Authored by Nicole Britton and Michael McCarthy.
In August 2026, the Prudential Authority and the Financial Sector Conduct Authority published Joint communication 5 of 2026 which sets out the form, manner and period for the notification of material information that financial institutions must use for reporting material IT and cyber incidents’ as contemplated in Joint Standard 1 of 2023 (Information Technology (IT) Governance and Risk Management Requirements for Financial Institutions) and Joint Standard 2 of 2024 (Cybersecurity and Cyber Resilience Requirements).
The communication provides that an initial notification must be submitted to the relevant responsible authority within 24 hours of the financial institution classifying:
- an IT incident as material in accordance with the Information Technology Governance and Risk Management Requirements Joint Standard;
- a cyber and information security incident as material in accordance with the Cybersecurity and Cyber Resilience Joint Standard.
Thereafter, the relevant financial institution must provide the responsible authority with a root cause and impact analysis report, within 14 calendar days of the initial notification.
A full and final incident or investigation report must be provided to the responsible authority within time periods agreed with the responsible authority.
The template that must be submitted for the initial notification and the root cause and impact analysis report are set out Annexure A to the Determination. The manner in which financial institutions must submit the template to the responsible authorities is set out in a table in the Determination.
For an insurer and a controlling company, the template must be completed and submitted on the Prudential Authority’s Umoja Portal - the secure portal for electronic submission available on the Prudential Authority’s website.
For financial institutions regulated by the Financial Sector Conduct Authority, for example, FAIS category I financial services providers that provide investment fund administration services, the template must be completed and submitted on the Joint Standards Submission Portal.
The Joint Standards Submission Portal will be operational on 1 September 2026.
The comments document clarifies:
- that the reporting to the responsible authorities does not replace obligations to other applicable regulators such as the Information Regulator in terms of the Protection of Personal Information Act 2014.
- that the 24 hours is calculated from the time the incident is classified as material. Therefore, merely detecting an incident does not start the period.
- that the 24 hours are ordinary hours, and not business hours. Practically, if the incident is classified as “material” on a weekend or a public holiday, the 24 hours commences.
The Determination defines a material incident as referring to a disruption of a business activity, process or function which has, or is likely to have, a severe and widespread impact on the financial institution’s operations, services to its customers, or the broader financial system and economy. A classification should not be delayed.
According to the comment document: “The responsibility for the classification of a material incident rests with the financial institution and the definition provides some guidance on what constitutes materiality. The financial institution will also have to measure the impact and the severity thereof in terms of their own business practices and determine whether reporting is needed”.
The Determination took effect on 1 September 2026.