Cybercrimes Act, 2020 (Act No. 19 of 2020)

Chapter 8 : Reporting Obligations and Capacity Building

Purchase

(1)

An electronic communications service provider or financial institution that is aware or becomes aware that its electronic communications service or electronic communications network is involved in the commission of any category or class of offences provided for in Part I of Chapter 2 and which is determined in terms of subsection (2), must—

(a)	without undue delay and, where feasible, not later than 72 hours after having become aware of the offence, report the offence in the prescribed form and manner to the South African Police Service; and

(b)	preserve any information which may be of assistance to the South African Police Service in investigating the offence.

(2)	The Cabinet member responsible for policing, in consultation with the Cabinet member responsible for the administration of justice, must by notice in the Gazette, prescribe—

(a)	the category or class of offences which must be reported to the South African Police Service in terms of subsection (1); and

(b)	the form and manner in which an electronic communications service provider or financial institution must report offences to the South African Police Service.

(3)	An electronic communications service provider or financial institution that fails to comply with subsection (1), is guilty of an offence and is liable on conviction to a fine not exceeding R50 000.

(4)	Subject to any other law or obligation, the provisions of subsection (1) must not be interpreted as to impose obligations on an electronic service provider or financial institution to—

(a)	monitor the data which the electronic communications service provider or financial institution transmits or stores; or

(b)	actively seek facts or circumstances indicating any unlawful activity.

(5)	This section does not apply to a financial sector regulator or a function performed by the South African Reserve Bank in terms of section 10 of the South African Reserve Bank Act, 1989.