Financial services comes with a lot of acronyms. Here's what the main ones mean for your IT, in normal words. Think of us as your IT co-pilot: you stay in charge of compliance, we help with the technology that makes it possible.
EveryonePOPIA (Protection of Personal Information Act)
Keep personal information secure and tell the Information Regulator and affected people if it's compromised. Since 1 April 2025, those reports go through the Regulator's eServices portal.
How we help: access controls, encryption, backups, monitoring and help gathering the facts for a report.
FSPsFAIS (Financial Advisory and Intermediary Services Act)
FSPs need the "operational ability" to do the job, which includes technology, and must keep records for five years, safe and easy to retrieve.
How we help: reliable systems, secure storage and backups.
Accountable institutionsFICA (Financial Intelligence Centre Act)
Accountable institutions keep client identification and transaction records for at least five years. Electronic records are fine, and if someone else stores them, you're still responsible.
How we help: secure, searchable storage and retention settings.
Banks, insurers, CIS managers, Cat II and III FSPsJoint Standard 1 of 2023: IT governance and risk management
In force since 15 November 2024 for banks, insurers, collective investment scheme managers, and discretionary and administrative FSPs.
How we help: IT asset lists, risk registers, backup and continuity plans.
Wider listJoint Standard 2 of 2024: cybersecurity and cyber resilience
In force since 1 June 2025, for the same group plus pension funds, certain Category I FSPs that administer investment funds and a few others. From 1 September 2026, material incidents must be reported to the FSCA or Prudential Authority within 24 hours of being classified as material.
How we help: security controls, testing, and a clear incident runbook so the right people know what to do.
InsurersOutsourcing by insurers (Joint Standard 1 of 2024)
Insurers' contracts with IT providers must meet the standard.
How we help: clear service descriptions, security commitments and incident reporting to you.
Card paymentsPCI DSS
If you take card payments, version 4.0.1 applies, and its newer requirements have been mandatory since 31 March 2025.
How we help: keep card data out of email and spreadsheets and secure the devices around it.
This is a plain-language summary, not legal advice. Which rules apply depends on your licence and what you do, so please confirm with your compliance officer. NETCONFIG helps you meet the IT side; we don't certify or guarantee compliance.