South Africa’s Financial Regulator Is Waiting for Global AI Rules. Now What?

Artificial intelligence is already changing how financial institutions assess risk, detect fraud, serve customers and process information. But as these systems become more capable, they also introduce difficult questions about accountability, consumer protection, cybersecurity and the stability of the financial system.

South Africa’s financial regulators have been preparing for those questions without rushing to introduce a standalone set of AI rules. In September, Financial Sector Conduct Authority (FSCA) Commissioner Unathi Kamlana told Bloomberg that the regulator would wait for international guidance before determining its next steps.

That guidance has now arrived.

On 15 October 2026, the Financial Stability Board (FSB) published its final report on Sound Practices for Responsible Adoption of Artificial Intelligence. The report contains 12 recommended practices for financial institutions, covering governance, risk management, data, human oversight, cybersecurity and third-party dependencies.

The timing creates a new test for South Africa. Waiting for international alignment can reduce fragmentation and help regulators learn from other markets. But global guidance does not automatically become domestic law, and it cannot resolve every question arising from South Africa’s financial system.

The next phase will depend on how the FSCA, the Prudential Authority (PA) and the South African Reserve Bank (SARB) translate the international framework into local supervisory expectations.

The central issue is no longer whether a global reference point exists. It is what South Africa will do with it.

The FSCA’s position reflects a particular approach to regulating a technology that continues to evolve quickly.

In September, Kamlana said South African regulators wanted to align their approach with the FSB’s forthcoming work. The FSCA, PA and SARB were preparing a joint discussion paper intended to explain how AI-related governance principles could be incorporated into the financial sector’s regulatory framework, including specific consideration of agentic AI.

Kamlana also made clear that the FSCA preferred principles-based supervision to prescriptive AI rules, arguing that the technology was evolving too rapidly for a rigid approach to remain appropriate.

There is a practical rationale for that position. Financial institutions use AI in different ways, with different levels of risk. A system that helps staff summarise internal documents is not equivalent to one that influences credit decisions, detects suspicious transactions or takes actions on behalf of a financial institution.

A single set of highly specific technical rules could become outdated as systems and applications change. Principles-based regulation can instead establish expectations around accountability, fair customer outcomes, risk management and oversight, allowing institutions to apply them proportionately to their activities.

But flexibility has a cost. Broad principles can leave organisations uncertain about what supervisors expect in practice. If different institutions interpret the same principle differently, the result may be inconsistent controls and uneven protection for customers.

South Africa’s challenge is therefore to preserve flexibility while making expectations sufficiently clear to be tested, supervised and enforced.

The FSB’s final report is an international reference point, not a binding AI statute that automatically applies to every financial institution in South Africa.

The FSB coordinates the work of national financial authorities and international standard-setting bodies. Its stated purpose includes promoting effective regulatory and supervisory policies that support financial stability. Its October report encourages financial institutions to use the recommended practices when developing and refining their AI governance, risk-management and control frameworks.

The report is organised around two broad priorities.

The first concerns institution-wide governance. Boards and senior management should oversee how AI fits the organisation’s strategy, business model and risk appetite. Institutions should define responsibilities, integrate AI risks into existing risk-management arrangements, document AI use and adapt their controls as circumstances change.

The second covers the AI lifecycle, from selecting and developing systems to deploying and monitoring them. The FSB highlights risk assessment, data governance, explainability, performance evaluation, human oversight, cybersecurity and risks arising from external AI providers.

The approach is significant because it treats AI risk as an organisational responsibility rather than a technical problem that can be delegated entirely to a software vendor.

However, South Africa must still decide how those practices relate to existing laws, supervisory requirements and the responsibilities of its domestic authorities. The FSB guidance does not settle which controls should be mandatory locally, how compliance should be assessed or what consequences should follow a failure.

Those questions belong in the domestic regulatory process.

The regulatory debate is not taking place before adoption begins. The FSCA and PA’s November 2025 report, Artificial Intelligence in the South African Financial Sector, provides an initial picture of AI use across the industry. Based on a survey conducted in 2024, it reported that 52% of banking institutions were actively using AI and 50% of payment providers were doing so. The report also identified potential benefits in data analytics, operational efficiency and cybersecurity.

These figures are a baseline from the survey period, not a live measurement of adoption in October 2026. Even so, they show why regulators are moving beyond general discussions of future risk.

The same report identified concerns involving data privacy, bias, discrimination, reputational damage and systemic vulnerabilities. It also highlighted constraints on adoption, including regulatory uncertainty, skills shortages, explainability and governance challenges.

This combination matters. AI can help financial institutions process information more efficiently and identify patterns that conventional methods might miss. Yet a poorly governed system can reproduce errors at scale, produce outcomes that are difficult to explain or create dependencies that an institution cannot adequately monitor.

For customers, these risks can become tangible. An AI-assisted process may influence how a financial institution assesses an application, detects suspected fraud or directs a customer to a particular service. If the process is inaccurate or unfair, customers need a way to obtain an explanation, challenge the outcome and seek appropriate redress.

For institutions, AI introduces questions about model performance, data quality, operational resilience, cybersecurity and reliance on external providers. For regulators, the challenge is to determine whether existing controls are adequate when AI changes how decisions are made and services are delivered.

The relevant question is not simply how many institutions use AI. It is whether their governance and risk-management arrangements are keeping pace with that use.

One reason the forthcoming South African discussion paper matters is its planned attention to agentic AI.

Traditional AI applications may produce a prediction, recommendation or response for a person to review. Agentic systems can go further by using tools, interacting with other systems and carrying out multi-step tasks within a defined scope. Depending on their permissions, they may take actions with limited intervention at each step.

In financial services, that could eventually support activities such as handling routine service requests, coordinating compliance workflows or assisting with operational processes. But the same capabilities create additional risks if an agent acts on incorrect information, exceeds its intended scope or interacts with systems in an unsafe way.

A chatbot that gives a misleading answer is a different risk from an AI agent that can initiate transactions, change records or execute actions across several systems.

The FSB’s final guidance addresses this broader governance challenge through its emphasis on effective human oversight, risk assessment throughout the lifecycle, cybersecurity and third-party dependencies.

For South African regulators, the practical questions include how institutions should define the boundaries of an agent’s authority, which actions require human approval, how decisions and transactions should be recorded, and how an institution can intervene when a system behaves unexpectedly.

Human oversight must also be meaningful. If staff approve every AI recommendation without sufficient review, the existence of a human checkpoint may provide little real protection. Conversely, controls that require manual approval for every low-risk task could undermine the efficiency gains that made automation attractive.

A proportionate approach would distinguish routine, reversible actions from consequential decisions involving customers’ money, access to financial services or the institution’s operational resilience.

That is the kind of practical detail a domestic supervisory framework needs to clarify.

A central question for financial regulation is whether responsibility remains clear when a decision involves a complex chain of models, vendors, data providers and internal teams.

The FSB’s guidance places considerable emphasis on institution-wide governance, clearly defined responsibilities, documentation and third-party risk.

That emphasis matters because financial institutions may rely on external providers for foundation models, cloud infrastructure, data processing or specialised AI applications. Outsourcing the technology does not necessarily remove the institution’s exposure to the resulting risks.

A bank may purchase an AI service from a technology company, but it still needs to understand how the service affects its operations, what data it processes, what happens when the service fails and whether the provider’s controls are adequate for the intended use.

This creates a supervisory challenge. Regulators need sufficient visibility into the institution’s risk-management arrangements without assuming that every organisation must build its own AI systems or disclose commercially sensitive technical information indiscriminately.

The most useful local framework would identify the outcomes institutions must demonstrate, the evidence supervisors may reasonably expect and how requirements should scale with the materiality of the use case.

That would give boards and executives a clearer basis for assigning responsibility while allowing institutions to select technologies appropriate to their needs.

AI oversight in financial services is not the responsibility of a single institution acting in isolation.

The FSCA oversees market conduct and the fair treatment of financial customers. The Prudential Authority supervises the prudential soundness of regulated institutions, while the South African Reserve Bank has broader responsibilities connected to financial stability and the functioning of the financial system.

The regulators’ planned joint discussion paper is therefore important. AI can create risks that cross the boundary between customer outcomes and institutional resilience. A system might produce unfair results for individual customers while also creating operational or reputational exposure for the institution. More widely shared systems and dependencies may introduce risks that extend beyond one firm.

Coordination also matters where AI processing involves personal information. The FSCA and PA’s 2025 report identified cooperation with the Information Regulator as important for aligning AI governance with South Africa’s Protection of Personal Information Act (POPIA).

The aim should not be to create overlapping requirements that leave institutions unsure which authority to approach. It should be to establish a coherent set of expectations, with clear responsibilities for market conduct, prudential supervision, data protection and wider systemic concerns.

That is easier to promise than to deliver. The discussion paper will need to show how the authorities intend to coordinate their work and how institutions can navigate the resulting framework.

There is a difference between waiting for international guidance and waiting to begin domestic preparation.

The first can help avoid fragmented rules and make use of shared expertise. The second can leave institutions without clear expectations while their AI systems and dependencies continue to develop.

The FSB’s final report reduces one source of uncertainty by providing a common set of recommended practices. But it does not remove the need for South Africa to assess its own market, legal framework, supervisory capacity and consumer risks.

Nor does it guarantee that every international recommendation will fit every domestic circumstance. A framework designed for a range of financial systems must be adapted to the structure, capabilities and risks of the institutions operating locally.

South Africa’s earlier market scan provides a starting point, but a survey of adoption is not the same as a comprehensive assessment of governance maturity. Knowing that institutions use AI does not establish whether their boards oversee it effectively, whether their models are tested for unfair outcomes or whether their third-party dependencies are adequately managed.

The next stage should therefore turn the broad principles into questions supervisors can examine and institutions can answer with evidence.

That may include expectations for AI inventories, risk classification, board accountability, testing, incident management, vendor oversight and customer redress. The exact requirements should emerge from the domestic process rather than be assumed to have already been adopted.

The FSB report gives South Africa a foundation for the next stage of its work. The value of that foundation will depend on the clarity and practicality of the domestic framework that follows.

Five priorities stand out.

1. Clear expectations for high-impact uses. Institutions need to understand how supervisory scrutiny will differ between low-risk support tools and systems that materially affect customers, financial transactions or operational resilience.

2. Accountable human oversight. Guidance should clarify how responsibility is assigned, when human intervention is necessary and how institutions can demonstrate that oversight is effective rather than merely procedural.

3. Stronger governance of external AI providers. Institutions should be able to assess relevant dependencies, establish appropriate contractual and operational safeguards, and prepare for service interruptions or changes in provider arrangements.

4. Evidence-based supervision. Regulators need to identify what documentation, testing and monitoring demonstrate that an AI system is performing as intended and that material risks are being controlled.

5. Coordinated domestic implementation. The FSCA, PA, SARB and relevant data-protection authorities should work towards clear, complementary expectations that reduce uncertainty without creating unnecessary duplication.

These priorities would help connect high-level principles to the decisions financial institutions make every day. They would also allow the regulators to adapt their approach as the technology changes, without having to rewrite the entire framework whenever a new application emerges.

South Africa’s decision to await international guidance reflects a preference for coordination and principles-based supervision over rushing into prescriptive AI rules. The FSB’s publication on 15 October now gives the country a concrete reference point for its next steps.

But the report does not itself establish South African requirements, guarantee effective oversight or resolve the risks facing financial customers. Those outcomes will depend on the domestic regulatory process and on whether institutions can demonstrate that AI is governed as part of their wider responsibilities.

The balance is delicate. Rules that are too rigid can struggle to keep pace with innovation; expectations that are too vague can leave material risks inadequately controlled. A principles-based framework still needs clarity, evidence and credible supervision.

For South Africa, the next milestone should be a domestic framework that explains what responsible AI adoption means in practice, how institutions will be assessed and how the regulators will coordinate their work.

The global guidance has arrived. The next test is whether South Africa can turn it into clear expectations for its financial sector—and meaningful protection for the people who depend on it.