market conduct legislation in South Africa for individuals and entities rendering financial advisory and intermediary services to consumers. The Act, administered and enforced by the Financial Sector Conduct Authority (FSCA), protects consumers by requiring businesses to be registered as Financial Service Providers (FSPs) and requiring their advisers to meet stringent "Fit and Proper" criteria of honesty, competence, and operations. While the primary Act was effective from 15 November 2002 and came into full operation in 2004, its regulations are always being upgraded using specific notices, and the most recent ones in administrative and operational aspects were effective on 1 July 2026 and 31 July 2026, respectively, through FAIS Notices 40, 43, and 54 of 2026.

The Financial Intelligence Centre Act (Act No. 38 of 2001), commonly referred to as FICA, is the South African Act of law that provides protection to the country’s financial system from money laundering and terrorist financing activities. The Financial Intelligence Centre (FIC) manages the FICA and implements it with the help of various sector-specific supervision organizations such as PA and FSCA. In terms of the Act, the Accountable Institution Designated under FICA has to be registered in goAML, create and implement the Risk Management and Compliance Programme (RMCP), perform Risk-Based Customer Due Diligence, and report high-value and suspicious cash transactions. The main Act has been in effect since 1 February 2002, with the customer verification requirements coming into effect in 2003; however, the Act is being consistently updated to combat financial crime activities. The last major revision came into operation on 7 September 2026 as per Directive 12, after several important changes were made in 2026 regarding FICA compliance, including Directives 10 and 11 as well as Proclamation 317.

The Banks Act (Act No. 94 of 1990) serves as the legislative basis for the banking industry in South Africa and is characterized by a tough regulatory regime for the licensing, regulation, and prudential supervision of deposit-taking institutions. Governed by the powers vested in the Prudential Authority (PA) at the South African Reserve Bank, the Banks Act ensures financial stability within the country with such provisions as operating the banks as public companies, compliance with international Basel-compliant capital adequacy ratios, and curatorship in cases of distress. Even though the primary act became effective on 1 February 1991, it is constantly restructured in accordance with modifications in the macroeconomic risk environment, and the most recent administrative modification took effect on 12 October 2026 under Directive 5 of 2026, where outdated notices have been systematically withdrawn following major modifications in 2026, including Directive 3 of 2026, which modified the interest rate risk requirement of the banking book.