GOVERNANCE IN 60 SECONDS
South Africa will open its national payments system to non-bank operators, including telecoms, fintechs and retailers, from mid-2027.
The FSCA confirmed that existing financial institutions will be relicensed under the proposed COFI framework rather than having to submit fresh applications.
The FSCA provisionally withdrew the licences of FXNovus and The Grand Trading over Cyprus control concerns and launched an investigation into Sanus Financial Services.
New Consumer Protection Act Opt-Out Registry Regulations require direct marketers to implement monthly database cleansing and respect consumer opt-out preferences.
Proposed amendments to JSE Clear (Pty) Ltd rules under the Financial Markets Act are open for public comment until 22 October 2026.
Deloitte was fined £11 million by the UK Financial Reporting Council for failing to detect a £30 million taxpayer fraud during its audits of the Go-Ahead Group.
A Labour Court judgment exposed how a former V&A Waterfront executive fraudulently secured IT consultancy appointments for business associates, costing the organisation nearly R1.9 million.
The R54 billion Transnet corruption case remains on track, with the court rejecting attempts to have charges dropped.
HUB ECOSYSTEM UPDATE
The Hub wishes all governance professionals and students writing their 2026 examinations success and confidence as they enter exam week.
CS Professionals Hub is preparing for the 2027 Company Secretary route registration cycle. Prospective students planning to write Finance for Decision-Making (FDM) in 2027 may complete the 2027 CGISA Company Secretary Route Study Interest Survey to be considered for limited access to the Hub's recorded FDM tutorial sessions during November.
The 2027 Examination Preparation Programme will cover Finance for Decision-Making, Enterprise Risk Management, Risk and Compliance, Applied Governance, Corporate Law and Company Secretarial Practice. Each module will provide eight weeks of focused examination preparation, with two evening sessions per week leading into the relevant examination period.
Follow the instructions and complete the 2027 Company Secretary Route Study Interest Survey: https://lnkd.in/dZjVp2hh
COMING UP
Further details on the 2027 registration cycle to be announced.
GOVERNANCE RADAR
Development | Key Update | Status |
|---|---|---|
SARB opens payments system to non-banks | South Africa will allow non-bank firms, including telecoms, fintechs and retailers, to connect directly to the national payments infrastructure from mid-2027, ending banks' long-standing dominance of payments processing. | Rules expected November 2026; non-bank operators expected to go live around March 2027. |
COFI framework: existing licence holders won't reapply | The FSCA confirmed that existing financial institutions will be relicensed under the proposed COFI framework rather than having to submit fresh applications. | COFI Bill still before Parliament; financial institutions should prepare for unified conduct regulation. |
JSE Clear rule amendments under consultation | Proposed amendments to JSE Clear (Pty) Ltd rules under the Financial Markets Act were published for public comment, closing on 22 October 2026. | Consultation open; listed entities, clearing members and market participants should assess impact on clearing, settlement and risk-management processes. |
Consumer Protection Act Opt-Out Registry Regulations | The Department of Trade, Industry and Competition published guidelines for compliance with the new Opt-Out Registry Regulations under the Consumer Protection Act, effective from October 2026. | Regulations in force; direct marketers, retailers and financial institutions must implement monthly database cleansing and respect consumer opt-out preferences. |
When professional skepticism fails: Deloitte Audit Failure
THE GOVERNANCE LENS
Deloitte Audit Failure: When Professional Skepticism Fails
The UK Financial Reporting Council fined Deloitte £11 million (discounted to £6.05 million for early admission and cooperation) for failing to detect that the Go-Ahead Group had wrongfully retained over £30 million in taxpayer funds during audits conducted between 2016 and 2020. The regulator found that Deloitte failed to recognise the overpayment issue and failed to address the transport group's concerns.
The Governance Lens
Audit firms must exercise professional skepticism and challenge management assumptions, not merely accept explanations.
Audit committees should require evidence that auditors have tested for fraud indicators, not just compliance with procedures.
Boards should assess whether their audit firm has the independence and resources to challenge management effectively.
Regulators are increasingly holding auditors accountable for failing to detect material misstatements.
Organisations should ensure their audit function has the skills and mandate to identify fraud risk.
Developing Story
Deloitte Cyprus and Abramovich: Alleged Document Fraud and Tax Evasion Under Regulatory Scrutiny
A joint investigative exposé alleges Deloitte Cyprus staff falsified and backdated 1,000+ documents to conceal Roman Abramovich's assets and enable tax evasion; Cyprus's audit oversight board is now examining the allegations.
V&A Waterfront: Conflicts of Interest Require Active Management
A Labour Court judgment exposed how a former V&A Waterfront executive fraudulently secured IT consultancy appointments for her private business associates, costing the organisation nearly R1.9 million. A Deloitte forensic investigation into the executive's laptop uncovered extensive undisclosed private business activities conducted during working hours, including interviews and presentations for her own company.
The Governance Lens
Conflicts of interest must be actively disclosed and managed, not merely prohibited on paper.
Boards should require executives to declare outside business interests and monitor compliance.
Forensic investigations can uncover undisclosed conflicts that routine controls miss.
Organisations should implement controls to detect undisclosed related-party transactions.
Executive conduct policies must be enforced, not merely documented.
Payments system reform: New payments, new risks
GOVERNANCE INTELLIGENCE
Payments System Reform: New Competition, New Risks
South Africa's decision to open its national payments system to non-bank operators represents a major shift in the financial services landscape. Banks, fintechs, telecoms and retailers will all need to prepare for a more competitive, fragmented payments environment with new licensing, security and digital identity requirements.
The reform is intended to increase competition and innovation in payments, but it also introduces new risks around fraud, cybersecurity and consumer protection that boards must address.
Recommended Actions
Boards of banks should assess competitive exposure and strategic response.
Fintechs and retailers should prepare for licensing and compliance requirements.
All participants should review security, digital identity and fraud-prevention controls.
Boards should monitor the November 2026 publication of payment rules and exemptions.
COFI Framework: Preparing for Unified Conduct Regulation
The FSCA's confirmation that existing licence holders will be relicensed under the COFI framework rather than having to reapply reduces immediate compliance burden but does not eliminate the need for preparation. The COFI Bill aims to establish a single framework for regulating market conduct, replacing the fragmented system under which different types of institutions are regulated by different sectoral laws.
Financial institutions should prepare for a more integrated approach to conduct regulation that will apply consistently across the financial services sector.
Recommended Actions
Financial institutions should map their current conduct-risk profile against COFI expectations.
Boards should assess whether existing governance and compliance frameworks will meet unified conduct-regulation requirements.
Compliance officers should monitor COFI Bill progress and prepare for implementation.
Boards should ensure that conduct-risk reporting and remediation tracking are in place.
RESOURCE OF THE PERIOD
Moonstone: COFI – Existing Licence Holders Won't Have to Reapply
Overview
Moonstone's October 2026 analysis examines the FSCA's confirmation that existing financial institutions will be relicensed under the proposed COFI framework rather than having to submit fresh applications. The article explains what this means for financial institutions preparing for the new conduct-regulation framework.
Practical Benefit
The analysis assists boards, compliance officers and governance professionals in understanding the implications of the COFI framework for existing licence holders, including what preparation is required and what changes to expect.
Access Moonstone: COFI – Existing Licence Holders Won't Have to Reapply
KNOW AN ORGANISATION
WE SHOULD PARTNER WITH?
We're growing our partnership network and looking to our community for introductions.
If you know an organisation that should be working with The Hub Briefing, we'd appreciate the referral, or simply forward our partnership information to the right person.
References
One Platform. One GRC Ecosystem.
If this edition was valuable, consider sharing it with a colleague working in governance, company secretarial, risk, compliance or the legal profession.
Until next time,
The Editorial Team
The Hub Briefing