TL;DR

  • The report: The Financial Sector Conduct Authority and the Prudential Authority published South Africa’s first joint report on AI in financial services on 24 November 2025, based on roughly 2,100 survey responses from banks, insurers, investment firms, and payment providers.
  • Adoption is already ahead of the rulebook: Banks lead AI adoption at 52%, payment providers close behind at 50%, concentrated in operations, IT, risk, and compliance.
  • What the report signals: Explainability methods such as SHAP and LIME, board-level oversight, a working model risk structure, and data governance aligned to POPIA, named as the direction supervision is heading.
  • Status today: None of this is binding. Both regulators describe a discussion paper as the next step, with no date set yet.
  • The real risk: A survey signal is not a checklist, and an institution that waits for a binding rule ends up building governance evidence under examination pressure.
  • Honest caveat: This piece draws on the regulators’ own published summary and two independent legal reviews of the full report, not a line by line read of the PDF itself, so treat the specific coverage figures as reported by those sources.

Most South African banks and insurers building an AI governance file are building it against a rule that does not exist yet. That is a reasonable place to be stuck, except that FSCA and the Prudential Authority already told everyone what they will eventually ask for. Their first joint report on AI names the exact things a governance file needs to show, months before either regulator turns that signal into a binding requirement.

The gap between a signal and a rule is where the readiness work happens. This piece sets out what the report says, what stays open, and what a governance framework has to produce today so it holds up whenever the discussion paper lands.

What FSCA and the Prudential Authority said in their first joint AI report

On 24 November 2025, the Financial Sector Conduct Authority and the Prudential Authority published “Artificial Intelligence in the South African Financial Sector,” the first joint report either regulator has produced on the topic. It draws on roughly 2,100 survey responses collected from banks, insurers, investment firms, and payment providers, and it carries no binding force on its own.

South Africa regulates financial institutions under a twin peaks model. The FSCA supervises market conduct, how institutions treat their customers, while the Prudential Authority, housed within the South African Reserve Bank, supervises safety and soundness. A joint report from both means the finding applies across both mandates at once: how a model is governed, and how its outcomes are explained to the people it affects.

Where AI concentrates today, per the survey: established machine learning already runs deep in operations, IT, risk, and compliance functions, while generative AI is only beginning to move into productivity tools and customer-facing engagement. Banks lead overall adoption at 52%, with payment providers close behind at 50%.

Why a non-binding report still sets the standard an examiner reaches for

A report without legal force can still become the yardstick a supervisor uses in practice. FSCA and the Prudential Authority describe their intended approach as principle-based and outcomes-focused, with no fixed list of technical requirements published yet. Both regulators state that a discussion paper will follow to work through the specific regulatory questions. Neither has given a date.

That sequence, survey and report first, discussion paper next, binding guidance after, is the same shape most financial regulators follow before they legislate. It gives institutions a real runway, but only if they use it. A Baker McKenzie review of the report found that 45% of surveyed banks already plan AI investment of ZAR 30 million or more for 2026. Adoption is moving well ahead of any rule that would govern it, which is exactly the gap a supervisor examines first once the paperwork exists to ask.

What a governance framework has to show today

The report and the legal commentary that followed it point to the same five things, whether or not a binding rule exists yet.

Board-level oversight. The board needs genuine, current visibility into AI governance status, refreshed on the same cycle as other risk reporting it already reviews.

Explainability at the decision level. The report names methods such as SHAP and LIME specifically, so an AI-driven decision is understandable and auditable. A model that scores well on accuracy but cannot produce a reason for one specific decision fails this test.

A working model risk structure. Every model in production needs an owner, a tier, and a place in an inventory. A model nobody remembers to list is a model nobody is governing.

Data governance aligned to POPIA. Wherever a model touches personal information, the institution needs to show lineage, purpose limitation, and coordination with the Information Regulator.

Disclosure when AI affects a consumer’s outcome. When an automated decision changes what a customer is offered or charged, a plain language explanation has to be available on request.

AI governance checklist outlining five requirements: board-level oversight, decision-level explainability, model risk management, POPIA-aligned data governance, and disclosure when AI affects consumer outcomes.


Where this already gets tested: collections AI

The joint report speaks to AI governance across an entire institution. In one specific application, FSCA’s expectations have already moved past signal into detail. Collections AI at South African credit providers and insurers is already answering to a documented set of obligations around disparate impact monitoring and explainability, covered in FSCA’s collections-specific AI governance obligations and in the parallel piece on governance across three simultaneous regulatory frameworks.

That distinction matters for scoping. An enterprise-wide governance framework is not the same exercise as a collections-model governance file, and a board that treats the two as one project usually under-resources the broader one.

Five questions to ask before an examiner does

A short internal audit against the report’s own findings surfaces most of the gap early.

  1. Can the board name, without checking a slide deck, what AI governance status looks like right now?
  2. Can any single model’s decision be explained to the person it affected, in plain language, on request?
  3. Does every production model appear in one inventory, with an owner and a risk tier?
  4. Does the data feeding each model have documented lineage back to its POPIA classification?
  5. Would the answers to the first four questions hold up if a supervisor asked to see the evidence itself?

A “no” to any of these is ordinary, and considerably cheaper to fix now than after a discussion paper turns the signal into a specific requirement with a deadline attached.

What audit-grade governance looks like in practice

Audit-Grade AI for Regulated Industries describes a specific mechanism: every prediction carries an explanation at the point it is made, every model change moves through maker-checker approval before it reaches production, and the full lineage from data to decision sits in one immutable audit trail.

That same mechanism travels across regulators. A leading NBFC in India used it to rank borrowers by risk and focus collections on the highest-risk segment, producing a 116% improvement in collections and 86% predictive accuracy, deployed in two weeks. The regulator was different. The requirement it satisfied, evidence a validator or examiner can read, was the same one FSCA and the Prudential Authority are now signaling for South Africa.

If your board cannot yet see what its own governance file would show an FSCA examiner today, book a working session with our team to map the gap before the discussion paper closes it for you.

Sources

  1. Financial Sector Conduct Authority and Prudential Authority, “Artificial Intelligence in the South African Financial Sector,” 24 November 2025. https://www.resbank.co.za/en/home/publications/publication-detail-pages/media-releases/2025/artificial-intelligence-in-the-south-african-financial-sector
  2. ENSafrica, “FSCA and Prudential Authority publish landmark report on AI in South Africa’s financial sector,” 2025. https://www.ensafrica.com/news/detail/11119/fsca-and-prudential-authority-publish-landmar
  3. Baker McKenzie, “South Africa: Regulators assess AI in finance,” December 2025. https://www.bakermckenzie.com/en/insight/publications/alerts/2025/12/south-africa-regulators-assess-ai-in-finance
  4. iTuring case study, “Improve Collections and Optimize Efforts” (Leading NBFC in India): 116% collections improvement, 86% predictive accuracy, two-week deployment. https://ituring.ai/case-study/improve-collections-and-optimize-efforts/